Class UniqueKeyConstraint

  • All Implemented Interfaces:
    IConfigTemplate

    public class UniqueKeyConstraint
    extends EnrollConstraint
    This constraint is to check for publickey uniqueness. The config param "allowSameKeyRenewal" enables the situation where if the publickey is not unique, and if the subject DN is the same, that is a "renewal". Another "feature" that is quoted out of this code is the "revokeDupKeyCert" option, which enables the revocation of certs that bear the same publickey as the enrolling request. Since this can potentially be abused, it is taken out and preserved in comments to allow future refinement.
    Version:
    $Revision$, $Date$
    • Constructor Detail

      • UniqueKeyConstraint

        public UniqueKeyConstraint()
    • Method Detail

      • getDefaultConfig

        public java.lang.String getDefaultConfig​(java.lang.String name)
      • validate

        public void validate​(IRequest request,
                             org.mozilla.jss.netscape.security.x509.X509CertInfo info)
                      throws ERejectException
        Validates the request. The request is not modified during the validation. It will try to capture orig cert expiration info for renewal later. Renewal can be either renewal with same key or new key. In case of renewing with same key, the old cert record can be retrieved and used to fill original info such as original expiration date for use with RenewGracePeriodConstraint. In case of renewing with new key, it would be no different from regular enrollment Search by ICertRecord.ATTR_X509CERT_PUBLIC_KEY_DATA would tell us if its reusing the same key or not. If any cert with the same key in the repository is found to be revoked, then the request is rejected This contraint has to go before the RenewGracePeriodConstraint, but after any of the SubjectName Default and Constraint
        Specified by:
        validate in class EnrollConstraint
        Parameters:
        request - enrollment request
        info - certificate template
        Throws:
        ERejectException - request is rejected due to violation of constraint
      • getText

        public java.lang.String getText​(java.util.Locale locale)
        make a CRL entry from a serial number and revocation reason.
        Overrides:
        getText in class EnrollConstraint
        Parameters:
        locale - locale of the end-user
        Returns:
        a RevokedCertImpl that can be entered in a CRL. protected RevokedCertImpl formCRLEntry( BigInteger serialNo, RevocationReason reason) throws EBaseException { CRLReasonExtension reasonExt = new CRLReasonExtension(reason); CRLExtensions crlentryexts = new CRLExtensions(); try { crlentryexts.set(CRLReasonExtension.NAME, reasonExt); } catch (IOException e) { logger.debug("CMSGW_ERR_CRL_REASON "+e.toString()); // throw new ECMSGWException( // CMS.getLogMessage("CMSGW_ERROR_SETTING_CRLREASON")); } RevokedCertImpl crlentry = new RevokedCertImpl(serialNo, new Date(), crlentryexts); return crlentry; }
      • escapeBinaryData

        public static java.lang.String escapeBinaryData​(byte[] data)
      • isApplicable

        public boolean isApplicable​(PolicyDefault def)
        Description copied from class: PolicyConstraint
        Checks if this constraint is applicable to the given default policy.
        Overrides:
        isApplicable in class EnrollConstraint
        Parameters:
        def - default policy to be checked
        Returns:
        true if this constraint can be applied to the given default policy