*                                                                       *

*  EJBCA: The OpenSource Certificate Authority                          *

*                                                                       *

*  This software is free software; you can redistribute it and/or       *

*  modify it under the terms of the GNU Lesser General Public           *

*  License as published by the Free Software Foundation; either         *

*  version 2.1 of the License, or any later version.                    *

*                                                                       *

*  See terms of license at gnu.org.                                     *

*                                                                       *

*************************************************************************/

* Administrates and manages CAs in EJBCA system.

*

* @version $Id: CAAdminSessionBean.java 11634 2011-03-30 09:49:31Z jeklund $

*/

    private static final long serialVersionUID = 1L;

    private static final Logger log = Logger.getLogger(CAAdminSessionBean.class);

    @PersistenceContext(unitName="ejbca")

    private EntityManager entityManager;

    @EJB

    private LogSessionLocal logSession;

    @EJB

    private AuthorizationSessionLocal authorizationSession;

    @EJB

    private CaSessionLocal caSession;

    @EJB

    private CertificateProfileSessionLocal certificateProfileSession;

    @EJB

    private CertificateStoreSessionLocal certificateStoreSession;

    @EJB

    private CrlCreateSessionLocal crlCreateSession;

    @EJB

    private PublisherSessionLocal publisherSession;

    @EJB

    private ApprovalSessionLocal approvalSession;

    /** Internal localization of logs and errors */

    private static final InternalResources intres = InternalResources.getInstance();

    @PostConstruct

    public void postConstruct() {

        CryptoProviderTools.installBCProvider();

    }

    @Override

    public void initializeAndUpgradeCAs(Admin admin) {

      Collection<CAData> result = CAData.findAll(entityManager);

      Iterator<CAData> iter = result.iterator();

      while (iter.hasNext()) {

        CAData cadata = iter.next();

        String caname = cadata.getName();

        try {

          cadata.upgradeCA();

          log.info("Initialized CA: " + caname + ", with expire time: " + new Date(cadata.getExpireTime()));

        } catch (UnsupportedEncodingException e) {

          log.error("UnsupportedEncodingException trying to load CA with name: " + caname, e);

        } catch (IllegalKeyStoreException e) {

          log.error("IllegalKeyStoreException trying to load CA with name: " + caname, e);

        }

      }

    }

    @Override

    public void createCA(Admin admin, CAInfo cainfo) throws CAExistsException, AuthorizationDeniedException, CATokenOfflineException,

            CATokenAuthenticationFailedException {

      if (log.isTraceEnabled()) {

        log.trace(">createCA: "+cainfo.getName());

      }

        int castatus = SecConst.CA_OFFLINE;

        // Check that administrator has superadminstrator rights.

        if(!authorizationSession.isAuthorizedNoLog(admin, "/super_administrator")) {

            String msg = intres.getLocalizedMessage("caadmin.notauthorizedtocreateca", "create", cainfo.getName());

            logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_NOTAUTHORIZEDTORESOURCE,

                    msg);

            throw new AuthorizationDeniedException(msg);

        }

        // Check that CA doesn't already exists

        int caid = cainfo.getCAId();

        if (caid >= 0 && caid <= CAInfo.SPECIALCAIDBORDER) {

          String msg = intres.getLocalizedMessage("caadmin.wrongcaid", Integer.valueOf(caid));

          logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg);

          throw new CAExistsException(msg);

        }

        if (CAData.findById(entityManager, Integer.valueOf(caid)) != null) {

          String msg = intres.getLocalizedMessage("caadmin.caexistsid", Integer.valueOf(caid));

          logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg);

          throw new CAExistsException(msg);

        }

        if (CAData.findByName(entityManager, cainfo.getName()) != null) {

          String msg = intres.getLocalizedMessage("caadmin.caexistsname", cainfo.getName());

          logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg);

          throw new CAExistsException(msg);

        }

        // Create CAToken

        CATokenInfo catokeninfo = cainfo.getCATokenInfo();

        CATokenContainer catoken = new CATokenContainerImpl(catokeninfo, cainfo.getCAId());

        String authCode = catokeninfo.getAuthenticationCode();

        authCode = getDefaultKeyStorePassIfSWAndEmpty(authCode, catokeninfo);

        if (catokeninfo instanceof SoftCATokenInfo) {

            try {

                // There are two ways to get the authentication code:

                // 1. The user provided one when creating the CA on the create

                // CA page

                // 2. We use the system default password

                boolean renew = false;

                catoken.generateKeys(authCode, renew, true);

