santuario-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Kenneth Jensen <xml...@gmail.com>
Subject KeyResolver blues
Date Sat, 23 Apr 2005 20:01:03 GMT
Hep,

I'm still working on that XKMS thing, and I have run into some trouble
with retrieving a X509Certificate from a KeyInfo element. Maybe I
misunderstood how to use the xmlsec java API, so I'll post my code
here - if someone could take a look and tell me if I'm doing something
impossible.

Context: I'm trying to do a XKMS Register operation and inserting the
information into a simple MySQL database. The problem arises when I
try to get the Certificate out of the KeyInfo element - as shown below
in the comment.
My question is: Can't I use the KeyInfo.getX509Certificate() just like that?


Here is the method for inserting the Base64 encoded certificate:

private void insertX509Certificate( Connection conn,
PrototypeKeybinding proto, int keyinfoId)  throws SQLException,
XKMSException {
        String sqlString = "INSERT INTO x509certificate values( 0, ?,
?, ?, ?, ?)";
        PreparedStatement stmt = conn.prepareStatement( sqlString );
        stmt.setInt( 2, keyinfoId );
        X509Certificate cert = null;
        // check the certificate data before inserting it into the DB
        boolean badcert = false;
        try {
            CertificateFactory certFactory =
CertificateFactory.getInstance("X.509");
            KeyInfo ki = proto.getKeyInfo();
            cert = ki.getX509Certificate();  // <-- This throws
KeyResolverException ???
            stmt.setInt( 1, cert.getSerialNumber().intValue() );
            stmt.setString( 3, Base64.encode( cert.getEncoded() ) );
            stmt.setString( 4, cert.getSubjectDN().getName() );
            stmt.setString( 5, cert.getIssuerDN().getName() );
            stmt.setInt( 6, 0); // FIXME  issuer_id should not be 0
every time. :(
        } 
 // snip ...


And the Request document it is processing looke like this:

