CertStore certs = CertStore.getInstance("Collection",
new CollectionCertStoreParameters(certList), "BC");
// Create the signed CMS message to be contained inside the envelope
// this message does not contain any message, and no signerInfo
CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
gen.addCertificatesAndCRLs(certs);
CMSSignedData s = gen.generate(null, false, "BC");
// Envelope the CMS message
if (recipientKeyInfo != null) {
try {
X509Certificate rec = (X509Certificate)CertTools.getCertfromByteArray(recipientKeyInfo);
log.debug("Added recipient information - issuer: '" + CertTools.getIssuerDN(rec) + "', serno: '" + CertTools.getSerialNumberAsString(rec));
edGen.addKeyTransRecipient(rec);
} catch (CertificateException e) {
throw new IOException("Can not decode recipients self signed certificate!");
}
} else {
edGen.addKeyTransRecipient((X509Certificate) cert);
}
CMSEnvelopedData ed = edGen.generate(new CMSProcessableByteArray(s.getEncoded()),
SMIMECapability.dES_CBC.getId(), "BC");
log.debug("Enveloped data is " + ed.getEncoded().length + " bytes long");
msg = new CMSProcessableByteArray(ed.getEncoded());
} else {
// Create an empty message here
//msg = new CMSProcessableByteArray("PrimeKey".getBytes());
msg = new CMSProcessableByteArray(new byte[0]);
}
// Create the outermost signed data
CMSSignedDataGenerator gen1 = new CMSSignedDataGenerator();
// add authenticated attributes...status, transactionId, sender- and recipientNonce and more...
Hashtable attributes = new Hashtable();
DERObjectIdentifier oid;
Attribute attr;
DERSet value;
// Content Type
/* Added automagically by CMSSignedDataGenerator
oid = PKCSObjectIdentifiers.pkcs_9_at_contentType;
value = new DERSet(PKCSObjectIdentifiers.data);
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
*/
// Message digest
/* Added automagically by CMSSignedDataGenerator
byte[] digest = null;
if (s != null) {
MessageDigest md = MessageDigest.getInstance("SHA1");
digest = md.digest(s.getEncoded());
} else {
digest = new byte[]{0};
}
oid = PKCSObjectIdentifiers.pkcs_9_at_messageDigest;
value = new DERSet(new DEROctetString(digest));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
*/
// Message type (certrep)
oid = new DERObjectIdentifier(ScepRequestMessage.id_messageType);
value = new DERSet(new DERPrintableString("3"));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
// TransactionId
if (transactionId != null) {
oid = new DERObjectIdentifier(ScepRequestMessage.id_transId);
log.debug("Added transactionId: " + transactionId);
value = new DERSet(new DERPrintableString(transactionId));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
}
// status
oid = new DERObjectIdentifier(ScepRequestMessage.id_pkiStatus);
value = new DERSet(new DERPrintableString(status.getValue()));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
if (status.equals(ResponseStatus.FAILURE)) {
oid = new DERObjectIdentifier(ScepRequestMessage.id_failInfo);
log.debug("Added failInfo: " + failInfo.getValue());
value = new DERSet(new DERPrintableString(failInfo.getValue()));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
}
// senderNonce
if (senderNonce != null) {
oid = new DERObjectIdentifier(ScepRequestMessage.id_senderNonce);
log.debug("Added senderNonce: " + senderNonce);
value = new DERSet(new DEROctetString(Base64.decode(senderNonce.getBytes())));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
}
// recipientNonce
if (recipientNonce != null) {
oid = new DERObjectIdentifier(ScepRequestMessage.id_recipientNonce);
log.debug("Added recipientNonce: " + recipientNonce);
value = new DERSet(new DEROctetString(Base64.decode(recipientNonce.getBytes())));
attr = new Attribute(oid, value);
attributes.put(attr.getAttrType(), attr);
}
// Add our signer info and sign the message
log.debug("Signing SCEP message with cert: "+CertTools.getSubjectDN(signCert));
gen1.addSigner(signKey, (X509Certificate)signCert, digestAlg, new AttributeTable(attributes), null);
signedData = gen1.generate(msg, true, provider);
responseMessage = signedData.getEncoded();
if (responseMessage != null) {
ret = true;
}
} catch (InvalidAlgorithmParameterException e) {