Skip to content
This repository was archived by the owner on Jun 5, 2025. It is now read-only.

Commit a006b33

Browse files
mr-tronmr-tron
authored
Merge pull request #2 from opencredo/master
Vcert-java initial implementation
2 parents 3986e54 + 50c91ff commit a006b33

79 files changed

Lines changed: 5964 additions & 2 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Compiled class file
2+
*.class
3+
4+
# Log file
5+
*.log
6+
7+
# BlueJ files
8+
*.ctxt
9+
10+
# Mobile Tools for Java (J2ME)
11+
.mtj.tmp/
12+
13+
# Package Files #
14+
*.jar
15+
*.war
16+
*.nar
17+
*.ear
18+
*.zip
19+
*.tar.gz
20+
*.rar
21+
22+
# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
23+
hs_err_pid*
24+
25+
26+
.idea/
27+
*.iml
28+
target/

‎README.md‎

Lines changed: 143 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,143 @@
1-
# vcert-java
2-
Java library and SDK that simplifies integration with Venafi certificate services.
1+
# VCert-Java
2+
3+
<img src="https://www.venafi.com/sites/default/files/content/body/Light_background_logo.png" width="330px" height="69px"/>
4+
5+
VCert is a Java library, SDK, designed to simplify key generation and enrollment of machine identities
6+
(also known as SSL/TLS certificates and keys) that comply with enterprise security policy by using the
7+
[Venafi Platform](https://www.venafi.com/platform/trust-protection-platform) or [Venafi Cloud](https://pki.venafi.com/venafi-cloud/).
8+
9+
10+
11+
## Installation
12+
13+
The current version of this library can be install using
14+
15+
```
16+
mvn install
17+
```
18+
19+
20+
## Usage
21+
22+
A basic example of createing a certificate using the VCert java implementation.
23+
24+
```
25+
final Config config = Config.builder()
26+
.connectorType(ConnectorType.CLOUD)
27+
.zone("Default")
28+
.build();
29+
30+
final VCertClient client = new VCertClient(config);
31+
final Authentication auth = Authentication.builder()
32+
.apiKey("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")
33+
.build();
34+
35+
client.authenticate(auth);
36+
final ZoneConfiguration zoneConfiguration = client.readZoneConfiguration("Public");
37+
38+
39+
40+
// Generate a certificate
41+
CertificateRequest certificateRequest = new CertificateRequest().subject(
42+
new CertificateRequest.PKIXName()
43+
.commonName("opencredo.test")
44+
.organization(Collections.singletonList("Venafi, Inc."))
45+
.organizationalUnit(Arrays.asList("Engineering"))
46+
.country(Collections.singletonList("US"))
47+
.locality(Collections.singletonList("SLC"))
48+
.province(Collections.singletonList("Utah")))
49+
50+
.keyType(KeyType.RSA);
51+
certificateRequest = client.generateRequest(zoneConfiguration, certificateRequest);
52+
53+
54+
// Submit the certificate request
55+
String newCertId = client.requestCertificate(certificateRequest, "Default");
56+
57+
58+
// Retrieve PEM collection from Venafi
59+
final CertificateRequest pickupRequest = new CertificateRequest().pickupId(newCertId);
60+
PEMCollection pemCollection = client.retrieveCertificate(pickupRequest);
61+
System.out.println(pemCollection.certificate());
62+
63+
// Renew the certificate
64+
X509Certificate cert = (X509Certificate) pemCollection.certificate();
65+
String thumbprint = DigestUtils.sha1Hex(cert.getEncoded()).toUpperCase();
66+
final CertificateRequest certificateRequestToRenew = new CertificateRequest().subject(
67+
new CertificateRequest.PKIXName()
68+
.commonName("opencredo.test")
69+
.organization(Collections.singletonList("Venafi, Inc."))
70+
.organizationalUnit(Arrays.asList("Engineering"))
71+
.country(Collections.singletonList("US"))
