Skip to content

Commit 6feb6ad

Browse files
uwemaureruwemaurer
authored
Merge pull request #45 from mstohr1975/feature/configurable-certificate-params
feat(certificate): make key length and validity years configurable
2 parents 5dbb782 + 5bebe9d commit 6feb6ad

3 files changed

Lines changed: 93 additions & 24 deletions

File tree

‎.github/workflows/maven.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ on:
88

99
jobs:
1010
build:
11-
11+
permissions:
12+
contents: write
1213
runs-on: ubuntu-latest
1314

1415
steps:
@@ -24,4 +25,5 @@ jobs:
2425

2526
# Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
2627
- name: Update dependency graph
28+
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
2729
uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6

‎src/main/java/org/kopi/ebics/certificate/CertificateManager.java‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@
4242
*/
4343
public class CertificateManager {
4444

45+
private static final String KEY_LENGTH_PROPERTY = "ebics.key.length";
46+
private static final String CERTIFICATE_VALIDITY_YEARS_PROPERTY = "ebics.cert.validity.years";
47+
private static final int DEFAULT_KEY_LENGTH = X509Constants.EBICS_KEY_SIZE;
48+
private static final int DEFAULT_CERTIFICATE_VALIDITY_YEARS = X509Constants.DEFAULT_DURATION / 365;
49+
4550
public CertificateManager(EbicsUser user) {
4651
this.user = user;
4752
generator = new X509Generator();
@@ -54,7 +59,7 @@ public CertificateManager(EbicsUser user) {
5459
*/
5560
public void create() throws GeneralSecurityException, IOException {
5661
Calendar calendar = Calendar.getInstance();
57-
calendar.add(Calendar.DAY_OF_YEAR, X509Constants.DEFAULT_DURATION);
62+
calendar.add(Calendar.YEAR, resolveCertificateValidityYears());
5863

5964
createA005Certificate(new Date(calendar.getTimeInMillis()));
6065
createX002Certificate(new Date(calendar.getTimeInMillis()));
@@ -82,7 +87,7 @@ private void setUserCertificates() {
8287
* @throws IOException
8388
*/
8489
public void createA005Certificate(Date end) throws GeneralSecurityException, IOException {
85-
KeyPair keypair = KeyUtil.makeKeyPair(X509Constants.EBICS_KEY_SIZE);
90+
KeyPair keypair = KeyUtil.makeKeyPair(resolveKeyLength());
8691
a005Certificate = generator.generateA005Certificate(keypair, user.getDN(), new Date(), end);
8792
a005PrivateKey = keypair.getPrivate();
8893
}
@@ -100,7 +105,7 @@ X509Certificate getA005Certificate() {
100105
public void createX002Certificate(Date end) throws GeneralSecurityException, IOException {
101106
KeyPair keypair;
102107

103-
keypair = KeyUtil.makeKeyPair(X509Constants.EBICS_KEY_SIZE);
108+
keypair = KeyUtil.makeKeyPair(resolveKeyLength());
104109
x002Certificate = generator.generateX002Certificate(keypair,
105110
user.getDN(),
106111
new Date(),
@@ -117,7 +122,7 @@ public void createX002Certificate(Date end) throws GeneralSecurityException, IOE
117122
public void createE002Certificate(Date end) throws GeneralSecurityException, IOException {
118123
KeyPair keypair;
119124

120-
keypair = KeyUtil.makeKeyPair(X509Constants.EBICS_KEY_SIZE);
125+
keypair = KeyUtil.makeKeyPair(resolveKeyLength());
121126
e002Certificate = generator.generateE002Certificate(keypair,
122127
user.getDN(),
123128
new Date(),
@@ -220,4 +225,20 @@ public void writePKCS12Certificate(char[] password, OutputStream fos)
220225
private PrivateKey a005PrivateKey;
221226
private PrivateKey x002PrivateKey;
222227
private PrivateKey e002PrivateKey;
228+
229+
private int resolveKeyLength() {
230+
Integer configuredKeyLength = Integer.getInteger(KEY_LENGTH_PROPERTY);
231+
if (configuredKeyLength == null || configuredKeyLength <= 0) {
232+
return DEFAULT_KEY_LENGTH;
233+
}
234+
return configuredKeyLength;
235+
}
236+
237+
private int resolveCertificateValidityYears() {
238+
Integer configuredYears = Integer.getInteger(CERTIFICATE_VALIDITY_YEARS_PROPERTY);
239+
if (configuredYears == null || configuredYears <= 0) {
240+
return DEFAULT_CERTIFICATE_VALIDITY_YEARS;
241+
}
242+
return configuredYears;
243+
}
223244
}