            } catch (Exception e) {

                String msg = intres.getLocalizedMessage("caadmin.errorcreatetoken");

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, e);

                throw new EJBException(e);

            }

        }

        try {

            catoken.activate(authCode);

        } catch (CATokenAuthenticationFailedException ctaf) {

            String msg = intres.getLocalizedMessage("caadmin.errorcreatetokenpin");

            logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, ctaf);

            throw ctaf;

        } catch (CATokenOfflineException ctoe) {

            String msg = intres.getLocalizedMessage("error.catokenoffline", cainfo.getName());

            logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, ctoe);

            throw ctoe;

        }

        // Create CA

        CA ca = null;

        // The certificate profile used for the CAs certificate

        CertificateProfile certprofile = certificateProfileSession.getCertificateProfile(admin, cainfo.getCertificateProfileId());

        // AltName is not implemented for all CA types

        String caAltName = null;

        // X509 CA is the normal type of CA

        if (cainfo instanceof X509CAInfo) {

            log.info("Creating an X509 CA");

            X509CAInfo x509cainfo = (X509CAInfo) cainfo;

            // Create X509CA

            ca = new X509CA(x509cainfo);

            X509CA x509ca = (X509CA) ca;

            ca.setCAToken(catoken);

            // getCertificateProfile

            if ((x509cainfo.getPolicies() != null) && (x509cainfo.getPolicies().size() > 0)) {

                certprofile.setUseCertificatePolicies(true);

                certprofile.setCertificatePolicies(x509cainfo.getPolicies());

            } else if (certprofile.getUseCertificatePolicies()) {

                x509ca.setPolicies(certprofile.getCertificatePolicies());

            }

            caAltName = x509cainfo.getSubjectAltName();

        } else {

            // CVC CA is a special type of CA for EAC electronic passports

            log.info("Creating a CVC CA");

            CVCCAInfo cvccainfo = (CVCCAInfo) cainfo;

            // Create CVCCA

            ca = new CVCCA(cvccainfo);

            ca.setCAToken(catoken);

        }

        // Certificate chain

        Collection<Certificate> certificatechain = null;

        String sequence = catoken.getCATokenInfo().getKeySequence(); // get from CAtoken to make sure it is fresh

        if (cainfo.getSignedBy() == CAInfo.SELFSIGNED) {

            try {

                // create selfsigned certificate

                Certificate cacertificate = null;

                log.debug("CAAdminSessionBean : " + cainfo.getSubjectDN());

                UserDataVO cadata = new UserDataVO("nobody", cainfo.getSubjectDN(), cainfo.getSubjectDN().hashCode(), caAltName, null, 0, 0, 0, cainfo

                        .getCertificateProfileId(), null, null, 0, 0, null);

                cacertificate = ca.generateCertificate(cadata, catoken.getPublicKey(SecConst.CAKEYPURPOSE_CERTSIGN), -1, cainfo.getValidity(), certprofile,

                        sequence);

                log.debug("CAAdminSessionBean : " + CertTools.getSubjectDN(cacertificate));

                // Build Certificate Chain

                certificatechain = new ArrayList<Certificate>();

                certificatechain.add(cacertificate);

                // set status to active

                castatus = SecConst.CA_ACTIVE;

            } catch (CATokenOfflineException e) {

                String msg = intres.getLocalizedMessage("error.catokenoffline", cainfo.getName());

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, e);

                throw e;

            } catch (Exception fe) {

                String msg = intres.getLocalizedMessage("caadmin.errorcreateca", cainfo.getName());

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, fe);

                throw new EJBException(fe);

            }

        }

        if (cainfo.getSignedBy() == CAInfo.SIGNEDBYEXTERNALCA) {

            certificatechain = new ArrayList<Certificate>();

            // set status to waiting certificate response.

            castatus = SecConst.CA_WAITING_CERTIFICATE_RESPONSE;

        }

        if (cainfo.getSignedBy() > CAInfo.SPECIALCAIDBORDER || cainfo.getSignedBy() < 0) {

            // Create CA signed by other internal CA.

            try {

              CAData signcadata = CAData.findByIdOrThrow(entityManager, Integer.valueOf(cainfo.getSignedBy()));

                CA signca = signcadata.getCA();

                // Check that the signer is valid

                checkSignerValidity(admin, signcadata);

                // Create CA certificate

                Certificate cacertificate = null;

