Adding a new Extension to my generated certificate

Question

I need to add a new Extension of OID 1.3.6.1.5.5.7.1.26 in my certificate. I got this OID extension in my certificate but with the following error:

Certificate Extensions: 10 [1]: ObjectId: 1.3.6.1.5.5.7.1.26 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 0C 30 0A 13 08 33 39 20 64 63 20 32 62 ..0...
39 dc 2b

I want this OID to be recognized similar to other extensions like AuthorityInfoAccess, etc.

Do I need to edit the jar of Bouncy Castle X509 class?

Im using ACME4j as a client and Letsencrypt Boulder as my server.

Here is the CSR Builder code for signing up the certificate.

public void sign(KeyPair keypair) throws IOException {
    //Security.addProvider(new BouncyCastleProvider());
    Objects.requireNonNull(keypair, "keypair");
    if (namelist.isEmpty()) {
        throw new IllegalStateException("No domain was set");
    }

    try {
        GeneralName[] gns = new GeneralName[namelist.size()];
        for (int ix = 0; ix < namelist.size(); ix++) {
            gns[ix] = new GeneralName(GeneralName.dNSName,namelist.get(ix));
        }
        SignatureAlgorithmIdentifierFinder algFinder = new 
                DefaultSignatureAlgorithmIdentifierFinder();
        GeneralNames subjectAltName = new GeneralNames(gns);


        PKCS10CertificationRequestBuilder p10Builder = new     JcaPKCS10CertificationRequestBuilder(namebuilder.build(), keypair.getPublic());

        ExtensionsGenerator extensionsGenerator = new ExtensionsGenerator();
        extensionsGenerator.addExtension(Extension.subjectAlternativeName,     false, subjectAltName);
        //extensionsGenerator.addExtension(Extension.authorityInfoAccess,         true, subjectAltName);
        //extensionsGenerator.addExtension(new ASN1ObjectIdentifier("TBD"),     false, subjectAltName);
        //extensionsGenerator.addExtension(new     ASN1ObjectIdentifier("1.3.6.1.5.5.7.1.24"), false, subjectAltName);
        extensionsGenerator.addExtension(new     ASN1ObjectIdentifier("1.3.6.1.5.5.7.1.26").intern(), false, subjectAltName);
        //extentionsGenerator.addExtension();
            p10Builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest,     extensionsGenerator.generate());


        PrivateKey pk = keypair.getPrivate();
        /*JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder(
                        pk instanceof ECKey ? EC_SIGNATURE_ALG :     EC_SIGNATURE_ALG);
        ContentSigner signer = csBuilder.build(pk);*/

        if(pk instanceof ECKey)
        {
            AlgorithmIdentifier sigAlg = algFinder.find("SHA1withECDSA");
              AlgorithmIdentifier digAlg = new     DefaultDigestAlgorithmIdentifierFinder().
                    find(sigAlg);
            ContentSigner signer = new     JcaContentSignerBuilder("SHA256with"+pk.getAlgorithm()).setProvider(BOUNCY_CASTL    E_PROVIDER).build(keypair.getPrivate());

            csr=p10Builder.build(signer);
            System.out.println("ZIPED CSR ECDSA: "+csr);
        }
        else
        {
            ContentSigner signer = new     JcaContentSignerBuilder("SHA256with"+pk.getAlgorithm()).build(keypair.getPrivate    ()); 
            csr = p10Builder.build(signer);
            System.out.println("ZIPED CSR RSA: "+csr);
        }

        //csr = p10Builder.build(signer);
    } catch (Exception ex) {
        ex.printStackTrace();;
    }
}

Answer 1

This is how im using ACME4j.

public class RSASignedCertificate {

private static final int KEY_SIZE = 2048;

private static final Logger LOG = Logger.getLogger(CCIDClient.class);

@SuppressWarnings("unused")
public void fetchCertificate(String domain,String spid, String email, int port,
        String username, String password, String certPath) throws Exception {
    // Load or create a key pair for the user's account
    boolean createdNewKeyPair = true;
    KeyPair domainKeyPair = null;

