net.maritimecloud.pki

Class CAHandler

java.lang.Object

net.maritimecloud.pki.CAHandler

public class CAHandler
extends Object

Constructor Summary

Constructors

Constructor and Description
CAHandler(CertificateBuilder certificateBuilder, PKIConfiguration pkiConfiguration)

Method Summary

Modifier and Type	Method and Description
void	createSubCa(String subCaCertDN) Creates a sub Certificate Authority for the MC PKI.
void	generateRootCRL(String outputCaCrlPath, String revocationFile) Generates a CRL for the root CA.
void	initRootCA(String rootCertX500Name, String crlUrl) Generates a self-signed certificate and saves it in the keystore and truststore.
List<RevocationInfo>	loadRevocationFile(String revocationFile) Loads a CSV file with information about revoked certificates into a RevocationInfo list.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CAHandler

public CAHandler(CertificateBuilder certificateBuilder,
                 PKIConfiguration pkiConfiguration)

Method Detail

createSubCa

public void createSubCa(String subCaCertDN)

Creates a sub Certificate Authority for the MC PKI. The certificate and keypair is placed in a "SubCaKeystore" defined in PKIConfiguration and in the truststore, also defined in PKIConfiguration. The SubCaKeystore will be created if it does not exist already, but the truststore is expected to exists already. It is also expected that a RootCaKeystore is defined in PKIConfiguration and exists.

Parameters:

subCaCertDN - The DN of the new sub CA certificate.

initRootCA

public void initRootCA(String rootCertX500Name,
                       String crlUrl)

Generates a self-signed certificate and saves it in the keystore and truststore. Should only be used to init the root CA. It is expected that info about the root keystore and the truststore is available in PKIConfiguration. If they already exists they will be overwritten!

Parameters:

rootCertX500Name - The DN of the new root CA Certificate

crlUrl - CRL endpoint

loadRevocationFile

public List<RevocationInfo> loadRevocationFile(String revocationFile)

Loads a CSV file with information about revoked certificates into a RevocationInfo list. The CSV file must use semi-colon for separation and in the format: serial-number;revocation-reason;date An example: 345678954765889809876543;cacompromise;2017-04-31

Parameters:

revocationFile - Path to the file that should be loaded.

Returns:

List of certificates that has been/should be revoked.

generateRootCRL

public void generateRootCRL(String outputCaCrlPath,
                            String revocationFile)

Generates a CRL for the root CA. It is expected that a RootCaKeystore is defined in PKIConfiguration and exists.

Parameters:

outputCaCrlPath - Output path where to place the CRL.

revocationFile - Path to the CSV file which contains revocation info.