Skip to content
This repository was archived by the owner on Jun 5, 2025. It is now read-only.

Commit c5dd0dd

Browse files
marcos-albornozmarcos-albornoz
authored
Merge pull request #67 from Venafi/VaaS-Keystore
Support for VaaS keystore
2 parents e3f1a65 + 0d57906 commit c5dd0dd

15 files changed

Lines changed: 707 additions & 168 deletions

File tree

‎pom.xml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
</distributionManagement>
6262

6363
<properties>
64-
<lombok.version>1.18.6</lombok.version>
64+
<lombok.version>1.18.20</lombok.version>
6565
<bouncycastle.version>1.67</bouncycastle.version>
6666
<feign.version>10.4.0</feign.version>
6767
<guava.version>30.1.1-jre</guava.version>
@@ -76,6 +76,7 @@
7676
<httpclient.version>4.5.13</httpclient.version>
7777
<httpcore.version>4.4.14</httpcore.version>
7878
<maverick-base.version>3.0.3-FINAL</maverick-base.version>
79+
<tweetnacl-java.version>1.1.2</tweetnacl-java.version>
7980
</properties>
8081

8182
<dependencies>
@@ -191,6 +192,11 @@
191192
<version>${maverick-base.version}</version>
192193
<scope>test</scope>
193194
</dependency>
195+
<dependency>
196+
<groupId>org.purejava</groupId>
197+
<artifactId>tweetnacl-java</artifactId>
198+
<version>${tweetnacl-java.version}</version>
199+
</dependency>
194200
</dependencies>
195201

196202
<build>
@@ -200,8 +206,8 @@
200206
<artifactId>maven-compiler-plugin</artifactId>
201207
<version>3.6.1</version>
202208
<configuration>
203-
<source>8</source>
204-
<target>8</target>
209+
<source>11</source>
210+
<target>11</target>
205211
</configuration>
206212
</plugin>
207213

‎src/main/java/com/venafi/vcert/sdk/certificate/CertificateRequest.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ public class CertificateRequest {
6464
private KeyPair keyPair;
6565
private CsrOriginOption csrOrigin = CsrOriginOption.defaultCsrOrigin();
6666
private String pickupId;
67+
private String certId;
6768
private ChainOption chainOption;
6869
private String keyPassword;
6970
private boolean fetchPrivateKey;

‎src/main/java/com/venafi/vcert/sdk/certificate/PEMCollection.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,15 @@
4141
import org.bouncycastle.openssl.bc.BcPEMDecryptorProvider;
4242
import org.bouncycastle.openssl.jcajce.JcaMiscPEMGenerator;
4343
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
44+
import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
4445
import org.bouncycastle.openssl.jcajce.JcePEMEncryptorBuilder;
46+
import org.bouncycastle.operator.InputDecryptorProvider;
4547
import org.bouncycastle.operator.OperatorCreationException;
4648
import org.bouncycastle.operator.OutputEncryptor;
4749
import org.bouncycastle.pkcs.PKCS12PfxPdu;
4850
import org.bouncycastle.pkcs.PKCS12PfxPduBuilder;
4951
import org.bouncycastle.pkcs.PKCS12SafeBag;
52+
import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;
5053
import org.bouncycastle.pkcs.PKCSException;
5154
import org.bouncycastle.pkcs.jcajce.JcaPKCS12SafeBagBuilder;
5255
import org.bouncycastle.pkcs.jcajce.JcePKCS12MacCalculatorBuilder;
@@ -329,6 +332,14 @@ public static SecretKeySpec passwordToCipherSecretKey(char[] password, byte[] iv
329332
byte[] key = keyFactory.generateSecret(spec).getEncoded();
330333
return new SecretKeySpec(key, SECRET_KEY_ALGORITHM);
331334
}
335+
336+
public static PrivateKey decryptPKCS8PrivateKey(PEMParser pemParser, String keyPassword) throws IOException, OperatorCreationException, PKCSException{
337+
PKCS8EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = (PKCS8EncryptedPrivateKeyInfo) pemParser.readObject();
338+
InputDecryptorProvider pkcs8Prov = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(keyPassword.toCharArray());
339+
JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
340+
PrivateKeyInfo decryptedPrivateKeyInfo = encryptedPrivateKeyInfo.decryptPrivateKeyInfo(pkcs8Prov);
341+
return converter.getPrivateKey(decryptedPrivateKeyInfo);
342+
}
332343

333344
@Data
334345
public static class RawPrivateKey {

‎src/main/java/com/venafi/vcert/sdk/connectors/ConnectorException.java‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
import static java.lang.String.format;
77

88
import java.util.List;
9+
import java.util.stream.Collectors;
10+
import java.util.stream.Stream;
911

