From 3529f2601a0020e781582b6f2382c4798c967687 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 9 Feb 2016 18:41:40 +0100 Subject: [PATCH] Added CLIs to inspect PKCS #12 file. The pki pkcs12-cert-find and pki pkcs12-key-find commands have been added to list the certificates and keys in a PKCS #12 file. https://fedorahosted.org/pki/ticket/1742 --- base/java-tools/bin/pki | 9 +- .../src/com/netscape/cmstools/cli/MainCLI.java | 3 + .../com/netscape/cmstools/pkcs12/PKCS12CLI.java | 45 ++++++ .../netscape/cmstools/pkcs12/PKCS12CertCLI.java | 41 +++++ .../cmstools/pkcs12/PKCS12CertFindCLI.java | 124 +++++++++++++++ .../com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java | 43 +++++ .../netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java | 157 ++++++++++++++++++ .../src/netscape/security/pkcs/PKCS12Util.java | 176 +++++++++++++++++++++ 8 files changed, 597 insertions(+), 1 deletion(-) create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java create mode 100644 base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java diff --git a/base/java-tools/bin/pki b/base/java-tools/bin/pki index 4b8e69a55f38fa9a6e5272520b585e9ed7d23be1..ce322a2ec7b853e6beacc28c26bfe39e0875571a 100644 --- a/base/java-tools/bin/pki +++ b/base/java-tools/bin/pki @@ -29,10 +29,16 @@ def run_java_cli(args): # read RESTEasy library path value = subprocess.check_output( - '. /etc/pki/pki.conf && echo $RESTEASY_LIB', + '. /usr/share/pki/etc/pki.conf && . /etc/pki/pki.conf && echo $RESTEASY_LIB', shell=True) resteasy_lib = value.decode(sys.getfilesystemencoding()).strip() + # read logging configuration path + value = subprocess.check_output( + '. /usr/share/pki/etc/pki.conf && . /etc/pki/pki.conf && echo $LOGGING_CONFIG', + shell=True) + logging_config = value.decode(sys.getfilesystemencoding()).strip() + # construct classpath classpath = [ '/usr/share/java/commons-cli.jar', @@ -71,6 +77,7 @@ def run_java_cli(args): 'java', '-cp', ':'.join(classpath), + '-Djava.util.logging.config.file=' + logging_config, 'com.netscape.cmstools.cli.MainCLI' ] diff --git a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java index 159e4ac5a21e741ef7ee15b313a91f8e389dd941..797f3cb03300daa721b66f21d6939c039c9c4e06 100644 --- a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java @@ -49,6 +49,7 @@ import com.netscape.cmstools.cert.CertCLI; import com.netscape.cmstools.client.ClientCLI; import com.netscape.cmstools.group.GroupCLI; import com.netscape.cmstools.key.KeyCLI; +import com.netscape.cmstools.pkcs12.PKCS12CLI; import com.netscape.cmstools.system.SecurityDomainCLI; import com.netscape.cmstools.user.UserCLI; @@ -85,6 +86,8 @@ public class MainCLI extends CLI { addModule(new TKSCLI(this)); addModule(new TPSCLI(this)); + addModule(new PKCS12CLI(this)); + createOptions(); } diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java new file mode 100644 index 0000000000000000000000000000000000000000..f69fcac53bb8afef502e8b3656fd02731892b43b --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CLI.java @@ -0,0 +1,45 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import com.netscape.cmstools.cli.CLI; +import com.netscape.cmstools.cli.MainCLI; + +/** + * @author Endi S. Dewata + */ +public class PKCS12CLI extends CLI { + + public PKCS12CLI(CLI parent) { + super("pkcs12", "PKCS #12 utilities", parent); + + addModule(new PKCS12CertCLI(this)); + addModule(new PKCS12KeyCLI(this)); + } + + public String getFullName() { + if (parent instanceof MainCLI) { + // do not include MainCLI's name + return name; + } else { + return parent.getFullName() + "-" + name; + } + } + +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java