Skip to content
This repository was archived by the owner on Jun 5, 2025. It is now read-only.

Commit 13d162c

Browse files
knikolov82knikolov82
authored
Cloud Recommended setting support (#10)
* Cloud Recommended setting support * Remove obsolete file * Bump library version and fix tests failure * Fix import package * Fix prepare certificate request when no key type in request * Change type of error args to be Object as they are not always string
1 parent 519f241 commit 13d162c

25 files changed

Lines changed: 160 additions & 418 deletions

‎examples/com/venafi/vcert/sdk/example/CloudClient.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
import com.venafi.vcert.sdk.certificate.CertificateRequest;
1212
import com.venafi.vcert.sdk.certificate.KeyType;
1313
import com.venafi.vcert.sdk.certificate.PEMCollection;
14-
import com.venafi.vcert.sdk.connectors.tpp.ZoneConfiguration;
14+
import com.venafi.vcert.sdk.connectors.ZoneConfiguration;
1515
import com.venafi.vcert.sdk.endpoint.Authentication;
1616
import com.venafi.vcert.sdk.endpoint.ConnectorType;
1717

‎examples/com/venafi/vcert/sdk/example/TppClient.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
import com.venafi.vcert.sdk.certificate.CertificateRequest;
1212
import com.venafi.vcert.sdk.certificate.KeyType;
1313
import com.venafi.vcert.sdk.certificate.PEMCollection;
14-
import com.venafi.vcert.sdk.connectors.tpp.ZoneConfiguration;
14+
import com.venafi.vcert.sdk.connectors.ZoneConfiguration;
1515
import com.venafi.vcert.sdk.endpoint.Authentication;
1616
import com.venafi.vcert.sdk.endpoint.ConnectorType;
1717

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>com.venafi.vcert.sdk</groupId>
88
<artifactId>vcert-java</artifactId>
9-
<version>0.1.2</version>
9+
<version>0.1.3</version>
1010

1111
<properties>
1212
<lombok.version>1.18.6</lombok.version>

‎src/main/java/com/venafi/vcert/sdk/VCertClient.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@
1212
import com.venafi.vcert.sdk.certificate.RevocationRequest;
1313
import com.venafi.vcert.sdk.connectors.Connector;
1414
import com.venafi.vcert.sdk.connectors.Policy;
15+
import com.venafi.vcert.sdk.connectors.ZoneConfiguration;
1516
import com.venafi.vcert.sdk.connectors.cloud.Cloud;
1617
import com.venafi.vcert.sdk.connectors.cloud.CloudConnector;
1718
import com.venafi.vcert.sdk.connectors.tpp.Tpp;
1819
import com.venafi.vcert.sdk.connectors.tpp.TppConnector;
19-
import com.venafi.vcert.sdk.connectors.tpp.ZoneConfiguration;
2020
import com.venafi.vcert.sdk.endpoint.Authentication;
2121
import com.venafi.vcert.sdk.endpoint.ConnectorType;
2222

‎src/main/java/com/venafi/vcert/sdk/VCertException.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import lombok.Data;
1111

1212
public class VCertException extends Exception {
13+
private static final long serialVersionUID = 1L;
1314

1415
public VCertException() {
1516
super();
@@ -71,6 +72,6 @@ private static class VenafiTppErrorResponse {
7172
private static class VenafiServerError {
7273
private int code;
7374
private String message;
74-
private Collection<String> args;
75+
private Collection<Object> args;
7576
}
7677
}

‎src/main/java/com/venafi/vcert/sdk/certificate/CertificateRequest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ public class CertificateRequest {
5454
private Collection<AttributeTypeAndValueSET> attributes;
5555
private SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.UnknownSignatureAlgorithm;
5656
private String friendlyName;
57-
private KeyType keyType = KeyType.defaultKeyType();
57+
private KeyType keyType;
5858
private int keyLength;
5959
private EllipticCurve keyCurve;
6060
private byte[] csr;
@@ -242,6 +242,7 @@ public boolean checkCertificate(Certificate certificate) throws VCertException {
242242
KeyType.from(certificate.getPublicKey().getAlgorithm()).X509Type();
243243

244244
if (keyPair != null && keyPair.getPublic() != null && keyPair.getPrivate() != null) {
245+
keyType = keyType == null ? KeyType.defaultKeyType() : keyType;
245246
if (keyType.X509Type() != publicKeyAlgorithm) {
246247
throw new VCertException(
247248
format("unmatched key type: %s, %s", keyType.X509Type(), publicKeyAlgorithm.name()));