    DomainKeyStore details = null;
    KeyPair userKeyPair = null;

    userKeyPair = KeyPairUtils.createKeyPair(KEY_SIZE);

    DateFormat dateTime = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");
    Date date;
    details = new DomainKeyStore();

    // Create Hibernate Util class Object

    // dao=new HibernateDAO();
    boolean isDomainExist = new HibernateDAO().isDomainExist(domain);
    if (isDomainExist) {

        details.setDomain(domain);
        details.setEmail(email);
        date = new Date();
        details.setUpdatedOn(dateTime.parse(dateTime.format(date)));
        boolean updateresult = new HibernateDAO().updateDetails(details);

        LOG.info("User Details Updated ");
    }

    else {

        date = new Date();
        // Date currentDateTime = dateTime.parse(dateTime.format(date));
        details.setEmail(email);
        details.setDomain(domain);
        details.setStatus("Not Registered");
        details.setCreatedOn(dateTime.parse(dateTime.format(date)));
        details.setUpdatedOn(dateTime.parse(dateTime.format(date)));

        boolean isInserted = new HibernateDAO().insertDetails(details);
        if (!isInserted) {
            throw new AcmeException("Unable to insert details");
        }
        LOG.info("User Details inserted ");
    }
    // details=dao.getDetails(domain);

    Session session = null;
    if (userKeyPair != null) {
        session = new Session("http://192.168.1.143:4000/directory", userKeyPair);
        System.out.println(session.getServerUri().toString());
        System.out.println(session.resourceUri(Resource.NEW_REG));
    }
    Registration reg = null;
    try {
        reg = new RegistrationBuilder().create(session);
        LOG.info("Registered a new user, URI: " + reg.getLocation());
    } catch (AcmeConflictException ex) {
        reg = Registration.bind(session, ex.getLocation());
        LOG.info("Account does already exist, URI: " + reg.getLocation());
    }
    date = new Date();
    details.setStatus("Registered");
    details.setRegistrationDate(dateTime.parse(dateTime.format(date)));
    details.setUpdatedOn(dateTime.parse(dateTime.format(date)));

    new HibernateDAO().updateRegistration(details);

    URI agreement = reg.getAgreement();
    LOG.info("Terms of Service: " + agreement);

    if (createdNewKeyPair) {
        boolean accepted = acceptAgreement(reg, agreement);
        if (!accepted) {
            return;
        }
    }

    Authorization auth = null;
    try {
        auth = reg.authorizeDomain(spid);
    } catch (AcmeUnauthorizedException ex) {
        // Maybe there are new T&C to accept?
        boolean accepted = acceptAgreement(reg, agreement);
        if (!accepted) {
            return;
        }
        // Then try again...
        auth = reg.authorizeDomain(spid);
    }
    LOG.info("New authorization for domain " + spid);
    LOG.info("Authorization " + auth);

    Challenge challenge = tokenChallenge(auth);
    // System.out.println("Challendg status before trigger :"+challenge.getStatus());
    if (challenge == null) {
        throw new AcmeException("No Challenge found");
    }

    if (challenge.getStatus() == Status.VALID) {
        return;
    }
    challenge.trigger();
    int attempts = 1;
    // System.out.println("Challendg status after trigger :"+challenge.getStatus());
    while (challenge.getStatus() != Status.VALID && attempts-- > 0) {
        // System.out.println(challenge.getStatus());
        if (challenge.getStatus().equals(Status.PENDING)) {
            challenge.update();
            try {
                Thread.sleep(100);
            } catch (InterruptedException e) {
                LOG.warn("interrupted", e);
                e.printStackTrace();
            }
        }
        if (challenge.getStatus() == Status.INVALID) {
            LOG.error("Challenge failed... Giving up.");
            throw new AcmeServerException("Challenge Failed");
        }
        try {
            Thread.sleep(3000L);
        } catch (InterruptedException ex) {
            LOG.warn("interrupted", ex);
        }
        challenge.update();
    }
    if (challenge.getStatus() != Status.VALID) {
        LOG.error("Failed to pass the challenge... Giving up.");
        throw new AcmeServerException("Challenge Failed");
    }

    date = new Date();
    details.setStatus("Clallenge Completed");
    details.setUpdatedOn(dateTime.parse(dateTime.format(date)));
    new HibernateDAO().updateChallenge(details);

    domainKeyPair = KeyPairUtils.createKeyPair(KEY_SIZE);

