Rand/eng works

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
import org.bouncycastle.asn1.x500.RDN;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.asn1.x500.style.IETFUtils;
import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.net.InetAddress;
import java.net.NetworkInterface;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.CertificateParsingException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.Enumeration;
import java.util.List;

public class CertificateUtils {

    private static final Logger logger = new Logger(CertificateUtils.class);

    /**
     * Custom Trust Manager to ignore trust paths.
     * Source from https://www.xinotes.net/notes/note/1088/
     */
    static TrustManager trm = new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() {
            return null;
        }

        public void checkClientTrusted(X509Certificate[] certs, String authType) {
        }

        public void checkServerTrusted(X509Certificate[] certs, String authType) {
        }
    };

    /**
     * Retrieves chain of certificates from a given site.
     * Source from https://www.xinotes.net/notes/note/1088
     *
     * @param host Host IP
     * @param port Numeric port
     * @return Array with X509 certificates
     * @throws NoSuchAlgorithmException when an SSL instance cannot be retrieved
     * @throws IOException              when SSL socket cannot be created, closed, or cannot establish handshake;
     *                                  as well as when session cannot retrieve the peer certificates
     * @throws KeyManagementException   when SSL context cannot be initialised
     */
    public static Certificate[] getCertificateChain(String host, int port) throws
            NoSuchAlgorithmException, IOException, KeyManagementException {
        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, new TrustManager[]{trm}, null);
        SSLSocketFactory factory = sc.getSocketFactory();
        SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
        socket.startHandshake();
        SSLSession session = socket.getSession();
        Certificate[] serverCerts = session.getPeerCertificates();
        socket.close();
        return serverCerts;
    }

    /**
     * Retrieves chain of certificates from a given site.
     * Port defaults to the typical SSL connection port (443).
     *
     * @param host Host IP
     * @return Array with X509 certificates
     * @throws NoSuchAlgorithmException when an SSL instance cannot be retrieved
     * @throws IOException              when SSL socket cannot be created, closed, or cannot establish handshake;
     *                                  as well as when session cannot retrieve the peer certificates
     * @throws KeyManagementException   when SSL context cannot be initialised
     */
    public static Certificate[] getCertificateChain(String host) throws
            NoSuchAlgorithmException, IOException, KeyManagementException {
        return getCertificateChain(host, 443);
    }

    /**
     * Retrieves DNS or CN from a given chain of X509 certificates.
     * This iterates through the chain of certificates and for each of them it will try:
     * 1) fetch the DNS in the alternative names,
     * 2) otherwise fetch the CN
     * From the returned list, typically the first entry (entries) correspond to the server certificate.
     *
     * @param chain Array with X509 certificates
     * @return List with DNSs or CNs for each of the certificates in the chain
     * @throws CertificateException when certificate cannot be retrieved, a certificate factory cannot get an X509
     *                              instance or generate a certificate; as well as when a a JCAX509 certificate
     *                              cannot be created
     */
    public static ArrayList<String> getCNsFromChain(Certificate[] chain) throws CertificateException {
        ArrayList<String> chainCNs = new ArrayList<>();
        // The first certificate will be the one for the exposed service. Going up in the chain reaches the top CAs
        for (Certificate cert : chain) {
            // Read X509 certificate (source from https://stackoverflow.com/a/41441860/2186237)
            ByteArrayInputStream inputStream = new ByteArrayInputStream(cert.getEncoded());
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
            X509Certificate dec = (X509Certificate) certFactory.generateCertificate(inputStream);
            JcaX509CertificateHolder decJCA = new JcaX509CertificateHolder(dec);
            // Attempt 1: obtain DNS name (X509v3 extensions > X509v3 Subject Alternative Name)
            try {
                Collection<List<?>> altNames = dec.getSubjectAlternativeNames();
                if (altNames == null) {
                    altNames = Collections.emptyList();
                }
                for (List<?> item : altNames) {
                    // Remove wildcards from CN
                    if (item.size() >= 2) {
                        chainCNs.add(item.get(1).toString());
                    }
                }
            } catch (CertificateParsingException e) {
                logger.error("Error parsing SubjectAltName in certificate: " + dec + "\r\nerror:" + e.getLocalizedMessage(), e);
            }
            // Attempt 2: obtain subject CN (source from https://stackoverflow.com/a/5527171/2186237)
            if (chainCNs.isEmpty()) {
                X500Name x500name = decJCA.getSubject();
                RDN cn = x500name.getRDNs(BCStyle.CN)[0];
                String commonName = IETFUtils.valueToString(cn.getFirst().getValue());
                chainCNs.add(commonName);
            }

            for (int i = 0; i < chainCNs.size(); i++) {
                // Remove wildcards from CN
                chainCNs.set(i, chainCNs.get(i).replace("*.", ""));
            }
        }

        return chainCNs;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
import org.junit.Test;

import java.security.cert.Certificate;
import java.util.ArrayList;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;

public class CertificateUtilsTest {

    private void shouldGetCN(String expectedCN, String hostIP) throws Exception {
        Certificate[] chainCerts = CertificateUtils.getCertificateChain(hostIP);
        ArrayList<String> chainCNs = CertificateUtils.getCNsFromChain(chainCerts);
        assertTrue(chainCNs.size() >= 1);
        assertEquals(expectedCN, chainCNs.get(0));
    }

    @Test
    public void shouldGetGoogleCN() throws Exception {
        shouldGetCN("dns.google", "8.8.8.8");
    }

    @Test
    public void shouldGetCloudflareCN() throws Exception {
        shouldGetCN("cloudflare-dns.com", "1.1.1.1");
    }
}