new file mode 100644 index 0000000000000000000000000000000000000000..2179c186c37ed324933f8f5867d954cc67a158ee --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java @@ -0,0 +1,41 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import com.netscape.cmstools.cli.CLI; + +import netscape.security.pkcs.PKCS12Util.PKCS12CertInfo; + +/** + * @author Endi S. Dewata + */ +public class PKCS12CertCLI extends CLI { + + public PKCS12CertCLI(PKCS12CLI parent) { + super("cert", "PKCS #12 certificate management commands", parent); + + addModule(new PKCS12CertFindCLI(this)); + } + + public static void printCertInfo(PKCS12CertInfo certInfo) throws Exception { + System.out.println(" Nickname: " + certInfo.nickname); + System.out.println(" Subject: " + certInfo.cert.getSubjectDN()); + System.out.println(" Issuer: " + certInfo.cert.getIssuerDN()); + } +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java new file mode 100644 index 0000000000000000000000000000000000000000..4cbfee5183d0c1a59140e0b560a2d2859adadcd8 --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertFindCLI.java @@ -0,0 +1,124 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import java.util.List; +import java.util.logging.Level; +import java.util.logging.Logger; + +import org.apache.commons.cli.CommandLine; +import org.apache.commons.cli.Option; +import org.apache.commons.cli.ParseException; + +import com.netscape.cmstools.cli.CLI; +import com.netscape.cmstools.cli.MainCLI; + +import netscape.security.pkcs.PKCS12Util; +import netscape.security.pkcs.PKCS12Util.PKCS12CertInfo; + +/** + * @author Endi S. Dewata + */ +public class PKCS12CertFindCLI extends CLI { + + public PKCS12CertFindCLI(PKCS12CertCLI certCLI) { + super("find", "Find certificates in PKCS #12 file", certCLI); + + createOptions(); + } + + public void printHelp() { + formatter.printHelp(getFullName() + " [OPTIONS...]", options); + } + + public void createOptions() { + Option option = new Option(null, "pkcs12", true, "PKCS #12 file"); + option.setArgName("path"); + options.addOption(option); + + options.addOption("v", "verbose", false, "Run in verbose mode."); + options.addOption(null, "debug", false, "Run in debug mode."); + options.addOption(null, "help", false, "Show help message."); + } + + public void execute(String[] args) throws Exception { + + CommandLine cmd = null; + + try { + cmd = parser.parse(options, args); + } catch (ParseException e) { + System.err.println("Error: " + e.getMessage()); + printHelp(); + System.exit(-1); + } + + if (cmd.hasOption("help")) { + printHelp(); + System.exit(0); + } + + if (cmd.hasOption("verbose")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.INFO); + Logger.getLogger("com.netscape").setLevel(Level.INFO); + Logger.getLogger("netscape").setLevel(Level.INFO); + + } else if (cmd.hasOption("debug")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.FINE); + Logger.getLogger("com.netscape").setLevel(Level.FINE); + Logger.getLogger("netscape").setLevel(Level.FINE); + } + + String[] cmdArgs = cmd.getArgs(); + + if (cmdArgs.length != 0) { + System.err.println("Error: Too many arguments specified."); + printHelp(); + System.exit(-1); + } + + String filename = cmd.getOptionValue("pkcs12"); + + if (filename == null) { + System.err.println("Error: Missing PKCS #12 file."); + printHelp(); + System.exit(-1); + } + + PKCS12Util util = new PKCS12Util(); + util.loadFromPKCS12(filename); + + List certInfos = util.getCertInfos(); + + MainCLI.printMessage(certInfos.size() + " entries found"); + if (certInfos.size() == 0) return; + + boolean first = true; + + for (PKCS12CertInfo certInfo : certInfos) { + if (first) { + first = false; + } else { + System.out.println(); + } + + PKCS12CertCLI.printCertInfo(certInfo); + } + } +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java new file mode 100644 index 0000000000000000000000000000000000000000..9612e2f4ace7e04ccbaa5e40d068aee1b0df6c9f --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyCLI.java @@ -0,0 +1,43 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import com.netscape.cmstools.cli.CLI; + +import netscape.security.pkcs.PKCS12Util.PKCS12KeyInfo; + +/** + * @author Endi S. Dewata + */ +public class PKCS12KeyCLI extends CLI { + + public PKCS12KeyCLI(PKCS12CLI parent) { + super("key", "PKCS# 12 key management commands", parent); + + addModule(new PKCS12KeyFindCLI(this)); + } + + public static void printKeyInfo(PKCS12KeyInfo keyInfo) throws Exception { + System.out.println(" Subject: " + keyInfo.subjectDN); + + if (keyInfo.privateKeyInfo != null) { + System.out.println(" Algorithm: " + keyInfo.privateKeyInfo.getAlgorithm()); + } + } +} diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java new file mode 100644 index 0000000000000000000000000000000000000000..4f630b0cf20055b510c9b0578c5d2c94af31e597 --- /dev/null +++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12KeyFindCLI.java @@ -0,0 +1,157 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2016 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package com.netscape.cmstools.pkcs12; + +import java.io.BufferedReader; +import java.io.FileReader; +import java.util.List; +import java.util.logging.Level; +import java.util.logging.Logger; + +import org.apache.commons.cli.CommandLine; +import org.apache.commons.cli.Option; +import org.apache.commons.cli.ParseException; +import org.mozilla.jss.util.Password; + +import com.netscape.cmstools.cli.CLI; +import com.netscape.cmstools.cli.MainCLI; + +import netscape.security.pkcs.PKCS12Util; +import netscape.security.pkcs.PKCS12Util.PKCS12KeyInfo; + +/** + * @author Endi S. Dewata + */ +public class PKCS12KeyFindCLI extends CLI { + + public PKCS12KeyFindCLI(PKCS12KeyCLI certCLI) { + super("find", "Find keys in PKCS #12 file", certCLI); + + createOptions(); + } + + public void printHelp() { + formatter.printHelp(getFullName() + " [OPTIONS...]", options); + } + + public void createOptions() { + Option option = new Option(null, "pkcs12", true, "PKCS #12 file"); + option.setArgName("path"); + options.addOption(option); + + option = new Option(null, "pkcs12-password", true, "PKCS #12 password"); + option.setArgName("path"); + options.addOption(option); + + option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file"); + option.setArgName("path"); + options.addOption(option); + + options.addOption("v", "verbose", false, "Run in verbose mode."); + options.addOption(null, "help", false, "Show help message."); + } + + public void execute(String[] args) throws Exception { + + CommandLine cmd = null; + + try { + cmd = parser.parse(options, args); + } catch (ParseException e) { + System.err.println("Error: " + e.getMessage()); + printHelp(); + System.exit(-1); + } + + if (cmd.hasOption("help")) { + printHelp(); + System.exit(0); + } + + if (cmd.hasOption("verbose")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.INFO); + Logger.getLogger("com.netscape").setLevel(Level.INFO); + Logger.getLogger("netscape").setLevel(Level.INFO); + + } else if (cmd.hasOption("debug")) { + Logger.getLogger("org.dogtagpki").setLevel(Level.FINE); + Logger.getLogger("com.netscape").setLevel(Level.FINE); + Logger.getLogger("netscape").setLevel(Level.FINE); + } + + String[] cmdArgs = cmd.getArgs(); + + if (cmdArgs.length != 