    // Generate a CSR for the domain
    CSRBuilder csrb = new CSRBuilder();
    csrb.addDomains(spid);
    csrb.sign(domainKeyPair);

    // System.out.println("CSR:" +csrb.getCSR());

    LOG.info("Keys Algorithm: "
            + domainKeyPair.getPrivate().getAlgorithm());

    PrivateKeyStore privatekey = new PrivateKeyStore();
    privatekey.setDomain(spid);
    privatekey.setEmail(email);
    privatekey.setPrivateKey(domainKeyPair.getPrivate().getEncoded());

    PublicKeyStore publickey = new PublicKeyStore();
    publickey.setDomain(spid);
    publickey.setEmail(email);
    publickey.setPublicKey(domainKeyPair.getPublic().getEncoded());

        // Request a signed certificate
    Certificate certificate = reg.requestCertificate(csrb.getEncoded());
    LOG.info("Success! The certificate for spids " + spid
            + " has been generated!");
    LOG.info("Certificate URI: " + certificate.getLocation());

    String nameFile = spid.replace(".", "") + ".cer";

    X509Certificate sscert = CertificateUtils.createTlsSniCertificate(domainKeyPair,spid);

    System.out.println("Certificate :" +sscert);

    ASN1Primitive o = X509ExtensionUtil.fromExtensionValue(sscert.getExtensionValue(TNAuthorizationList.TN_AUTH_LIST_OID.getId()));
    System.out.println("ASN1:Object "+o+" class: "+o.getClass());
    TNAuthorizationList TNList = TNAuthorizationList.getInstance(o);
    System.out.println(TNList.toString());

    File createFile = new File(certPath + nameFile);
    if (!createFile.exists()) {
        createFile.createNewFile();
    }

    try (FileWriter fw = new FileWriter(createFile.getAbsoluteFile())) {
        CertificateUtils.writeX509Certificate(sscert, fw);
        System.out.println("Certificate " + sscert);
        System.out.println("Certificate Content" + fw);
    }

    date = new Date();
    Calendar c = Calendar.getInstance();
    c.setTime(new Date());
    c.add(Calendar.DATE, 90);
    details.setIssueDate(dateTime.parse(dateTime.format(date)));
    details.setUpdatedOn(dateTime.parse(dateTime.format(date)));
    details.setValidUntil(dateTime.parse(dateTime.format(c.getTime())));
    details.setStatus("Issued");



    details.setCertPath(certPath + nameFile);
    new HibernateDAO().updateCertificate(details);

}

public boolean acceptAgreement(Registration reg, URI agreement) throws AcmeException
         {

    reg.modify().setAgreement(agreement).commit();
    LOG.info("Updated user's ToS");

    return true;
}

public Challenge tokenChallenge(Authorization auth)
{
    TokenChallenge chall = auth.findChallenge(TokenChallenge.TYPE);

    LOG.info("File name: " + chall.getType());
    //LOG.info("Content: " + chall.`);
    return chall;

}

Answer 2

As the OID 1.3.6.1.5.5.7.1.26 is still a draft, I believe it's very unlikely that tools and systems like Let's Encrypt recognize this extension (they'll probably do it after this extension becomes official, and I really don't know the bureaucratic process behind such approvals).

Which means you'll probably have to code it. I've been using Bouncy Castle for a couple of years but never had to create a new ASN1 structure. But if I had to, I'd take a look at its source code as an initial guidance.

