How to add ASN.1 extensions before signing with bouncycastle?

user_12903733 0
Viewed 167

Right, so I am completely stumped. Usually when I sign certificates I use an ASN.1 like below to specify specific rules, that can be used for IoT for example.

1.2.3.4=ASN1:SEQUENCE:seq_sect

[seq_sect]
one=SEQUENCE:do_one
two=SEQUENCE:do_two

[do_one]
field.1 = UTF8:field1/*
field.2 = UTF8:field2/*

[do_two]
field.1 = UTF8:field1/*
field.2 = UTF8:field2/*

I usually use a program called xca, but in this case I have been coding with bouncycastle and have been really struggling in importing this into the X509v3CertificateBuilder. I know I should be using .addExtension, but I'm not particularly certain if I should store the rules in a .txt file or if I should store it in an array and somehow parse through it?

bouncycastle signing asn.1 certificate java
1 Answers

Actually you're using OpenSSL, which xca wraps. Only OpenSSL uses this particular text-based 'config' format for ASN.1. For BouncyCastle you'll have to write code instead, something like (not tested):

ASN1EncodableVector one = new ASN1EncodableVector();
one.add(new DERUTF8String("field1/*"));
one.add(new DERUTF8String("field2/*"));

// if two is really identical to one, just reuse it; otherwise do something different

ASN1EncodableVector outer = new ASN1EncodableVector();
outer.add(new DERSequence(one));
outer.add(new DERSequence(two)); // or one again

builder.addExtension (oid, critical, new DERSequence(outer));

Similar How to add PrivateKeyUsage extension to a certificate using bouncycastle in java? and Creating Custom X509 v3 Extensions in Java with Bouncy Castle

user_28688010
Related