<?xml version="1.0" encoding="UTF-8"?>
<RegisterRequest Id="-2048387245" Nonce="VgSqzAAX7r+UhJlvrO597A=="
    OriginalRequestId="2088880619"
    Service="http://bea.itu.dk:8080/xkms/"
xmlns="http://www.w3.org/2002/03/xkms#">
    <PrototypeKeyBinding>
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
            <KeyName
xmlns="http://www.w3.org/2000/09/xmldsig#">Kenneth</KeyName>
            <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
                <X509Certificate xmlns="http://www.w3.org/2000/09/xmldsig#">
MIIFtzCCBJ+gAwIBAgIEP77GNTANBgkqhkiG9w0BAQUFADAxMQswCQYDVQQGEwJESzEMMAoGA1UE
ChMDVERDMRQwEgYDVQQDEwtUREMgT0NFUyBDQTAeFw0wNDAzMDExNDIzMjRaFw0wNjAzMDExNDUz
MjRaMHoxCzAJBgNVBAYTAkRLMSkwJwYDVQQKEyBJbmdlbiBvcmdhbmlzYXRvcmlzayB0aWxrbnl0
bmluZzFAMBkGA1UEAxMSS2VubmV0aCBBaG4gSmVuc2VuMCMGA1UEBRMcUElEOjkyMDgtMjAwMi0y
LTI1MDM1NTkzMzU1NzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO0WfYlnLEwUjTSo
W76NOTCVS204x2KX6sYAOa7rORLH+fBikLJ+yUFikJDEOde28WhswBzmDQs8SSvKS56QK2U/3PXt
Nk12qiyEdOxJzYvNLHLYvncuKIcaMoUp1YbldmaQYy2ScKOxC78lP7Ns7p8CIsygCezeMBL5NOYT
TXNYizQI1yFiuGBZi8qYvk2u8ya7ELq1audaDB7wssqsUuADrsijUD8vkiTbDhcI537LorGDDR8+
GiGxbUEJ9qcy9AisjzcVLnYW4MKiex2K4w1JB2Fb6ckfh5ULyCIiOlT3oyhTxCec1Oa/2K/lXEl8
zde/+ldb2gBPxEDc5Zqr9ZsCAwEAAaOCAowwggKIMA4GA1UdDwEB/wQEAwID+DArBgNVHRAEJDAi
gA8yMDA0MDMwMTE0MjMyNFqBDzIwMDYwMzAxMTQ1MzI0WjCCATcGA1UdIASCAS4wggEqMIIBJgYK
KoFQgSkBAQEBATCCARYwLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuY2VydGlmaWthdC5kay9yZXBv
c2l0b3J5MIHiBggrBgEFBQcCAjCB1TAKFgNUREMwAwIBARqBxkZvciBhbnZlbmRlbHNlIGFmIGNl
cnRpZmlrYXRldCBn5mxkZXIgT0NFUyB2aWxr5XIsIENQUyBvZyBPQ0VTIENQLCBkZXIga2FuIGhl
bnRlcyBmcmEgd3d3LmNlcnRpZmlrYXQuZGsvcmVwb3NpdG9yeS4gQmVt5nJrLCBhdCBUREMgZWZ0
ZXIgdmlsa+VyZW5lIGhhciBldCBiZWdy5m5zZXQgYW5zdmFyIGlmdC4gcHJvZmVzc2lvbmVsbGUg
cGFydGVyLjAVBgNVHREEDjAMgQprYWpAaXR1LmRrMIGQBgNVHR8EgYgwgYUwSqBIoEakRDBCMQsw
CQYDVQQGEwJESzEMMAoGA1UEChMDVERDMRQwEgYDVQQDEwtUREMgT0NFUyBDQTEPMA0GA1UEAxMG
Q1JMMTc3MDegNaAzhjFodHRwOi8vY3JsLm9jZXMuY2VydGlmaWthdC5kay9vY2VzLzEwNjk0Njcx
ODkuY3JsMB8GA1UdIwQYMBaAFGC1hexWZH4SGSdnHVAVS3OuO/kSMB0GA1UdDgQWBBQ8rlgJhuoO
3AKSRHZ/Zjbi+4lKTTAJBgNVHRMEAjAAMBkGCSqGSIb2fQdBAAQMMAobBFY2LjADAgOoMA0GCSqG
SIb3DQEBBQUAA4IBAQCYOZm9DILGgeHqIjIdoFOeW/2deijhJvVGzfc/JNilx2MUOtcOvhRRgkvY
bpCvffNMW4qyfZ94eNfRZKIrWRliDNT6u75WxAV0n0Fz07ksLHmD/RK1WsUv9xQ1ypWCrDTSmtBM
IOzc5HpLcMGtmA37I+plq1+YxQab7spd0wJZzlF31IxN1hyKMzteRMv4QGsmZ7AdstDi37bMfEbj
kg+vqoXr0ZOhk27u1crSsTYN7wA8bT54i1+q53u0icScRk46VY3umCRoYj9qFOw6qOneetnSZD3j
1f5qMNjCA3yVodY7RtosvNUxid2CfYF9cMyqBww4h4NDlzmucafvDsqx
</X509Certificate>
            </X509Data>
        </KeyInfo>
        <KeyUsage>http://www.w3.org/2002/03/xkms#Encryption</KeyUsage>
        <KeyUsage>http://www.w3.org/2002/03/xkms#Signature</KeyUsage>
        <UseKeyWith Application="urn:ietf:rfc:2633" Identifier="kaj@itu.dk"/>
        <RevocationCodeIdentifier>foo</RevocationCodeIdentifier>
    </PrototypeKeyBinding>
    <ResponseMechanism>http://www.w3.org/2002/03/xkms#Represent</ResponseMechanism>
</RegisterRequest>

Thanks. 
---
Cheers,
Kenneth

Mime
View raw message