0) { + System.err.println("Error: Too many arguments specified."); + printHelp(); + System.exit(-1); + } + + String filename = cmd.getOptionValue("pkcs12"); + + if (filename == null) { + System.err.println("Error: Missing PKCS #12 file."); + printHelp(); + System.exit(-1); + } + + String passwordString = cmd.getOptionValue("pkcs12-password"); + + if (passwordString == null) { + + String passwordFile = cmd.getOptionValue("pkcs12-password-file"); + if (passwordFile != null) { + try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) { + passwordString = in.readLine(); + } + } + } + + Password password = null; + if (passwordString != null) { + password = new Password(passwordString.toCharArray()); + } + + List keyInfos; + + try { + PKCS12Util util = new PKCS12Util(); + util.loadFromPKCS12(filename); + + keyInfos = util.getKeyInfos(password); + } finally { + if (password != null) password.clear(); + } + + MainCLI.printMessage(keyInfos.size() + " entries found"); + if (keyInfos.size() == 0) return; + + boolean first = true; + + for (PKCS12KeyInfo keyInfo : keyInfos) { + if (first) { + first = false; + } else { + System.out.println(); + } + + PKCS12KeyCLI.printKeyInfo(keyInfo); + } + } +} diff --git a/base/util/src/netscape/security/pkcs/PKCS12Util.java b/base/util/src/netscape/security/pkcs/PKCS12Util.java index 63051858e05a23e2f8b39503e2eaad07ad7dae1a..9d66ac6fb035ac5c11aeb71b086be41838d86c6d 100644 --- a/base/util/src/netscape/security/pkcs/PKCS12Util.java +++ b/base/util/src/netscape/security/pkcs/PKCS12Util.java @@ -17,15 +17,23 @@ // --- END COPYRIGHT BLOCK --- package netscape.security.pkcs; +import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.FileOutputStream; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; import java.security.MessageDigest; +import java.util.ArrayList; +import java.util.List; import java.util.logging.Logger; import org.mozilla.jss.CryptoManager; +import org.mozilla.jss.asn1.ANY; import org.mozilla.jss.asn1.ASN1Util; import org.mozilla.jss.asn1.ASN1Value; import org.mozilla.jss.asn1.BMPString; +import org.mozilla.jss.asn1.OBJECT_IDENTIFIER; import org.mozilla.jss.asn1.OCTET_STRING; import org.mozilla.jss.asn1.SEQUENCE; import org.mozilla.jss.asn1.SET; @@ -48,16 +56,30 @@ import org.mozilla.jss.pkcs12.CertBag; import org.mozilla.jss.pkcs12.PFX; import org.mozilla.jss.pkcs12.PasswordConverter; import org.mozilla.jss.pkcs12.SafeBag; +import org.mozilla.jss.pkix.primitive.Attribute; import org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo; import org.mozilla.jss.pkix.primitive.PrivateKeyInfo; import org.mozilla.jss.util.Password; +import netscape.security.x509.X509CertImpl; + public class PKCS12Util { private static Logger logger = Logger.getLogger(PKCS12Util.class.getName()); PFX pfx; + public static class PKCS12KeyInfo { + public EncryptedPrivateKeyInfo encPrivateKeyInfo; + public PrivateKeyInfo privateKeyInfo; + public String subjectDN; + } + + public static class PKCS12CertInfo { + public X509CertImpl cert; + public String nickname; + } + byte[] getEncodedKey(PrivateKey privateKey) throws Exception { CryptoManager cm = CryptoManager.getInstance(); @@ -211,4 +233,158 @@ public class PKCS12Util { loadFromNSS(password); storeIntoPKCS12(filename, password); } + + public PKCS12KeyInfo getKeyInfo(SafeBag bag, Password password) throws Exception { + + // get private key info + EncryptedPrivateKeyInfo encPrivateKeyInfo = (EncryptedPrivateKeyInfo) bag.getInterpretedBagContent(); + + PrivateKeyInfo privateKeyInfo = null; + if (password != null) { + privateKeyInfo = encPrivateKeyInfo.decrypt(password, new PasswordConverter()); + } + + // find