‎src/test/java/org/kopi/ebics/certificate/CertificateManagerTest.java‎

Lines changed: 65 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@
22

33
import static org.junit.jupiter.api.Assertions.assertEquals;
44
import static org.junit.jupiter.api.Assertions.assertNotNull;
5+
import static org.junit.jupiter.api.Assertions.assertTrue;
56

67
import java.io.IOException;
78
import java.security.GeneralSecurityException;
89
import java.security.PrivateKey;
910
import java.security.Security;
1011
import java.security.cert.X509Certificate;
1112
import java.security.interfaces.RSAPublicKey;
13+
import java.time.temporal.ChronoUnit;
1214
import java.util.Calendar;
1315
import java.util.Date;
1416

@@ -30,7 +32,69 @@ class CertificateManagerTest {
3032

3133
@Test
3234
void createA005Certificate() throws GeneralSecurityException, IOException {
33-
var user = new EbicsUser() {
35+
var user = testUser();
36+
var manager = new CertificateManager(user);
37+
Calendar calendar = Calendar.getInstance();
38+
calendar.add(Calendar.DAY_OF_YEAR, X509Constants.DEFAULT_DURATION);
39+
40+
manager.createA005Certificate(new Date(calendar.getTimeInMillis()));
41+
42+
var cert = manager.getA005Certificate();
43+
44+
assertNotNull(cert);
45+
46+
//System.out.println(cert);
47+
48+
assertEquals(3, cert.getVersion(), "Certificate version must be 3 (V3).");
49+
String expectedDN = "CN=test-dn";
50+
assertEquals(expectedDN, cert.getIssuerX500Principal().getName(X500Principal.RFC2253));
51+
assertEquals(expectedDN, cert.getSubjectX500Principal().getName(X500Principal.RFC2253));
52+
assertEquals("SHA256WITHRSA", cert.getSigAlgName());
53+
}
54+
55+
@Test
56+
void createUsesConfiguredKeyLength() throws Exception {
57+
String previousKeyLength = System.getProperty("ebics.key.length");
58+
System.setProperty("ebics.key.length", "3072");
59+
try {
60+
var manager = new CertificateManager(testUser());
61+
manager.create();
62+
var cert = manager.getA005Certificate();
63+
assertNotNull(cert);
64+
assertEquals(3072, ((RSAPublicKey) cert.getPublicKey()).getModulus().bitLength());
65+
} finally {
66+
if (previousKeyLength == null) {
67+
System.clearProperty("ebics.key.length");
68+
} else {
69+
System.setProperty("ebics.key.length", previousKeyLength);
70+
}
71+
}
72+
}
73+
74+
@Test
75+
void createUsesConfiguredCertificateValidityYears() throws Exception {
76+
String previousValidityYears = System.getProperty("ebics.cert.validity.years");
77+
System.setProperty("ebics.cert.validity.years", "2");
78+
try {
79+
var manager = new CertificateManager(testUser());
80+
manager.create();
81+
var cert = manager.getA005Certificate();
82+
assertNotNull(cert);
83+
long validDays = ChronoUnit.DAYS.between(
84+
cert.getNotBefore().toInstant(),
85+
cert.getNotAfter().toInstant());
86+
assertTrue(validDays >= 730 && validDays <= 732);
87+
} finally {
88+
if (previousValidityYears == null) {
89+
System.clearProperty("ebics.cert.validity.years");
90+
} else {
91+
System.setProperty("ebics.cert.validity.years", previousValidityYears);
92+
}
93+
}
94+
}
95+
96+
private EbicsUser testUser() {
97+
return new EbicsUser() {
3498
@Override
3599
public RSAPublicKey getA005PublicKey() {
36100
return null;
@@ -136,24 +200,6 @@ public byte[] decrypt(byte[] encryptedKey, byte[] transactionKey)
136200
throws GeneralSecurityException, IOException, EbicsException {
137201
return new byte[0];
138202
}
139-
140203
};
141-
var manager = new CertificateManager(user);
142-
Calendar calendar = Calendar.getInstance();
143-
calendar.add(Calendar.DAY_OF_YEAR, X509Constants.DEFAULT_DURATION);
144-
145-
manager.createA005Certificate(new Date(calendar.getTimeInMillis()));
146-
147-
var cert = manager.getA005Certificate();
148-
149-
assertNotNull(cert);
150-
151-
//System.out.println(cert);
152-
153-
assertEquals(3, cert.getVersion(), "Certificate version must be 3 (V3).");
154-
String expectedDN = "CN=test-dn";
155-
assertEquals(expectedDN, cert.getIssuerX500Principal().getName(X500Principal.RFC2253));
156-
assertEquals(expectedDN, cert.getSubjectX500Principal().getName(X500Principal.RFC2253));
157-
assertEquals("SHA256WITHRSA", cert.getSigAlgName());
158204
}
159205
}

0 commit comments

Comments
 (0)