public void test04RevocationApprovals() throws Exception {
// Generate random username and CA name
String randomPostfix = Integer.toString((new Random(new Date().getTime() + 4711)).nextInt(999999));
String caname = "cmpRevocationCA" + randomPostfix;
String username = "cmpRevocationUser" + randomPostfix;
X509CAInfo cainfo = null;
try {
// Generate CA with approvals for revocation enabled
int caID = RevocationApprovalTest.createApprovalCA(admin, caname, CAInfo.REQ_APPROVAL_REVOCATION, caAdminSession, caSession);
// Get CA cert
cainfo = (X509CAInfo) caAdminSession.getCAInfo(admin, caID);
assertNotNull(cainfo);
X509Certificate newCACert = (X509Certificate) cainfo.getCertificateChain().iterator().next();
// Create a user and generate the cert
UserDataVO userdata = new UserDataVO(username, "CN=" + username, cainfo.getCAId(), null, null, 1, SecConst.EMPTY_ENDENTITYPROFILE,
SecConst.CERTPROFILE_FIXED_ENDUSER, SecConst.TOKEN_SOFT_P12, 0, null);
userdata.setPassword("foo123");
userAdminSession.addUser(admin, userdata, true);
BatchMakeP12 makep12 = new BatchMakeP12();
File tmpfile = File.createTempFile("ejbca", "p12");
makep12.setMainStoreDir(tmpfile.getParent());
makep12.createAllNew();
Collection<java.security.cert.Certificate> userCerts = certificateStoreSession.findCertificatesByUsername(admin, username);
assertTrue(userCerts.size() == 1);
X509Certificate cert = (X509Certificate) userCerts.iterator().next();
// revoke via CMP and verify response
byte[] nonce = CmpMessageHelper.createSenderNonce();
byte[] transid = CmpMessageHelper.createSenderNonce();
ByteArrayOutputStream bao = new ByteArrayOutputStream();
DEROutputStream out = new DEROutputStream(bao);
PKIMessage rev = genRevReq(cainfo.getSubjectDN(), userdata.getDN(), cert.getSerialNumber(), newCACert, nonce, transid, true);
PKIMessage revReq = protectPKIMessage(rev, false, PBEPASSWORD, 567);
assertNotNull(revReq);
bao = new ByteArrayOutputStream();
out = new DEROutputStream(bao);
out.writeObject(revReq);
byte[] ba = bao.toByteArray();
byte[] resp = sendCmpHttp(ba, 200);
checkCmpResponseGeneral(resp, cainfo.getSubjectDN(), userdata.getDN(), newCACert, nonce, transid, false, PBEPASSWORD);
checkCmpRevokeConfirmMessage(cainfo.getSubjectDN(), userdata.getDN(), cert.getSerialNumber(), newCACert, resp, true);
int reason = checkRevokeStatus(cainfo.getSubjectDN(), cert.getSerialNumber());
assertEquals(reason, RevokedCertInfo.NOT_REVOKED);
// try to revoke one more via CMP and verify error
nonce = CmpMessageHelper.createSenderNonce();
transid = CmpMessageHelper.createSenderNonce();
bao = new ByteArrayOutputStream();
out = new DEROutputStream(bao);
rev = genRevReq(cainfo.getSubjectDN(), userdata.getDN(), cert.getSerialNumber(), newCACert, nonce, transid, true);
revReq = protectPKIMessage(rev, false, PBEPASSWORD, 567);
assertNotNull(revReq);
bao = new ByteArrayOutputStream();
out = new DEROutputStream(bao);
out.writeObject(revReq);
ba = bao.toByteArray();
resp = sendCmpHttp(ba, 200);
checkCmpResponseGeneral(resp, cainfo.getSubjectDN(), userdata.getDN(), newCACert, nonce, transid, false, PBEPASSWORD);
checkCmpFailMessage(resp, "The request is already awaiting approval.", CmpPKIBodyConstants.REVOCATIONRESPONSE, 0, ResponseStatus.FAILURE
.getIntValue());
reason = checkRevokeStatus(cainfo.getSubjectDN(), cert.getSerialNumber());
assertEquals(reason, RevokedCertInfo.NOT_REVOKED);
// Approve revocation and verify success
Admin approvingAdmin = new Admin((X509Certificate) certificateStoreSession.findCertificatesByUsername(admin, APPROVINGADMINNAME).iterator().next(),
APPROVINGADMINNAME, null);
approveRevocation(admin, approvingAdmin, username, RevokedCertInfo.REVOCATION_REASON_CESSATIONOFOPERATION,
ApprovalDataVO.APPROVALTYPE_REVOKECERTIFICATE, certificateStoreSession, approvalSession, approvalExecutionSession, cainfo.getCAId());
// try to revoke the now revoked cert via CMP and verify error
nonce = CmpMessageHelper.createSenderNonce();
transid = CmpMessageHelper.createSenderNonce();
bao = new ByteArrayOutputStream();
out = new DEROutputStream(bao);
rev = genRevReq(cainfo.getSubjectDN(), userdata.getDN(), cert.getSerialNumber(), newCACert, nonce, transid, true);
revReq = protectPKIMessage(rev, false, PBEPASSWORD, 567);
assertNotNull(revReq);
bao = new ByteArrayOutputStream();
out = new DEROutputStream(bao);
out.writeObject(revReq);
ba = bao.toByteArray();
resp = sendCmpHttp(ba, 200);
checkCmpResponseGeneral(resp, cainfo.getSubjectDN(), userdata.getDN(), newCACert, nonce, transid, false, PBEPASSWORD);
checkCmpFailMessage(resp, "Already revoked.", CmpPKIBodyConstants.REVOCATIONRESPONSE, 0, ResponseStatus.FAILURE.getIntValue());
} finally {
// Delete user
userAdminSession.deleteUser(admin, username);
// Nuke CA
try {
caAdminSession.revokeCA(admin, cainfo.getCAId(), RevokedCertInfo.REVOCATION_REASON_UNSPECIFIED);
} finally {
caSession.removeCA(admin, cainfo.getCAId());
}
}
} // test04RevocationApprovals