                UserDataVO cadata = new UserDataVO("nobody", cainfo.getSubjectDN(), cainfo.getSubjectDN().hashCode(), caAltName, null, 0, 0, 0, cainfo

                        .getCertificateProfileId(), null, null, 0, 0, null);

                cacertificate = signca.generateCertificate(cadata, catoken.getPublicKey(SecConst.CAKEYPURPOSE_CERTSIGN), -1, cainfo.getValidity(), certprofile,

                        sequence);

                // Build Certificate Chain

                Collection<Certificate> rootcachain = signca.getCertificateChain();

                certificatechain = new ArrayList<Certificate>();

                certificatechain.add(cacertificate);

                certificatechain.addAll(rootcachain);

                // set status to active

                castatus = SecConst.CA_ACTIVE;

            } catch (CATokenOfflineException e) {

                String msg = intres.getLocalizedMessage("error.catokenoffline", cainfo.getName());

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, e);

                throw e;

            } catch (Exception fe) {

                String msg = intres.getLocalizedMessage("caadmin.errorcreateca", cainfo.getName());

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg, fe);

                throw new EJBException(fe);

            }

        }

        // Set Certificate Chain

        ca.setCertificateChain(certificatechain);

        // Publish CA certificates.

        publishCACertificate(admin, ca.getCertificateChain(), ca.getCRLPublishers(), ca.getSubjectDN());

        if (castatus == SecConst.CA_ACTIVE) {

            // activate External CA Services

            activateAndPublishExternalCAServices(admin, cainfo.getExtendedCAServiceInfos(), ca);

        }

        // Store CA in database.

        try {

          entityManager.persist(new CAData(cainfo.getSubjectDN(), cainfo.getName(), castatus, ca));

            if (castatus == SecConst.CA_ACTIVE) {

                // create initial CRL

                crlCreateSession.createCRLs(admin, ca, cainfo);

            }

            String msg = intres.getLocalizedMessage("caadmin.createdca", cainfo.getName(), Integer.valueOf(castatus));

            logSession.log(admin, ca.getCAId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_INFO_CACREATED, msg);

        } catch (RuntimeException e) {

            String msg = intres.getLocalizedMessage("caadmin.errorcreateca", cainfo.getName());

            logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CACREATED, msg);

            throw e;

        }

        // Update local OCSP's CA certificate cache

        CertificateCacheFactory.getInstance(certificateStoreSession).forceReload();

      if (log.isTraceEnabled()) {

        log.trace("<createCA: "+cainfo.getName());

      }

    }

    @Override

    public void editCA(Admin admin, CAInfo cainfo) throws AuthorizationDeniedException {

        boolean xkmsrenewcert = false;

        boolean cmsrenewcert = false;

        // Check authorization

        if(!authorizationSession.isAuthorizedNoLog(admin, "/super_administrator")) {

            String msg = intres.getLocalizedMessage("caadmin.notauthorizedtoeditca", cainfo.getName());

            logSession.log(admin, cainfo.getCAId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_NOTAUTHORIZEDTORESOURCE,

                    msg);

            throw new AuthorizationDeniedException(msg);

        }

        // Check if extended service certificates are about to be renewed.

        Iterator<ExtendedCAServiceInfo> iter = cainfo.getExtendedCAServiceInfos().iterator();

        while (iter.hasNext()) {

          ExtendedCAServiceInfo next = iter.next();

            // No OCSP Certificate exists that can be renewed.

            if (next instanceof XKMSCAServiceInfo) {

                xkmsrenewcert = ((XKMSCAServiceInfo) next).getRenewFlag();

            } else if (next instanceof CmsCAServiceInfo) {

                cmsrenewcert = ((CmsCAServiceInfo) next).getRenewFlag();

            }

        }

        // Get CA from database

        try {

          CAData cadata = CAData.findByIdOrThrow(entityManager, Integer.valueOf(cainfo.getCAId()));

            CA ca = cadata.getCA();

            // Update CA values

            ca.updateCA(cainfo);

            // Store CA in database

            cadata.setCA(ca);

            // Try to activate the CA token after we have edited the CA

            try {

                CATokenContainer catoken = ca.getCAToken();

                CATokenInfo catokeninfo = cainfo.getCATokenInfo();

                String authCode = catokeninfo.getAuthenticationCode();

                String keystorepass = getDefaultKeyStorePassIfSWAndEmpty(authCode, catokeninfo);

                if (keystorepass != null) {

                    catoken.activate(keystorepass);