Considering the ASN1 structure of this extension:

 TNAuthorizationList ::= SEQUENCE SIZE (1..MAX) OF TNEntry

 TNEntry ::= CHOICE {
   spc   [0] ServiceProviderCodeList,
   range [1] TelephoneNumberRange,
   one       E164Number
   }

 ServiceProviderCodeList ::= SEQUENCE SIZE (1..3) OF IA5String

 -- Service Provider Codes may be OCNs, various SPIDs, or other
 -- SP identifiers from the telephone network

 TelephoneNumberRange ::= SEQUENCE {
   start E164Number,
   count INTEGER
   }

 E164Number ::= IA5String (SIZE (1..15)) (FROM ("0123456789#*"))

The extension value must be a SEQUENCE of TNEntry. So you could use ASN1Sequence (or its subclass DERSequence) and put instances of TNEntry inside it.

To create a TNEntry, you need to implement ASN1Choice (take a look at source of GeneralName class and do something similar).

And so on, until you have the whole structure mapped to their respective classes, using Bouncy Castle built-in classes to support you (there are DERIA5String for IA5String and DERInteger for INTEGER, which can be used in ServiceProviderCodeList and TelephoneNumberRange)

After that you can build your own parser, which can recognize this extension. But as I said, don't expect other tools to recognize it.

Answer 3

Right now, for testing purpose , Im just passing a string value from my CA Boulder. So to read that, this is the custom ASN1 Object STructure for TNAUthList.

public class TNAuthorizationList extends ASN1Object implements ASN1Choice{

public static final int spc                     = 0;
public static final int range                   = 1;

private ASN1Encodable obj;
private int           tag;

public TNAuthorizationList(
        int           tag,
        ASN1Encodable name)
    {
        this.obj = name;
        this.tag = tag;
    }

public TNAuthorizationList(
        int       tag,
        String    name)
    {
        this.tag = tag;

        if (tag == spc)
        {
            this.obj = new DERIA5String(name);
        }
        else if (tag == range)
        {
            this.obj = new ASN1ObjectIdentifier(name);
        }
        else
        {
            throw new IllegalArgumentException("can't process String for tag: " + tag);
        }
    }

public static TNAuthorizationList getInstance(
        Object obj)
    {
        if (obj == null || obj instanceof TNAuthorizationList)
        {
            return (TNAuthorizationList)obj;
        }

        if (obj instanceof ASN1TaggedObject)
        {
            ASN1TaggedObject    tagObj = (ASN1TaggedObject)obj;
            int                 tag = tagObj.getTagNo();

            switch (tag)
            {
            case spc:
                return new TNAuthorizationList(tag, DERIA5String.getInstance(tagObj, false));
            }
        }

        if (obj instanceof byte[])
        {
            try
            {
                return getInstance(ASN1Primitive.fromByteArray((byte[])obj));
            }
            catch (IOException e)
            {
                throw new IllegalArgumentException("unable to parse encoded general name");
            }
        }

        throw new IllegalArgumentException("unknown object in getInstance: " + obj.getClass().getName());
    }

public static TNAuthorizationList getInstance(
        ASN1TaggedObject tagObj,
        boolean          explicit)
    {
        return TNAuthorizationList.getInstance(ASN1TaggedObject.getInstance(tagObj, true));
    }

    public int getTagNo()
    {
        return tag;
    }

    public ASN1Encodable getSpc()
    {
        return obj;
    }

    public String toString()
    {
        StringBuffer buf = new StringBuffer();

        buf.append(tag);
        buf.append(": ");
        switch (tag)
        {
        case spc:
            buf.append(DERIA5String.getInstance(obj).getString());
            break;
        default:
            buf.append(obj.toString());
        }
        return buf.toString();
    }



/**
*TNEntry ::= CHOICE {
*       spc   [0] ServiceProviderCodeList,
*       range [1] TelephoneNumberRange,
*       one       E164Number
*       }
*/
@Override
public ASN1Primitive toASN1Primitive() {
    // TODO Auto-generated method stub
    return new DERTaggedObject(false, tag, obj);
}

}

As You suggested I have passed the OID value to X509Util class and printed the Output.

