4 Oracle Security Engine

Example 4-1 Code Example for Creating and Retrieving an X500RDN Object

// Create the X500RDN object
X500RDN rdn = new X500RDN(PKIX.id_at_commonName, "Joe Smith");

// Retrieve the value
X500Name n = Instance of oracle.security.crypto.cert.X500Name;
String name = n.getAttribute(PKIX.id_at_commonName).getValue().getValue();

Example 4-2 Code Example for Creating an X500Name Object

X500Name name = new X500Name();
name.addComponent(PKIX.id_at_commonName, "Joe Smith");
name.addComponent(PKIX.id_at_countryName, "USA");
name.addComponent(PKIX.id_at_stateOrProvinceName, "NY");
name.addComponent(PKIX.id_at_localityName, "New York");
name.addComponent(PKIX.id_at_organizationName, "Oracle");
name.addComponent(PKIX.id_at_organizationalUnitName, "Engineering");
name.addComponent(PKIX.emailAddress, "joe.smith@oracle.com");

// Make object DER-encoded so its available to other processes 

byte[] encodedName = Utils.toBytes(name);
X500Name n = new X500Name(new ByteArrayInputStream(encodedName));
String name = n.getAttribute(PKIX.id_at_commonName).getValue().getValue();
String email = n.getAttribute(PKIX.emailAddress).getValue().getValue();

Example 4-3 Code Example for Creating a Certificate Request

//Create CertificateRequest by setting the keys and subject name
 CertificateRequest certReq = new CertificateRequest();
 certReq.setPrivateKey(privKey);
certReq.setPublicKey(pubKey);
 certReq.setSubject(subjectName);

//OR

// Create CertificateRequest by taking an X500Name and KeyPair object
CertificateRequest certReq = new CertificateRequest(subjectName, keyPair);

// Add X.509 certificate extensions in a extensionRequest attribute
X509ExtensionSet extSet = new X509ExtensionSet();

// Basic Constraints: non-CA, critical
extSet.addExtension(new BasicConstraintsExtension(false, true));

// Key Usage: signature, data encipherment, key agreement 
// & non-repudiation flags, critical
extSet.addExtension(new KeyUsageExtension(new int[] {
     KeyUsageExtension.DIGITAL_SIGNATURE,
     KeyUsageExtension.DATA_ENCIPHERMENT,
     KeyUsageExtension.KEY_AGREEMENT,
     KeyUsageExtension.NON_REPUDIATION},
        true));

// Subject Alternative Name: email address, non-critical
if (email.length() > 0)
    extSet.addExtension(new SubjectAltNameExtension(
        new GeneralName(GeneralName.Type.RFC822_NAME, email), false));

// Subject Key Identifier: key ID bytes, non-critical
extSet.addExtension(new SubjectKeyIDExtension
    (CryptoUtils.generateKeyID(kp.getPublic())));
req.addAttribute(PKIX.extensionRequest, extSet);

// Sign the certificate request and save to file
req.sign();
req.output(reqOS);
reqOS.close();
	}
// The certificate request can then be sent to a CA