private key's subject DN + SET bagAttrs = bag.getBagAttributes(); + String subjectDN = null; + + for (int i = 0; i < bagAttrs.size(); i++) { + + Attribute attr = (Attribute) bagAttrs.elementAt(i); + OBJECT_IDENTIFIER oid = attr.getType(); + + if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue; + + SET values = attr.getValues(); + ANY value = (ANY) values.elementAt(0); + + ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded()); + BMPString sss = (BMPString) new BMPString.Template().decode(bbis); + subjectDN = sss.toString(); + + break; + } + + logger.fine("Found private key " + subjectDN); + + PKCS12KeyInfo keyInfo = new PKCS12KeyInfo(); + keyInfo.encPrivateKeyInfo = encPrivateKeyInfo; + keyInfo.privateKeyInfo = privateKeyInfo; + keyInfo.subjectDN = subjectDN; + + return keyInfo; + } + + public PKCS12KeyInfo getKeyInfo(SafeBag bag) throws Exception { + return getKeyInfo(bag, null); + } + + public PKCS12CertInfo getCertInfo(SafeBag bag) throws Exception { + + CertBag certBag = (CertBag) bag.getInterpretedBagContent(); + + OCTET_STRING str = (OCTET_STRING) certBag.getInterpretedCert(); + byte[] x509cert = str.toByteArray(); + + // find cert's nickname + SET bagAttrs = bag.getBagAttributes(); + String nickname = null; + + if (bagAttrs != null) { + + for (int k = 0; k < bagAttrs.size(); k++) { + + Attribute attr = (Attribute) bagAttrs.elementAt(k); + OBJECT_IDENTIFIER oid = attr.getType(); + + if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue; + SET values = attr.getValues(); + ANY value = (ANY) values.elementAt(0); + + ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded()); + BMPString sss = (BMPString) (new BMPString.Template()).decode(bbis); + nickname = sss.toString(); + + break; + } + } + + X509CertImpl certImpl = new X509CertImpl(x509cert); + + logger.fine("Found certificate " + certImpl.getSubjectDN() + (nickname == null ? "" : " (" + nickname + ")")); + + PKCS12CertInfo certInfo = new PKCS12CertInfo(); + certInfo.cert = certImpl; + certInfo.nickname = nickname; + + return certInfo; + } + + public List getKeyInfos(Password password) throws Exception { + + logger.fine("Getting private keys"); + + List keyInfos = new ArrayList(); + AuthenticatedSafes safes = pfx.getAuthSafes(); + + for (int i = 0; i < safes.getSize(); i++) { + + SEQUENCE contents = safes.getSafeContentsAt(null, i); + + for (int j = 0; j < contents.size(); j++) { + + SafeBag bag = (SafeBag) contents.elementAt(j); + OBJECT_IDENTIFIER oid = bag.getBagType(); + + if (!oid.equals(SafeBag.PKCS8_SHROUDED_KEY_BAG)) continue; + + PKCS12KeyInfo keyInfo = getKeyInfo(bag, password); + keyInfos.add(keyInfo); + } + } + + return keyInfos; + } + + public List getKeyInfos() throws Exception { + return getKeyInfos(null); + } + + public List getCertInfos() throws Exception { + + logger.fine("Getting certificates"); + + List certInfos = new ArrayList(); + AuthenticatedSafes safes = pfx.getAuthSafes(); + + for (int i = 0; i < safes.getSize(); i++) { + + SEQUENCE contents = safes.getSafeContentsAt(null, i); + + for (int j = 0; j < contents.size(); j++) { + + SafeBag bag = (SafeBag) contents.elementAt(j); + OBJECT_IDENTIFIER oid = bag.getBagType(); + + if (!oid.equals(SafeBag.CERT_BAG)) continue; + + PKCS12CertInfo certInfo = getCertInfo(bag); + certInfos.add(certInfo); + } + } + + return certInfos; + } + + public void loadFromPKCS12(String filename) throws Exception { + + logger.info("Loading PKCS #12 file"); + + Path path = Paths.get(filename); + byte[] b = Files.readAllBytes(path); + + ByteArrayInputStream bis = new ByteArrayInputStream(b); + + pfx = (PFX) (new PFX.Template()).decode(bis); + } } -- 2.4.3