72+
.locality(Collections.singletonList("SLC"))
73+
.province(Collections.singletonList("Utah")));
74+
75+
client.generateRequest(zoneConfiguration, certificateRequestToRenew);
76+
77+
final RenewalRequest renewalRequest = new RenewalRequest()
78+
.thumbprint(thumbprint)
79+
.request(certificateRequestToRenew);
80+
final String renewedCertificate = client.renewCertificate(renewalRequest);
81+
82+
// Retrieve PEM collection from Venafi
83+
final CertificateRequest renewPickupRequest = new CertificateRequest().pickupId(renewedCertificate);
84+
PEMCollection pemCollectionRenewed = client.retrieveCertificate(pickupRequest);
85+
System.out.println(pemCollectionRenewed.certificate());
86+
87+
88+
```
89+
90+
## Prerequisites for using with Trust Protection Platform
91+
92+
1. A user account that has been granted WebSDK Access
93+
2. A folder (zone) where the user has been granted the following permissions: View, Read, Write, Create, Revoke (for the revoke action), and Private Key Read (for the pickup action when CSR is service generated)
94+
3. Policy applied to the folder which specifies:
95+
1. CA Template that Trust Protection Platform will use to enroll certificate requests submitted by VCert
96+
2. Subject DN values for Organizational Unit (OU), Organization (O), City (L), State (ST) and Country (C)
97+
3. Management Type not locked or locked to 'Enrollment'
98+
4. Certificate Signing Request (CSR) Generation not locked or locked to 'Service Generated CSR'
99+
5. Generate Key/CSR on Application not locked or locked to 'No'
100+
6. (Recommended) Disable Automatic Renewal set to 'Yes'
101+
7. (Recommended) Key Bit Strength set to 2048 or higher
102+
8. (Recommended) Domain Whitelisting policy appropriately assigned
103+
104+
The requirement for the CA Template to be assigned by policy follows a long standing Venafi best practice which also met our design objective to keep the certificate request process simple for VCert users. If you require the abilty to specify the CA Template with the request you can use the TPP REST APIs but please be advised this goes against Venafi recommendations.
105+
106+
## Acceptance Tests
107+
108+
To run the acceptance tests the following environment variables must be set:
109+
110+
| NAME | NOTES |
111+
|------|-------|
112+
| VENAFI_USER | |
113+
| VENAFI_PASSWORD | |
114+
| VENAFI_TPP_URL | Only for TPP connector tests |
115+
| VENAFI_API_KEY | Taken from account after logged in |
116+
| VENAFI_CERT_COMMON_NAME | Used for cert creation, should match configured domains |
117+
| VENAFI_CLOUD_URL | Only for cloud connector tests |
118+
| VENAFI_ZONE | Only for cloud connector tests |
119+
120+
Acceptance test are executed with:
121+
```
122+
mvn "-Dtest=*AT" test
123+
```
124+
125+
126+
## Contributing to VCert
127+
128+
1. Fork it to your account (https://github.com/Venafi/vcert-java/fork)
129+
2. Clone your fork (`git clone git@github.com:youracct/vcert-java.git`)
130+
3. Create a feature branch (`git checkout -b your-branch-name`)
131+
4. Implement and test your changes
132+
5. Commit your changes (`git commit -am 'Added some cool functionality'`)
133+
6. Push to the branch (`git push origin your-branch-name`)
134+
7. Create a new Pull Request (https://github.com/youracct/vcert-java/pull/new/working-branch)
135+
136+
137+
## License
138+
139+
Copyright &copy; Venafi, Inc. All rights reserved.
140+
141+
VCert is licensed under the Apache License, Version 2.0. See `LICENSE` for the full license text.
142+
143+
Please direct questions/comments to opensource@venafi.com.