                } else {

                    log.debug("Not trying to activate CAToken after editing, authCode == null.");

                }

            } catch (CATokenAuthenticationFailedException ctaf) {

                String msg = intres.getLocalizedMessage("caadmin.errorcreatetokenpin");

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CAEDITED, msg, ctaf);

            } catch (CATokenOfflineException ctoe) {

                String msg = intres.getLocalizedMessage("error.catokenoffline", cainfo.getName());

                logSession.log(admin, admin.getCaId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CAEDITED, msg, ctoe);

            }

            // No OCSP Certificate exists that can be renewed.

            if (xkmsrenewcert) {

                XKMSCAServiceInfo info = (XKMSCAServiceInfo) ca.getExtendedCAServiceInfo(ExtendedCAServiceInfo.TYPE_XKMSEXTENDEDSERVICE);

                Certificate xkmscert = (Certificate) info.getXKMSSignerCertificatePath().get(0);

                ArrayList<Certificate> xkmscertificate = new ArrayList<Certificate>();

                xkmscertificate.add(xkmscert);

                // Publish the extended service certificate, but only for active

                // services

                if ((info.getStatus() == ExtendedCAServiceInfo.STATUS_ACTIVE) && (!xkmscertificate.isEmpty())) {

                    publishCACertificate(admin, xkmscertificate, ca.getCRLPublishers(), ca.getSubjectDN());

                }

            }

            if (cmsrenewcert) {

                CmsCAServiceInfo info = (CmsCAServiceInfo) ca.getExtendedCAServiceInfo(ExtendedCAServiceInfo.TYPE_CMSEXTENDEDSERVICE);

                Certificate cmscert = (Certificate) info.getCertificatePath().get(0);

                ArrayList<Certificate> cmscertificate = new ArrayList<Certificate>();

                cmscertificate.add(cmscert);

                // Publish the extended service certificate, but only for active

                // services

                if ((info.getStatus() == ExtendedCAServiceInfo.STATUS_ACTIVE) && (!cmscertificate.isEmpty())) {

                    publishCACertificate(admin, cmscertificate, ca.getCRLPublishers(), ca.getSubjectDN());

                }

            }

            // Log Action

            String msg = intres.getLocalizedMessage("caadmin.editedca", cainfo.getName());

            logSession.log(admin, cainfo.getCAId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_INFO_CAEDITED, msg);

        } catch (Exception fe) {

            String msg = intres.getLocalizedMessage("caadmin.erroreditca", cainfo.getName());

            log.error(msg, fe);

            logSession.log(admin, cainfo.getCAId(), LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_CAEDITED, msg, fe);

            throw new EJBException(fe);

        }

    }

    @TransactionAttribute(TransactionAttributeType.SUPPORTS)

    @Override

    public CAInfo getCAInfoOrThrowException(Admin admin, String name) throws CADoesntExistsException {

        return caSession.getCA(admin, name).getCAInfo();

    }

    @TransactionAttribute(TransactionAttributeType.SUPPORTS)

    @Override

    public CAInfo getCAInfo(Admin admin, String name) {

        CAInfo caInfo = null;

        try {

            caInfo = getCAInfoOrThrowException(admin, name);

        } catch (CADoesntExistsException e) {

            // NOPMD ignore, we want to return null and getCAInfoOrThrowException already logged

          // that we could not find it

        }

        return caInfo;

    }

    @TransactionAttribute(TransactionAttributeType.SUPPORTS)

    @Override

    public CAInfo getCAInfoOrThrowException(Admin admin, int caid) throws CADoesntExistsException {

        return getCAInfoOrThrowException(admin, caid, false);

    }

    /**

     * Internal method that get CA info, and optionally performs a sign test

     * with the CAs test signing key.

     *

     * If doSignTest is true, and the CA is active and the CA is included in

     * healthcheck (cainfo.getIncludeInHealthCheck()), a signature with the test

     * keys is performed to set the CA Token status correctly.

     *

     * @param admin

     *            administrator performing this action

     * @param caid

     *            numerical id of CA (subjectDN.hashCode()) that we search for

     * @param doSignTest

     *            true if a test signature should be performed, false if only

     *            the status from token info is checked. Should normally be set

     *            to false.

