org.dcache.xrootd.plugins.authn.gsi

Class CertUtil

java.lang.Object

org.dcache.xrootd.plugins.authn.gsi.CertUtil

public class CertUtil
extends Object

CertUtil - convenience methods for certificate processing

Author:

radicke, tzangerl

Constructor Summary

Constructors

Constructor and Description
CertUtil()

Method Summary

Methods

Modifier and Type	Method and Description
static String	certToPEM(byte[] der) Encodes to PEM format with default X.509 certificate header/footer
static String	computeHash(MessageDigest md, X500Principal principal) Computes the hash from the principal, using the passed-in digest (usually MD5).
static String	computeMD5Hash(X500Principal principal) Convenience method to compute a openssl-compatible md5 hash
static byte[]	fromPEM(String pem, String header, String footer) Decodes PEM by removing the given header and footer, and decodes the inner content with base64.
static List<X509Certificate>	parseCerts(Reader in) Parses a sequence of certificates from an input source and returns it as a list.
static String	toPEM(byte[] der, String header, String footer) Encodes to PEM.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CertUtil

public CertUtil()

Method Detail

fromPEM

public static byte[] fromPEM(String pem,
             String header,
             String footer)

Decodes PEM by removing the given header and footer, and decodes the inner content with base64.

Parameters:

pem - the full PEM-encoded data including header + footer

header - the header to be striped off

footer - the footer to be striped off

Returns:

the content in DER format

certToPEM

public static String certToPEM(byte[] der)

Encodes to PEM format with default X.509 certificate header/footer

Parameters:

der - the content to be encoded

Returns:

the PEM-encoded String

toPEM

public static String toPEM(byte[] der,
           String header,
           String footer)

Encodes to PEM. The content is base64-encoded and the header and footer is added.

Parameters:

der - the content to be encoded

header - the header line

footer - the footer line

Returns:

the PEM-encoded String

computeMD5Hash

public static String computeMD5Hash(X500Principal principal)

Convenience method to compute a openssl-compatible md5 hash

Parameters:

principal - the principal (either issuer or subject)

Returns:

the 8-digit hexadecimal hash string

computeHash

public static String computeHash(MessageDigest md,
                 X500Principal principal)

Computes the hash from the principal, using the passed-in digest (usually MD5). After applying the digest on the DER-encoded principal, the first 4 bytes of the computed hash are taken and interpreted as a hexadecimal integer in Little Endian. This corresponds to the openssl hash mechanism. Keep a cache of principals, as this method will often be called with the same principal (to avoid costly rehashing).

Parameters:

md - the digest instance

principal - the principal (subject or issuer)

Returns:

the 8-digit hexadecimal hash

parseCerts

public static List<X509Certificate> parseCerts(Reader in)
                                        throws IOException,
                                               GeneralSecurityException

Parses a sequence of certificates from an input source and returns it as a list. The cert list usually represents a 'certificate path', used to validate the chain of trust.

Parameters:

in - the input source

Returns:

a list of x509 certificates

Throws:

IOException - if an parse error occurs

GeneralSecurityException - if not certificates are found