NetscapeCertRequest nscr = new NetscapeCertRequest(spkacSeq);
// Verify POPO, we don't care about the challenge, it's not important.
nscr.setChallenge("challenge");
if (nscr.verify("challenge") == false) {
log.debug("SPKAC POPO verification Failed");
throw new SignRequestSignatureException("Invalid signature in NetscapeCertRequest, popo-verification failed.");
}
log.debug("POPO verification successful");
PublicKey pubKey = nscr.getPublicKey();
imsg = new SimpleRequestMessage(pubKey, username, password);
}
} else if (reqType == REQTYPE_CRMF) {
byte[] request = Base64.decode(req.getBytes());
ASN1InputStream in = new ASN1InputStream(request);
ASN1Sequence crmfSeq = (ASN1Sequence) in.readObject();
ASN1Sequence reqSeq = (ASN1Sequence) ((ASN1Sequence) crmfSeq.getObjectAt(0)).getObjectAt(0);
CertRequest certReq = new CertRequest( reqSeq );
SubjectPublicKeyInfo pKeyInfo = certReq.getCertTemplate().getPublicKey();
KeyFactory keyFact = KeyFactory.getInstance("RSA", "BC");
KeySpec keySpec = new X509EncodedKeySpec( pKeyInfo.getEncoded() );
PublicKey pubKey = keyFact.generatePublic(keySpec); // just check it's ok
imsg = new SimpleRequestMessage(pubKey, username, password);
// a simple crmf is not a complete PKI message, as desired by the CrmfRequestMessage class
//PKIMessage msg = PKIMessage.getInstance(new ASN1InputStream(new ByteArrayInputStream(request)).readObject());
//CrmfRequestMessage reqmsg = new CrmfRequestMessage(msg, null, true, null);
//imsg = reqmsg;
} else if (reqType == REQTYPE_CVC) {
CVCObject parsedObject = CertificateParser.parseCVCObject(Base64.decode(req.getBytes()));
// We will handle both the case if the request is an authenticated request, i.e. with an outer signature
// and when the request is missing the (optional) outer signature.
CVCertificate cvccert = null;
if (parsedObject instanceof CVCAuthenticatedRequest) {
CVCAuthenticatedRequest cvcreq = (CVCAuthenticatedRequest)parsedObject;
cvccert = cvcreq.getRequest();
} else {
cvccert = (CVCertificate)parsedObject;
}
CVCRequestMessage reqmsg = new CVCRequestMessage(cvccert.getDEREncoded());
reqmsg.setUsername(username);
reqmsg.setPassword(password);
// Popo is really actually verified by the CA (in RSASignSessionBean) as well
if (reqmsg.verify() == false) {
log.debug("CVC POPO verification Failed");
throw new SignRequestSignatureException("Invalid inner signature in CVCRequest, popo-verification failed.");
} else {
log.debug("POPO verification successful");
}
imsg = reqmsg;
}