     * @return CAInfo value object, never null

     * @throws CADoesntExistsException

     *             if CA with caid does not exist or admin is not authorized to CA

     */

    private CAInfo getCAInfoOrThrowException(Admin admin, int caid, boolean doSignTest) throws CADoesntExistsException {

        if (!authorizedToCA(admin, caid)) {

            if (log.isDebugEnabled()) {

                log.debug("Admin (" + admin.toString() + ") is not authorized to CA: " + caid);

            }

            String msg = intres.getLocalizedMessage("caadmin.canotexistsid", Integer.valueOf(caid));

            throw new CADoesntExistsException(msg);

        }

        CAInfo cainfo = null;

        try {

            CA ca = caSession.getCA(admin, caid);      

            cainfo = ca.getCAInfo();

            int status = cainfo.getStatus();

            boolean includeInHealthCheck = cainfo.getIncludeInHealthCheck();

            int tokenstatus = ICAToken.STATUS_OFFLINE;

            if (doSignTest && status == SecConst.CA_ACTIVE && includeInHealthCheck) {

                // Only do a real test signature if the CA is supposed to be

                // active and if it is included in healthchecking

                // Otherwise we will only waste resources

                if (log.isDebugEnabled()) {

                    log.debug("Making test signature with CAs token. CA=" + ca.getName() + ", doSignTest=" + doSignTest + ", CA status=" + status

                            + ", includeInHealthCheck=" + includeInHealthCheck);

                }

                CATokenContainer catoken = ca.getCAToken();

                tokenstatus = catoken.getCATokenInfo().getCATokenStatus();

            } else {

                // if (log.isDebugEnabled()) {

                // log.debug("Not making test signature with CAs token. doSignTest="+doSignTest+", CA status="+status+", includeInHealthCheck="+includeInHealthCheck);

                // }

                tokenstatus = cainfo.getCATokenInfo().getCATokenStatus();

            }

            // Set a possible new status in the info value object

            cainfo.getCATokenInfo().setCATokenStatus(tokenstatus);

        } catch (CADoesntExistsException ce) {

            // Just re-throw, getCAInternal has already logged that the CA does

            // not exist

            throw ce;

        } catch (Exception e) {

            String msg = intres.getLocalizedMessage("caadmin.errorgetcainfo", Integer.valueOf(caid));

            log.error(msg, e);

            throw new EJBException(e);

        }

        return cainfo;

    }

    @TransactionAttribute(TransactionAttributeType.SUPPORTS)

    @Override

    public CAInfo getCAInfo(Admin admin, int caid) {

        // No sign test for the standard method

        return getCAInfo(admin, caid, false);

    }

    @TransactionAttribute(TransactionAttributeType.SUPPORTS)

    @Override

    public CAInfo getCAInfo(Admin admin, int caid, boolean doSignTest) {

        CAInfo caInfo = null;

        try {

            caInfo = getCAInfoOrThrowException(admin, caid, doSignTest);

        } catch (CADoesntExistsException e) {

            // NOPMD ignore, we want to return null and getCAInfoOrThrowException already logged

          // that we could not find it

        }

        return caInfo;

    }

    @Override

    public void verifyExistenceOfCA(int caid) throws CADoesntExistsException {

      // TODO: Test if "SELECT a.caId FROM CAData a WHERE a.caId=:caId" improves performance

      CAData.findByIdOrThrow(entityManager, Integer.valueOf(caid));

    }

    @TransactionAttribute(TransactionAttributeType.SUPPORTS)

    @Override

    public HashMap<Integer,String> getCAIdToNameMap(Admin admin) {

        HashMap<Integer, String> returnval = new HashMap<Integer, String>();

        Collection<CAData> result = CAData.findAll(entityManager);

        Iterator<CAData> iter = result.iterator();

        while (iter.hasNext()) {

          CAData cadata = iter.next();

          returnval.put(cadata.getCaId(), cadata.getName());

        }

        return returnval;

    }

    @Override

    public byte[] makeRequest(Admin admin, int caid, Collection<?> cachainin, boolean regenerateKeys, boolean usenextkey, boolean activatekey, String keystorepass)

            throws CADoesntExistsException, AuthorizationDeniedException, CertPathValidatorException, CATokenOfflineException,

            CATokenAuthenticationFailedException {

        if (log.isTraceEnabled()) {

            log.trace(">makeRequest: " + caid + ", regenerateKeys=" + regenerateKeys + ", usenextkey=" + usenextkey + ", activatekey=" + activatekey);

        }

        byte[] returnval = null;