‎src/main/java/com/venafi/vcert/sdk/connectors/Connector.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77
import com.venafi.vcert.sdk.certificate.PEMCollection;
88
import com.venafi.vcert.sdk.certificate.RenewalRequest;
99
import com.venafi.vcert.sdk.certificate.RevocationRequest;
10-
import com.venafi.vcert.sdk.connectors.tpp.ZoneConfiguration;
1110
import com.venafi.vcert.sdk.endpoint.Authentication;
1211
import com.venafi.vcert.sdk.endpoint.ConnectorType;
1312

‎src/main/java/com/venafi/vcert/sdk/connectors/ServerPolicy.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import com.venafi.vcert.sdk.SignatureAlgorithm;
1616
import com.venafi.vcert.sdk.certificate.EllipticCurve;
1717
import com.venafi.vcert.sdk.certificate.KeyType;
18-
import com.venafi.vcert.sdk.connectors.tpp.ZoneConfiguration;
1918
import com.venafi.vcert.sdk.endpoint.AllowedKeyConfiguration;
2019
import com.venafi.vcert.sdk.utils.Is;
2120

src/main/java/com/venafi/vcert/sdk/connectors/tpp/ZoneConfiguration.java renamed to src/main/java/com/venafi/vcert/sdk/connectors/ZoneConfiguration.java

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.venafi.vcert.sdk.connectors.tpp;
1+
package com.venafi.vcert.sdk.connectors;
22

33
import static org.apache.commons.lang3.StringUtils.isNotBlank;
44
import java.util.Collection;
@@ -15,7 +15,6 @@
1515
import com.venafi.vcert.sdk.certificate.CertificateRequest;
1616
import com.venafi.vcert.sdk.certificate.EllipticCurve;
1717
import com.venafi.vcert.sdk.certificate.KeyType;
18-
import com.venafi.vcert.sdk.connectors.Policy;
1918
import com.venafi.vcert.sdk.endpoint.AllowedKeyConfiguration;
2019
import com.venafi.vcert.sdk.utils.Is;
2120

@@ -36,14 +35,15 @@ public class ZoneConfiguration {
3635
// empty map
3736

3837
private String zoneId;
38+
private AllowedKeyConfiguration keyConfig;
3939

4040
/**
4141
* UpdateCertificateRequest updates a certificate request based on the zone configuration
4242
* retrieved from the remote endpoint
4343
*
4444
* @return
4545
*/
46-
public void updateCertificateRequest(CertificateRequest request) {
46+
public void applyCertificateRequestDefaultSettingsIfNeeded(CertificateRequest request) {
4747
CertificateRequest.PKIXName subject = request.subject();
4848
subject.organization(Entity.of(subject.organization(), organization).resolve());
4949
if (Is.blank(subject.organizationalUnit()) && !Is.blank(organizationalUnit)) {
@@ -55,7 +55,8 @@ public void updateCertificateRequest(CertificateRequest request) {
5555

5656
// apply defaults for settings that weren't specified and then make sure they comply with policy
5757
if (request.keyType() == null) {
58-
request.keyType(KeyType.defaultKeyType());
58+
request
59+
.keyType(keyConfig != null && keyConfig.keyType() != null ? keyConfig.keyType() : KeyType.defaultKeyType());
5960
}
6061

6162
switch (request.keyType()) {
@@ -69,8 +70,10 @@ public void updateCertificateRequest(CertificateRequest request) {
6970
break;
7071

7172
default:
72-
if (request.keyLength() < 2048) {
73-
request.keyLength(2048);
73+
if (request.keyLength() < KeyType.defaultRsaLength()) {
74+
request.keyLength(keyConfig != null && !Is.blank(keyConfig.keySizes())
75+
&& keyConfig.keySizes().get(0) >= KeyType.defaultRsaLength() ? keyConfig.keySizes().get(0)
76+
: KeyType.defaultRsaLength());
7477
}
7578
if (request.signatureAlgorithm() == SignatureAlgorithm.UnknownSignatureAlgorithm) {
7679
request.signatureAlgorithm(SignatureAlgorithm.SHA256WithRSA);
@@ -126,42 +129,37 @@ static Entity of(List<String> target, String source) {
126129
}
127130

128131
List<String> resolve() {
129-
if (Is.blank(target) && isNotBlank(source)) {
130-
return Collections.singletonList(source);
131-
} else if (!Is.blank(target) && isNotBlank(source) && !Is.equalsFold(target.get(0), source)) {
132-
return Collections.singletonList(source);
133-
}
134-
return target;
132+
return Is.blank(target) && isNotBlank(source) ? Collections.singletonList(source) : target;
135133
}
136134
}
137135