ASN1Object o = X509ExtensionUtil.fromExtensionValue(cert.getExtensionValue("1.3.6.1.5.5.7.1.26"));
    System.out.println("ASN1 Object: "+o);
    System.out.println("get Class "+o.getClass());

and the O/P is

ASN1 Object: [SPID : 39 dc 2b]
get Class class org.bouncycastle.asn1.DLSequence

Is this fine. How do i parse this with my custom ASN1 Structure?

Answer 4

Note: for these codes I used bcprov-jdk15on 1.56

Some comments about your code. First of all, note the ASN1 structure:

TNAuthorizationList ::= SEQUENCE SIZE (1..MAX) OF TNEntry

TNEntry ::= CHOICE {
  spc   [0] ServiceProviderCodeList,
  range [1] TelephoneNumberRange,
  one       E164Number
}

Note that TNEntry is a choice, and TNAuthorizationList is a sequence of TNEntry objects. So your class name should be changed to TNEntry. In the code below, please remember that I've changed the class name to TNEntry.

I've also changed some things in this class. In getInstance(Object obj) method, the types of spc and range fields are incorrect (according to ASN1 definition, they are both sequences):

switch (tag) {
    case spc:
    case range: // both are sequences
        return new TNEntry(tag, ASN1Sequence.getInstance(tagObj, false));
    // not sure about "one" field, as it's not tagged
}

I just don't know how to handle the one field, as it's not tagged. Maybe it should be a DERIA5String, or maybe there's another type for "untagged" choices.

In this same class (remember, I've changed its name to TNEntry), I also removed the constructor public TNEntry(int tag, String name) because I'm not sure if it applies (at least I didn't need to use it, but you can keep it if you want), and I've changed toString method to return a more readable string:

public String toString() {
    String sep = System.getProperty("line.separator");
    StringBuffer buf = new StringBuffer();

    buf.append(this.getClass().getSimpleName());
    buf.append(" [").append(tag);
    buf.append("]: ");
    switch (tag) {
        case spc:
            buf.append("ServiceProviderCodeList: ").append(sep);
            ASN1Sequence seq = (ASN1Sequence) this.obj;
            int size = seq.size();
            for (int i = 0; i < size; i++) {
                // all elements are DERIA5Strings
                DERIA5String str = (DERIA5String) seq.getObjectAt(i);
                buf.append("    ");
                buf.append(str.getString());
                buf.append(sep);
            }
            break;

        case range:
            buf.append("TelephoneNumberRange: ").append(sep);

            // there are always 2 elements in TelephoneNumberRange
            ASN1Sequence s = (ASN1Sequence) this.obj;
            DERIA5String str = (DERIA5String) s.getObjectAt(0);
            buf.append("    start: ");
            buf.append(str.getString());
            buf.append(sep);
            ASN1Integer count = (ASN1Integer) s.getObjectAt(1);
            buf.append("    count: ");
            buf.append(count.toString());
            buf.append(sep);
            break;

        default:
            buf.append(obj.toString());
    }

    return buf.toString();
}

And I also created a TNAuthorizationList class, which holds the sequence of TNEntry objects (remember that I've changed your class name to TNEntry, so this TNAuthorizationList class is a different one). Note that I also created a constant to hold the OID (just to make things a little bit easier):

public class TNAuthorizationList extends ASN1Object {
    // put OID in a constant, so I don't have to remember it all the time
    public static final ASN1ObjectIdentifier TN_AUTH_LIST_OID = new ASN1ObjectIdentifier("1.3.6.1.5.5.7.1.26");

    private TNEntry[] entries;

    public TNAuthorizationList(TNEntry[] entries) {
        this.entries = entries;
    }

    public static TNAuthorizationList getInstance(Object obj) {
        if (obj instanceof TNAuthorizationList) {
            return (TNAuthorizationList) obj;
        }
        if (obj != null) {
            return new TNAuthorizationList(ASN1Sequence.getInstance(obj));
        }

