} else if (op == Operation.PKI_OPERATION) {
// PKIOperation
res.setHeader("Content-Type", "application/x-pki-message");
CMSSignedData sd;
try {
sd = new CMSSignedData(body);
} catch (CMSException e) {
throw new ServletException(e);
}
Store reqStore = sd.getCertificates();
Collection<X509CertificateHolder> reqCerts = reqStore
.getMatches(null);
CertificateFactory factory;
try {
factory = CertificateFactory.getInstance("X.509");
} catch (CertificateException e) {
throw new ServletException(e);
}
X509CertificateHolder holder = reqCerts.iterator().next();
ByteArrayInputStream bais = new ByteArrayInputStream(
holder.getEncoded());
X509Certificate reqCert;
try {
reqCert = (X509Certificate) factory.generateCertificate(bais);
} catch (CertificateException e) {
throw new ServletException(e);
}
PkiMessage<?> msg;
try {
PkcsPkiEnvelopeDecoder envDecoder = new PkcsPkiEnvelopeDecoder(
getRecipient(), getRecipientKey());
PkiMessageDecoder decoder = new PkiMessageDecoder(reqCert,
envDecoder);
msg = decoder.decode(sd);
} catch (MessageDecodingException e) {
LOGGER.error("Error decoding request", e);
throw new ServletException(e);
}
LOGGER.debug("Processing message {}", msg);
MessageType msgType = msg.getMessageType();
Object msgData = msg.getMessageData();
Nonce senderNonce = Nonce.nextNonce();
TransactionId transId = msg.getTransactionId();
Nonce recipientNonce = msg.getSenderNonce();
CertRep certRep;
if (msgType == MessageType.GET_CERT) {
final IssuerAndSerialNumber iasn = (IssuerAndSerialNumber) msgData;
final X500Name principal = iasn.getName();
final BigInteger serial = iasn.getSerialNumber().getValue();
try {
List<X509Certificate> issued = doGetCert(principal, serial);
if (issued.size() == 0) {
certRep = new CertRep(transId, senderNonce,
recipientNonce, FailInfo.badCertId);
} else {
CMSSignedData messageData = getMessageData(issued);
certRep = new CertRep(transId, senderNonce,
recipientNonce, messageData);
}
} catch (OperationFailureException e) {
certRep = new CertRep(transId, senderNonce, recipientNonce,
e.getFailInfo());
} catch (Exception e) {
throw new ServletException(e);
}
} else if (msgType == MessageType.GET_CERT_INITIAL) {
final IssuerAndSubject ias = (IssuerAndSubject) msgData;
final X500Name issuer = X500Name.getInstance(ias.getIssuer());
final X500Name subject = X500Name.getInstance(ias.getSubject());
try {
List<X509Certificate> issued = doGetCertInitial(issuer,
subject, transId);
if (issued.size() == 0) {
certRep = new CertRep(transId, senderNonce,
recipientNonce);
} else {
CMSSignedData messageData = getMessageData(issued);
certRep = new CertRep(transId, senderNonce,
recipientNonce, messageData);
}
} catch (OperationFailureException e) {
certRep = new CertRep(transId, senderNonce, recipientNonce,
e.getFailInfo());
} catch (Exception e) {
throw new ServletException(e);
}
} else if (msgType == MessageType.GET_CRL) {
final IssuerAndSerialNumber iasn = (IssuerAndSerialNumber) msgData;
final X500Name issuer = iasn.getName();
final BigInteger serialNumber = iasn.getSerialNumber()
.getValue();
try {
LOGGER.debug("Invoking doGetCrl");
CMSSignedData messageData = getMessageData(doGetCrl(issuer,
serialNumber));
certRep = new CertRep(transId, senderNonce, recipientNonce,
messageData);
} catch (OperationFailureException e) {
LOGGER.error("Error executing GetCRL request", e);
certRep = new CertRep(transId, senderNonce, recipientNonce,
e.getFailInfo());
} catch (Exception e) {
LOGGER.error("Error executing GetCRL request", e);
throw new ServletException(e);
}
} else if (msgType == MessageType.PKCS_REQ) {
final PKCS10CertificationRequest certReq = (PKCS10CertificationRequest) msgData;
try {
LOGGER.debug("Invoking doEnrol");
List<X509Certificate> issued = doEnrol(certReq, transId);
if (issued.size() == 0) {
certRep = new CertRep(transId, senderNonce,
recipientNonce);
} else {
CMSSignedData messageData = getMessageData(issued);
certRep = new CertRep(transId, senderNonce,
recipientNonce, messageData);
}
} catch (OperationFailureException e) {
certRep = new CertRep(transId, senderNonce, recipientNonce,
e.getFailInfo());
} catch (Exception e) {
throw new ServletException(e);
}
} else {
throw new ServletException("Unknown Message for Operation");
}
PkcsPkiEnvelopeEncoder envEncoder = new PkcsPkiEnvelopeEncoder(
reqCert, "DESede");
PkiMessageEncoder encoder = new PkiMessageEncoder(getSignerKey(),
getSigner(), envEncoder);
CMSSignedData signedData;
try {
signedData = encoder.encode(certRep);
} catch (MessageEncodingException e) {
LOGGER.error("Error decoding response", e);
throw new ServletException(e);
}
res.getOutputStream().write(signedData.getEncoded());
res.getOutputStream().close();
} else {
res.sendError(HttpServletResponse.SC_BAD_REQUEST,
"Unknown Operation");
}