        // Check authorization

        try {

           

            if(!authorizationSession.isAuthorizedNoLog(admin, AccessRulesConstants.REGULAR_RENEWCA)) {

                Authorizer.throwAuthorizationException(admin, AccessRulesConstants.REGULAR_RENEWCA, null);

            }

            if (!authorizedToCA(admin, caid)) {

                throw new AuthorizationDeniedException("Not authorized to CA");

            }

        } catch (AuthorizationDeniedException e) {

            String msg = intres.getLocalizedMessage("caadmin.notauthorizedtocertreq", Integer.valueOf(caid));

            logSession.log(admin, caid, LogConstants.MODULE_CA, new java.util.Date(), null, null, LogConstants.EVENT_ERROR_NOTAUTHORIZEDTORESOURCE, msg, e);

            throw new AuthorizationDeniedException(msg);

        }

        // Get CA info.

        CAData cadata = null;

        try {

          cadata = CAData.findByIdOrThrow(entityManager, Integer.valueOf(caid));

            CA ca = cadata.getCA();

            String caname = ca.getName();

            Collection<Certificate> chain = null;

            if ((cachainin != null) && (cachainin.size() > 0)) {

                chain = CertTools.createCertChain(cachainin);

                log.debug("Setting request certificate chain of size: " + chain.size());

                ca.setRequestCertificateChain(chain);

            } else {

                log.debug("Empty request certificate chain parameter.");

                // create empty list if input was null

                chain = new ArrayList<Certificate>();

            }

            // AR+ patch to make SPOC independent of external CVCA certificates for automatic renewals

            // i.e. if we don't pass a CA certificate as parameter we try to find a suitable CA certificate in the database, among existing CAs

            // (can be a simple imported CA-certificate of external CA)

            if (chain.isEmpty() &&

              ca.getCAType() == CAInfo.CATYPE_CVC &&

                ca.getSignedBy() == CAInfo.SIGNEDBYEXTERNALCA &&

                ca.getStatus() == SecConst.CA_ACTIVE){

              CardVerifiableCertificate dvcert = (CardVerifiableCertificate)ca.getCACertificate();

          String ca_ref = dvcert.getCVCertificate().getCertificateBody().getAuthorityReference().getConcatenated();

              log.debug("DV renewal missing CVCA cert, try finding CA for:"+ ca_ref);

            Iterator<Integer> cas = caSession.getAvailableCAs(admin).iterator();

            while (cas.hasNext()){

              CA cvca = caSession.getCA(admin,cas.next());

              if (cvca.getCAType() == CAInfo.CATYPE_CVC && cvca.getSignedBy() == CAInfo.SELFSIGNED){

                CardVerifiableCertificate cvccert = (CardVerifiableCertificate)cvca.getCACertificate();

                if (ca_ref.equals (cvccert.getCVCertificate().getCertificateBody().getHolderReference().getConcatenated())){

                        log.debug("Added missing CVCA to rewnewal request: "+ cvca.getName());

                  chain.add(cvccert);

                  break;

                }

              }

             }

            if (chain.isEmpty ()){

                  log.info("Failed finding suitable CVCA, forgot to import it?");

            }

            }

            // AR-

           

            // Generate new certificate request.

            String signAlg = "SHA1WithRSA"; // Default algorithm

            CATokenInfo tinfo = ca.getCAInfo().getCATokenInfo();

            if (tinfo != null) {

                signAlg = tinfo.getSignatureAlgorithm();

            }

            log.debug("Using signing algorithm: " + signAlg + " for the CSR.");

            CATokenContainer caToken = ca.getCAToken();

            if (regenerateKeys) {

                log.debug("Generating new keys.");

                keystorepass = getDefaultKeyStorePassIfSWAndEmpty(keystorepass, caToken.getCATokenInfo());

                caToken.generateKeys(keystorepass, true, activatekey);

                ca.setCAToken(caToken);

                // In order to generate a certificate with this keystore we must

                // make sure it is activated

                ca.getCAToken().activate(keystorepass);

            }

            // The CA certificate signing this request is the first in the

            // certificate chain

            Iterator<Certificate> iter = chain.iterator();

            Certificate cacert = null;

            if (iter.hasNext()) {

                cacert = (Certificate) iter.next();

            }

            // If we don't set status to waiting we want to use the next

            // signature key pair

            int keyPurpose = SecConst.CAKEYPURPOSE_CERTSIGN;

            boolean usepreviouskey = true; // for creating an authenticated