        return null;
    }

    public static TNAuthorizationList getInstance(ASN1TaggedObject obj, boolean explicit) {
        return getInstance(ASN1Sequence.getInstance(obj, explicit));
    }

    private TNAuthorizationList(ASN1Sequence seq) {
        this.entries = new TNEntry[seq.size()];

        for (int i = 0; i != seq.size(); i++) {
            entries[i] = TNEntry.getInstance(seq.getObjectAt(i));
        }
    }

    public TNEntry[] getEntries() {
        TNEntry[] tmp = new TNEntry[entries.length];
        System.arraycopy(entries, 0, tmp, 0, entries.length);
        return tmp;
    }

    @Override
    public ASN1Primitive toASN1Primitive() {
        return new DERSequence(entries);
    }

    public String toString() {
        String sep = System.getProperty("line.separator");
        StringBuffer buf = new StringBuffer();

        buf.append(this.getClass().getSimpleName());
        buf.append(":").append(sep);
        for (TNEntry tnEntry : entries) {
            buf.append("  ");
            buf.append(tnEntry.toString());
            buf.append(sep);
        }
        return buf.toString();
    }
}

Now, to add this extension to a certificate, I've done this code (with some sample data as I don't know what should be in each field in a real world situation):

X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(etc...);

// create TNEntries for TNAuthorizationList
TNEntry[] entries = new TNEntry[2];

// create a "spc" entry
DERIA5String[] cList = new DERIA5String[] { new DERIA5String("spc1"), new DERIA5String("spc2") };
DERSequence spc = new DERSequence(cList);
entries[0] = TNEntry.getInstance(new DERTaggedObject(false, TNEntry.spc, spc));

// create a "range" entry
DERSequence range = new DERSequence(new ASN1Encodable[] { new DERIA5String("123456"), new ASN1Integer(1) });
entries[1] = TNEntry.getInstance(new DERTaggedObject(false, TNEntry.range, range));

TNAuthorizationList tnAuthList = new TNAuthorizationList(entries);
builder.addExtension(TNAuthorizationList.TN_AUTH_LIST_OID, false, tnAuthList);

Once you have the certificate object (a X509Certificate in my example), you can do:

// cert is a X509Certificate instance
ASN1Primitive value = X509ExtensionUtil.fromExtensionValue(cert.getExtensionValue(TNAuthorizationList.TN_AUTH_LIST_OID.getId()));
TNAuthorizationList authList = TNAuthorizationList.getInstance(value);
System.out.println(authList.toString());

The output will be:

TNAuthorizationList:
  TNEntry [0]: ServiceProviderCodeList: 
    spc1
    spc2

  TNEntry [1]: TelephoneNumberRange: 
    start: 123456
    count: 1

---

Notes:

• As I said, this code is incomplete because I'm not sure how to handle the one field of TNEntry, because it's not tagged (I don't know if it must be a DERIA5String or if there's another type of object for an "untagged" field).
• You could also do some improvements:
  • ServiceProviderCodeList can have 1 to 3 elements, so you could validate its size
  • TelephoneNumberRange: the start field has a specific format (FROM ("0123456789#*") which I think it means only these characters are accepted), so you could also validate it
  • To create the values for ServiceProviderCodeList and TelephoneNumberRange, I've created the DERSequence objects by hand, but you can create custom classes for them if you want: ServiceProviderCodeList could hold a list of DERIA5String and perform proper validations in its constructor (size from 1 to 3), and TelephoneNumberRange could have start and count fields (with proper validation of start value) - and toASN1Primitive just need to return a DERSequence of its fields in the right order

---

For your parsing issues, I've checked acme4j code and it uses a java.security.cert.X509Certificate class. The toString() method of this class (when using Sun's default provider) is generating this "extension unknown" output (according to the corresponding code).

So, in order to parse it correctly (show the formatted output as described above), you'll probably have to change acme4j's code (or write your own), creating a new toString() method and include the new TNAuthorizationList classes in this method.

When you provide the code showing how you're using acme4j, I'll update this answer accordingly, if needed.