// If the user did not specify this, we try to generate a key with the same specification as the currently used key.
String keyspec = info.getSignKeySpec(); // can be "unknown"
if (StringUtils.equals(keyspec, AlgorithmTools.KEYSPEC_UNKNOWN)) {
keyspec = null;
}
AlgorithmParameterSpec paramspec = KeyTools.getKeyGenSpec(previousPubSign);
if (log.isDebugEnabled()) {
if (keyspec != null) {
log.debug("Generating new Soft key with specified spec "+keyspec+" with label "+SoftCAToken.PRIVATESIGNKEYALIAS);
} else {
int keySize = KeyTools.getKeyLength(previousPubSign);
String alg = previousPubSign.getAlgorithm();
log.debug("Generating new Soft "+alg+" key with spec "+paramspec+" (size="+keySize+") with label "+SoftCAToken.PRIVATESIGNKEYALIAS);
}
}
// Generate signature keys.
KeyPair newsignkeys = KeyTools.genKeys(keyspec, paramspec, info.getSignKeyAlgorithm());
// Create the new keystore and add the new signature keys
KeyStore keystore = KeyStore.getInstance("PKCS12", "BC");
keystore.load(null, null);
// PLay with aliases depending on if we activate the new key or not
String newSignKeyAlias = SoftCAToken.PRIVATESIGNKEYALIAS;
String previousSignKeyAlias = SoftCAToken.PREVIOUSPRIVATESIGNKEYALIAS;
if (!activate) {
// If the new keys are not activated we must still use the old key as active signing key (PRIVATESIGNKEYALIAS)
newSignKeyAlias = SoftCAToken.NEXTPRIVATESIGNKEYALIAS;
previousSignKeyAlias = SoftCAToken.PRIVATESIGNKEYALIAS;
}
log.debug("Setting newsignkeys as "+newSignKeyAlias+" in soft CA token.");
Certificate[] certchain = new Certificate[1]; // generate dummy certificate
String sigAlg = (String)AlgorithmTools.getSignatureAlgorithms(newsignkeys.getPublic()).iterator().next();
certchain[0] = CertTools.genSelfCert("CN=dummy", 36500, null, newsignkeys.getPrivate(), newsignkeys.getPublic(), sigAlg, true);
keystore.setKeyEntry(newSignKeyAlias, newsignkeys.getPrivate(), null, certchain);
if (!activate) {
log.debug("Set next sequence: "+newSequence);
properties.setProperty(ICAToken.NEXT_SEQUENCE_PROPERTY, newSequence);
log.debug("Set nextCertSignKey: "+newSignKeyAlias);
properties.setProperty(KeyStrings.CAKEYPURPOSE_CERTSIGN_STRING_NEXT, newSignKeyAlias);
}
// If we have an old key (i.e. generating new keys), we will store the old one as "previous"
if (previousPrivSign != null) {
log.debug("Setting previousPrivSign as "+previousSignKeyAlias+" in soft CA token.");
sigAlg = (String)AlgorithmTools.getSignatureAlgorithms(previousPubSign).iterator().next();
certchain[0] = CertTools.genSelfCert("CN=dummy2", 36500, null, previousPrivSign, previousPubSign, sigAlg, true);
keystore.setKeyEntry(previousSignKeyAlias, previousPrivSign, null, certchain);
// Now this keystore should have this previous key
if (activate) {
// This key pair is now moved down to previous sign key
properties.setProperty(KeyStrings.CAKEYPURPOSE_CERTSIGN_STRING_PREVIOUS, previousSignKeyAlias);
// Set previous sequence so we can create link certificates
log.debug("Set previous sequence : "+oldSequence);
properties.setProperty(ICAToken.PREVIOUS_SEQUENCE_PROPERTY, oldSequence);
} else {
// If we have an old previous key and we are not activating the new key, we will keep this one as "previous"
// If the new keys are activate the old previous keys are trashed and replaced by the old active signature key
String prevProp = properties.getProperty(KeyStrings.CAKEYPURPOSE_CERTSIGN_STRING_PREVIOUS); // If we don't have a previous key don't try to add it
if ( (oldPreviousPrivSign != null) && (prevProp != null) ) {
log.debug("Setting old previousprivatesignkeyalias as "+SoftCAToken.PREVIOUSPRIVATESIGNKEYALIAS+" in soft CA token.");
sigAlg = (String)AlgorithmTools.getSignatureAlgorithms(oldPreviousPubSign).iterator().next();
certchain[0] = CertTools.genSelfCert("CN=dummy3", 36500, null, oldPreviousPrivSign, oldPreviousPubSign, sigAlg, true);
keystore.setKeyEntry(SoftCAToken.PREVIOUSPRIVATESIGNKEYALIAS, oldPreviousPrivSign, null, certchain);
properties.setProperty(KeyStrings.CAKEYPURPOSE_CERTSIGN_STRING_PREVIOUS, SoftCAToken.PREVIOUSPRIVATESIGNKEYALIAS);
} else {
log.debug("No previousprivatesignkeyalias exists, not setting any previous key.");
}
}
}
// Finally install the old encryption/decryption keys as well
sigAlg = (String)AlgorithmTools.getSignatureAlgorithms(pubEnc).iterator().next();
certchain[0] = CertTools.genSelfCert("CN=dummy2", 36500, null, privEnc, pubEnc, sigAlg, true);
keystore.setKeyEntry(SoftCAToken.PRIVATEDECKEYALIAS, privEnc, null, certchain);
storeSoftKeyStore(authCode, info, properties, keystore);
tokentype = "Soft"; // for logging
} else if (catokeninfo instanceof HardCATokenInfo) {
ICAToken token = getCAToken();
if (token instanceof PKCS11CAToken) {
Properties properties = getProperties();
PublicKey pubK = token.getPublicKey(SecConst.CAKEYPURPOSE_CERTSIGN);
String keyLabel = token.getKeyLabel(SecConst.CAKEYPURPOSE_CERTSIGN);
log.debug("Old key label is: "+keyLabel);
String crlKeyLabel = token.getKeyLabel(SecConst.CAKEYPURPOSE_CRLSIGN);
// The key label to use for the new key
// Remove the old sequence from the end of the key label and replace it with the
// new label. If no label was present just concatenate the new label
String newKeyLabel = StringUtils.removeEnd(keyLabel, oldSequence)+newSequence;
log.debug("New key label is: "+newKeyLabel);
final KeyStore.PasswordProtection pwp = new KeyStore.PasswordProtection(authCode);
// As first choice we check if the used have specified which type of key should be generated, this can be different from the currently used key
// If the user did not specify this, we try to generate a key with the same specification as the currently used key.
String keyspec = properties.getProperty(ICAToken.KEYSPEC_PROPERTY); // can be null, and that is ok
AlgorithmParameterSpec paramspec = KeyTools.getKeyGenSpec(pubK);
if (log.isDebugEnabled()) {
String sharedLibrary = properties.getProperty(PKCS11CAToken.SHLIB_LABEL_KEY);
String slot = properties.getProperty(PKCS11CAToken.SLOT_LABEL_KEY);
String attributesFile = properties.getProperty(PKCS11CAToken.ATTRIB_LABEL_KEY);
if (keyspec != null) {