‎lombok.config‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
config.stopBubbling = true
2+
lombok.accessors.fluent=true

‎pom.xml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>com.venafi.vcert.sdk</groupId>
8+
<artifactId>venafi-vcert-java</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
11+
<properties>
12+
<lombok.version>1.18.6</lombok.version>
13+
<bouncycastle.version>1.61</bouncycastle.version>
14+
<feign.version>10.2.0</feign.version>
15+
<guava.version>23.0</guava.version>
16+
<log4j.version>2.11.2</log4j.version>
17+
<junit.version>5.3.1</junit.version>
18+
<mockito.version>2.25.1</mockito.version>
19+
<wiremock.version>2.22.0</wiremock.version>
20+
<wiremock-extension.version>0.4.0</wiremock-extension.version>
21+
<assertj.version>3.12.2</assertj.version>
22+
<ini4j.version>0.5.4</ini4j.version>
23+
</properties>
24+
25+
<dependencies>
26+
<dependency>
27+
<groupId>org.projectlombok</groupId>
28+
<artifactId>lombok</artifactId>
29+
<version>${lombok.version}</version>
30+
<scope>provided</scope>
31+
</dependency>
32+
33+
<dependency>
34+
<groupId>org.bouncycastle</groupId>
35+
<artifactId>bcprov-jdk15on</artifactId>
36+
<version>${bouncycastle.version}</version>
37+
</dependency>
38+
39+
<dependency>
40+
<groupId>org.bouncycastle</groupId>
41+
<artifactId>bcpkix-jdk15on</artifactId>
42+
<version>${bouncycastle.version}</version>
43+
</dependency>
44+
45+
<dependency>
46+
<groupId>io.github.openfeign</groupId>
47+
<artifactId>feign-gson</artifactId>
48+
<version>${feign.version}</version>
49+
</dependency>
50+
<dependency>
51+
<groupId>io.github.openfeign</groupId>
52+
<artifactId>feign-slf4j</artifactId>
53+
<version>${feign.version}</version>
54+
</dependency>
55+
56+
<dependency>
57+
<groupId>org.apache.logging.log4j</groupId>
58+
<artifactId>log4j-api</artifactId>
59+
<version>${log4j.version}</version>
60+
</dependency>
61+
<dependency>
62+
<groupId>org.apache.logging.log4j</groupId>
63+
<artifactId>log4j-core</artifactId>
64+
<version>${log4j.version}</version>
65+
</dependency>
66+
<dependency>
67+
<groupId>org.apache.logging.log4j</groupId>
68+
<artifactId>log4j-slf4j-impl</artifactId>
69+
<version>${log4j.version}</version>
70+
</dependency>
71+
72+
<dependency>
73+
<groupId>com.google.guava</groupId>
74+
<artifactId>guava</artifactId>
75+
<version>${guava.version}</version>
76+
</dependency>
77+
78+
<dependency>
79+
<groupId>org.junit.jupiter</groupId>
80+
<artifactId>junit-jupiter-engine</artifactId>
81+
<version>${junit.version}</version>
82+
<scope>test</scope>
83+
</dependency>
84+
<dependency>
85+
<groupId>org.junit.jupiter</groupId>
86+
<artifactId>junit-jupiter-params</artifactId>
87+
<version>${junit.version}</version>
88+
<scope>test</scope>
89+
</dependency>
90+
<dependency>
91+
<groupId>org.mockito</groupId>
92+
<artifactId>mockito-core</artifactId>
93+
<version>${mockito.version}</version>
94+
<scope>test</scope>
95+
</dependency>
96+
<dependency>
97+
<groupId>org.mockito</groupId>
98+
<artifactId>mockito-junit-jupiter</artifactId>
99+
<version>${mockito.version}</version>
100+
<scope>test</scope>
101+
</dependency>
102+
<dependency>
103+
<groupId>com.github.tomakehurst</groupId>
104+
<artifactId>wiremock-jre8</artifactId>
105+
<version>${wiremock.version}</version>
106+
<scope>test</scope>
107+
</dependency>
108+
<dependency>
109+
<groupId>com.github.JensPiegsa</groupId>
110+
<artifactId>wiremock-extension</artifactId>
111+
<version>${wiremock-extension.version}</version>
112+
</dependency>
113+
<dependency>
114+
<groupId>org.assertj</groupId>
115+
<artifactId>assertj-core</artifactId>
116+
<version>${assertj.version}</version>
117+
<scope>test</scope>
118+
</dependency>
119+
<dependency>
120+
<groupId>org.ini4j</groupId>
121+
<artifactId>ini4j</artifactId>
122+
<version>${ini4j.version}</version>
123+
</dependency>
124+
</dependencies>
125+
126+
<build>
127+
<plugins>
128+
<plugin>
129+
<groupId>org.apache.maven.plugins</groupId>
130+
<artifactId>maven-compiler-plugin</artifactId>
131+
<version>3.6.1</version>
132+
<configuration>
133+
<source>8</source>
134+
<target>8</target>
135+
</configuration>
136+
</plugin>
137+
138+
<plugin>
139+
<groupId>org.apache.maven.plugins</groupId>
140+
<artifactId>maven-surefire-plugin</artifactId>
141+
<version>3.0.0-M3</version>
142+
<executions>
143+
<execution>
144+
<id>integration-test</id>
145+
<goals>
146+
<goal>test</goal>
147+
</goals>
148+
<phase>integration-test</phase>
149+
<configuration>
150+
<includes>
151+
<include>**/*IT.java</include>
152+
</includes>
153+
</configuration>
154+
</execution>
155+
</executions>
156+
</plugin>
157+
</plugins>
158+
</build>
159+
160+
<repositories>
161+
<repository>
162+
<id>jitpack.io</id>
163+
<url>https://jitpack.io</url>
164+
</repository>
165+
</repositories>
166+
167+
</project>

0 commit comments

Comments
 (0)