Java CMSSignedDataGenerator.addCRLs方法代码示例

import org.bouncycastle.cms.CMSSignedDataGenerator; //导入方法依赖的package包/类
/**
 * Note:
 * Section 5.1 of RFC 3852 [4] requires that, the CMS SignedData version be set to 3 if certificates from
 * SignedData is present AND (any version 1 attribute certificates are present OR any SignerInfo structures
 * are version 3 OR eContentType from encapContentInfo is other than id-data). Otherwise, the CMS
 * SignedData version is required to be set to 1.
 * ---> CMS SignedData Version is handled automatically by BouncyCastle.
 *
 * @param parameters
 *            set of the driving signing parameters
 * @param contentSigner
 *            the contentSigned to get the hash of the data to be signed
 * @param signerInfoGeneratorBuilder
 *            true if the unsigned attributes must be included
 * @param originalSignedData
 *            the original signed data if extending an existing signature. null otherwise.
 * @return the bouncycastle signed data generator which signs the document and adds the required signed and unsigned
 *         CMS attributes
 * @throws eu.europa.esig.dss.DSSException
 */
protected CMSSignedDataGenerator createCMSSignedDataGenerator(final CAdESSignatureParameters parameters, final ContentSigner contentSigner,
		final SignerInfoGeneratorBuilder signerInfoGeneratorBuilder, final CMSSignedData originalSignedData) throws DSSException {
	try {

		final CertificateToken signingCertificate = parameters.getSigningCertificate();

		final CMSSignedDataGenerator generator = new CMSSignedDataGenerator();

		final X509CertificateHolder certHolder = DSSASN1Utils.getX509CertificateHolder(signingCertificate);
		final SignerInfoGenerator signerInfoGenerator = signerInfoGeneratorBuilder.build(contentSigner, certHolder);

		generator.addSignerInfoGenerator(signerInfoGenerator);

		final List<CertificateToken> certificateChain = new LinkedList<CertificateToken>();
		if (originalSignedData != null) {

			generator.addSigners(originalSignedData.getSignerInfos());
			generator.addAttributeCertificates(originalSignedData.getAttributeCertificates());
			generator.addCRLs(originalSignedData.getCRLs());
			generator.addOtherRevocationInfo(id_pkix_ocsp_basic, originalSignedData.getOtherRevocationInfo(id_pkix_ocsp_basic));
			generator.addOtherRevocationInfo(id_ri_ocsp_response, originalSignedData.getOtherRevocationInfo(id_ri_ocsp_response));

			final Store<X509CertificateHolder> certificates = originalSignedData.getCertificates();
			final Collection<X509CertificateHolder> certificatesMatches = certificates.getMatches(null);
			for (final X509CertificateHolder certificatesMatch : certificatesMatches) {
				final CertificateToken token = DSSASN1Utils.getCertificate(certificatesMatch);
				if (!certificateChain.contains(token)) {
					certificateChain.add(token);
				}
			}
		}

		final JcaCertStore jcaCertStore = getJcaCertStore(certificateChain, parameters);
		generator.addCertificates(jcaCertStore);
		return generator;
	} catch (CMSException | OperatorCreationException e) {
		throw new DSSException(e);
	}
}
 

import org.bouncycastle.cms.CMSSignedDataGenerator; //导入方法依赖的package包/类
protected CMSSignedData regenerateCMSSignedData(CMSSignedData cmsSignedData, CAdESSignatureParameters parameters, Store certificatesStore,
		Store attributeCertificatesStore, Store crlsStore, Store otherRevocationInfoFormatStoreBasic, Store otherRevocationInfoFormatStoreOcsp) {
	try {

		final CMSSignedDataGenerator cmsSignedDataGenerator = new CMSSignedDataGenerator();
		cmsSignedDataGenerator.addSigners(cmsSignedData.getSignerInfos());
		cmsSignedDataGenerator.addAttributeCertificates(attributeCertificatesStore);
		cmsSignedDataGenerator.addCertificates(certificatesStore);
		cmsSignedDataGenerator.addCRLs(crlsStore);
		cmsSignedDataGenerator.addOtherRevocationInfo(id_pkix_ocsp_basic, otherRevocationInfoFormatStoreBasic);
		cmsSignedDataGenerator.addOtherRevocationInfo(id_ri_ocsp_response, otherRevocationInfoFormatStoreOcsp);
		final boolean encapsulate = cmsSignedData.getSignedContent() != null;
		if (!encapsulate) {
			List<DSSDocument> detachedContents = parameters.getDetachedContents();
			// CAdES can only sign one document
			final InputStream inputStream = detachedContents.get(0).openStream();
			final CMSProcessableByteArray content = new CMSProcessableByteArray(DSSUtils.toByteArray(inputStream));
			Utils.closeQuietly(inputStream);
			cmsSignedData = cmsSignedDataGenerator.generate(content, encapsulate);
		} else {
			cmsSignedData = cmsSignedDataGenerator.generate(cmsSignedData.getSignedContent(), encapsulate);
		}
		return cmsSignedData;
	} catch (CMSException e) {
		throw new DSSException(e);
	}
}
 