138136
public boolean validateCertificateRequest(CertificateRequest request) throws VCertException {
139137
if (!isComponentValid(policy.subjectCNRegexes(),
140-
Collections.singletonList(request.subject().commonName()))) {
138+
Collections.singletonList(request.subject().commonName()), false)) {
141139
throw new VCertException(
142140
"The requested CN does not match any of the allowed CN regular expressions");
143141
}
144-
if (!isComponentValid(policy.subjectORegexes(), request.subject().organization())) {
142+
if (!isComponentValid(policy.subjectORegexes(), request.subject().organization(), false)) {
145143
throw new VCertException(
146144
"The requested Organization does not match any of the allowed Organization regular expressions");
147145
}
148-
if (!isComponentValid(policy.subjectOURegexes(), request.subject().organizationalUnit())) {
146+
if (!isComponentValid(policy.subjectOURegexes(), request.subject().organizationalUnit(), false)) {
149147
throw new VCertException(
150148
"The requested Organizational Unit does not match any of the allowed Organization Unit regular expressions");
151149
}
152-
if (!isComponentValid(policy.subjectSTRegexes(), request.subject().province())) {
150+
if (!isComponentValid(policy.subjectSTRegexes(), request.subject().province(), false)) {
153151
throw new VCertException(
154152
"The requested State/Province does not match any of the allowed State/Province regular expressions");
155153
}
156-
if (!isComponentValid(policy.subjectLRegexes(), request.subject().locality())) {
154+
if (!isComponentValid(policy.subjectLRegexes(), request.subject().locality(), false)) {
157155
throw new VCertException(
158156
"The requested Locality does not match any of the allowed Locality regular expressions");
159157
}
160-
if (!isComponentValid(policy.subjectCRegexes(), request.subject().country())) {
158+
if (!isComponentValid(policy.subjectCRegexes(), request.subject().country(), false)) {
161159
throw new VCertException(
162160
"The requested Country does not match any of the allowed Country regular expressions");
163161
}
164-
if (!isComponentValid(policy.dnsSanRegExs(), request.dnsNames())) {
162+
if (!isComponentValid(policy.dnsSanRegExs(), request.dnsNames(), true)) {
165163
throw new VCertException(
166164
"The requested Subject Alternative Name does not match any of the allowed Country regular expressions");
167165
}
@@ -188,26 +186,28 @@ public boolean validateCertificateRequest(CertificateRequest request) throws VCe
188186
return true;
189187
}
190188

191-
private boolean isComponentValid(Collection<String> regexes, Collection<String> components) {
192-
if (regexes.size() == 0 || components.size() == 0) {
189+
private boolean isComponentValid(Collection<String> regexes, Collection<String> components, boolean optional) {
190+
if (regexes.isEmpty() || (optional && Is.blank(components))) {
193191
return true;
194192
}
195193

196-
for (String regex : regexes) {
197-
Pattern pattern;
198-
try {
199-
pattern = Pattern.compile(regex);
200-
} catch (PatternSyntaxException e) {
201-
// TODO log error
202-
return false;
203-
}
204-
for (String component : components) {
205-
Matcher m = pattern.matcher(component);
206-
if (m.matches()) {
207-
return true; // todo: that seems wrong. Check if all policy rules need to be matched, or
208-
// any one? (E.g.: Policy says location is [0]:Madrid,[1]:London - does it
209-
// need to match either or both?) Also, if we have locations 0:London, 1:
210-
// Brussels, 2: Madrid, won't this pass? Should it?
194+
if (components != null) {
195+
for (String regex : regexes) {
196+
Pattern pattern;
197+
try {
198+
pattern = Pattern.compile(regex);
199+
} catch (PatternSyntaxException e) {
200+
// TODO log error
201+
return false;
202+
}
203+
for (String component : components) {
204+
Matcher m = pattern.matcher(component);
205+
if (m.matches()) {
206+
return true; // todo: that seems wrong. Check if all policy rules need to be matched, or
207+
// any one? (E.g.: Policy says location is [0]:Madrid,[1]:London - does it
208+
// need to match either or both?) Also, if we have locations 0:London, 1:
209+
// Brussels, 2: Madrid, won't this pass? Should it?
210+
}
211211
}
212212
}
213213
}

‎src/main/java/com/venafi/vcert/sdk/connectors/cloud/CertificatePolicy.java‎

Lines changed: 0 additions & 123 deletions
This file was deleted.

0 commit comments

Comments
 (0)