1012
import com.venafi.vcert.sdk.VCertException;
1113
import com.venafi.vcert.sdk.certificate.CsrOriginOption;
@@ -384,5 +386,57 @@ public CAOrGUIDNotProvidedException() {
384386
super("CA template or GUID are not specified");
385387
}
386388
}
389+
390+
public static class PolicyMatchException extends ConnectorException {
391+
392+
private static final long serialVersionUID = 1L;
393+
394+
private static String formatArrayToString(String[] arrayOfStrings) {
395+
return Stream.of(arrayOfStrings).collect(Collectors.joining(",","[","]"));
396+
}
397+
398+
String policySpecificationAttribute;
399+
String[] policySpecificationAttributeValues;
400+
String policyAttribute;
401+
String[] policyAttributeValues;
402+
403+
public PolicyMatchException(String policySpecificationAttribute, String policySpecificationAttributeValues
404+
, String policyAttribute, String[] policyAttributeValues) {
405+
this(policySpecificationAttribute, new String[] {policySpecificationAttributeValues}, policyAttribute, policyAttributeValues);
406+
}
407+
408+
public PolicyMatchException(String policySpecificationAttribute, String[] policySpecificationAttributeValues
409+
, String policyAttribute, String[] policyAttributeValues) {
410+
411+
super(format("Specified %s %s, doesn't match with policy's specified %s %s"
412+
, policySpecificationAttribute, formatArrayToString(policySpecificationAttributeValues)
413+
, policyAttribute, formatArrayToString(policyAttributeValues)));
414+
415+
this.policySpecificationAttribute = policySpecificationAttribute;
416+
this.policySpecificationAttributeValues = policySpecificationAttributeValues;
417+
this.policyAttribute = policyAttribute;
418+
this.policyAttributeValues = policyAttributeValues;
419+
}
420+
}
421+
422+
public static class UndeterminedCertIdException extends ConnectorException {
423+
424+
private static final long serialVersionUID = 1L;
425+
426+
public UndeterminedCertIdException() {
427+
super("It wasn't possible to determine the certificate Id using the pickupId "
428+
+ "or the thumbprint from the CertificateRequest.");
429+
}
430+
}
431+
432+
public static class PickupIdOrThumbprintNotSetToGetCertIdException extends ConnectorException {
433+
434+
private static final long serialVersionUID = 1L;
435+
436+
public PickupIdOrThumbprintNotSetToGetCertIdException() {
437+
super("It's not being provided neither the pickupId or thumbprint "
438+
+ "in the CertificateRequest to determine the certificate Id.");
439+
}
440+
}
387441

388442
}

‎src/main/java/com/venafi/vcert/sdk/connectors/cloud/Cloud.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import com.venafi.vcert.sdk.connectors.cloud.domain.Application;
1313
import com.venafi.vcert.sdk.connectors.cloud.domain.CertificateDetails;
1414
import com.venafi.vcert.sdk.connectors.cloud.domain.CertificateIssuingTemplate;
15+
import com.venafi.vcert.sdk.connectors.cloud.domain.EdgeEncryptionKey;
1516
import com.venafi.vcert.sdk.connectors.cloud.domain.UserDetails;
1617
import com.venafi.vcert.sdk.connectors.cloud.endpoint.*;
1718
import com.venafi.vcert.sdk.utils.FeignUtils;
@@ -58,7 +59,7 @@ CloudConnector.CertificateRequestsResponse certificateRequest(@Param("apiKey") S
5859

5960
@Headers("tppl-api-key: {apiKey}")
6061
@RequestLine("GET /outagedetection/v1/certificates/{id}/contents?chainOrder={chainOrder}&format=PEM")
61-
Response certificateViaCSR(@Param("id") String id, @Param("apiKey") String apiKey,
62+
Response retrieveCertificate(@Param("id") String id, @Param("apiKey") String apiKey,
6263
@Param("chainOrder") String chainOrder);
6364

6465
@Headers({"tppl-api-key: {apiKey}"})
@@ -100,6 +101,14 @@ Response certificateViaCSR(@Param("id") String id, @Param("apiKey") String apiKe
100101
@Headers({"tppl-api-key: {apiKey}", "Content-Type: application/json"})
101102
@RequestLine("PUT /outagedetection/v1/applications/{id}")
102103
Application updateApplication(Application application, @Param("id") String id, @Param("apiKey") String apiKey);
104+
105+
@Headers({"tppl-api-key: {apiKey}"})
106+
@RequestLine("GET /v1/edgeencryptionkeys/{id}")
107+
EdgeEncryptionKey retrieveEdgeEncryptionKey(@Param("id") String id, @Param("apiKey") String apiKey);
108+
109+
@Headers({"tppl-api-key: {apiKey}", "Content-Type: application/json"})
110+
@RequestLine("POST /outagedetection/v1/certificates/{id}/keystore")
111+
Response retrieveKeystore(@Param("id") String id, KeystoreRequest keystoreRequest, @Param("apiKey") String apiKey);
103112

104113
static Cloud connect(String baseUrl) {
105114
return FeignUtils.client(Cloud.class,

0 commit comments

Comments
 (0)