import org.bouncycastle.cms.CMSSignedDataGenerator; //导入方法依赖的package包/类
public void testSHA1WithRSACounterSignature()
    throws Exception
{
    List certList = new ArrayList();
    List crlList = new ArrayList();
    CMSTypedData        msg = new CMSProcessableByteArray("Hello World!".getBytes());

    certList.add(_signCert);
    certList.add(_origCert);

    crlList.add(_signCrl);

    Store           certStore = new JcaCertStore(certList);
    Store           crlStore = new JcaCRLStore(crlList);

    CMSSignedDataGenerator gen = new CMSSignedDataGenerator();

    ContentSigner sha1Signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider(BC).build(_signKP.getPrivate());

    gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider(BC).build()).build(sha1Signer, _signCert));

    gen.addCertificates(certStore);
    gen.addCRLs(crlStore);
    
    CMSSignedData s = gen.generate(msg, true);
    SignerInformation origSigner = (SignerInformation)s.getSignerInfos().getSigners().toArray()[0];
    SignerInformationStore counterSigners1 = gen.generateCounterSigners(origSigner);
    SignerInformationStore counterSigners2 = gen.generateCounterSigners(origSigner);

    SignerInformation signer1 = SignerInformation.addCounterSigners(origSigner, counterSigners1);
    SignerInformation signer2 = SignerInformation.addCounterSigners(signer1, counterSigners2);

    SignerInformationStore cs = signer2.getCounterSignatures();
    Collection csSigners = cs.getSigners();
    assertEquals(2, csSigners.size());

    Iterator it = csSigners.iterator();
    while (it.hasNext())
    {
        SignerInformation   cSigner = (SignerInformation)it.next();
        Collection certCollection = certStore.getMatches(cSigner.getSID());

        Iterator certIt = certCollection.iterator();
        X509CertificateHolder cert = (X509CertificateHolder)certIt.next();

        assertTrue(cSigner.isCounterSignature());
        assertNull(cSigner.getSignedAttributes().get(PKCSObjectIdentifiers.pkcs_9_at_contentType));
        assertEquals(true, cSigner.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BC).build(cert)));
    }
}
 

import org.bouncycastle.cms.CMSSignedDataGenerator; //导入方法依赖的package包/类
public void testSHA1WithRSACounterSignature()
    throws Exception
{
    List                certList = new ArrayList();
    List                crlList = new ArrayList();
    CMSTypedData        msg = new CMSProcessableByteArray("Hello World!".getBytes());

    certList.add(_signCert);
    certList.add(_origCert);

    crlList.add(_signCrl);

    Store           certStore = new JcaCertStore(certList);
    Store           crlStore = new JcaCRLStore(crlList);

    CMSSignedDataGenerator gen = new CMSSignedDataGenerator();

    ContentSigner sha1Signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider(BC).build(_signKP.getPrivate());

    gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider(BC).build()).build(sha1Signer, _signCert));

    gen.addCertificates(certStore);
    gen.addCRLs(crlStore);
    
    CMSSignedData s = gen.generate(msg, true);
    SignerInformation origSigner = (SignerInformation)s.getSignerInfos().getSigners().toArray()[0];
    SignerInformationStore counterSigners1 = gen.generateCounterSigners(origSigner);
    SignerInformationStore counterSigners2 = gen.generateCounterSigners(origSigner);

    SignerInformation signer1 = SignerInformation.addCounterSigners(origSigner, counterSigners1);
    SignerInformation signer2 = SignerInformation.addCounterSigners(signer1, counterSigners2);

    SignerInformationStore cs = signer2.getCounterSignatures();
    Collection csSigners = cs.getSigners();
    assertEquals(2, csSigners.size());

    Iterator it = csSigners.iterator();
    while (it.hasNext())
    {
        SignerInformation   cSigner = (SignerInformation)it.next();
        Collection          certCollection = certStore.getMatches(cSigner.getSID());

        Iterator        certIt = certCollection.iterator();
        X509CertificateHolder cert = (X509CertificateHolder)certIt.next();

        assertTrue(cSigner.isCounterSignature());
        assertNull(cSigner.getSignedAttributes().get(PKCSObjectIdentifiers.pkcs_9_at_contentType));
        assertEquals(true, cSigner.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BC).build(cert)));
    }
}