if (ca.getStatus() == SecConst.CA_OFFLINE) {
String msg = intres.getLocalizedMessage("error.catokenoffline", cadata.getName());
throw new CATokenOfflineException(msg);
}
CATokenContainer caToken = ca.getCAToken();
if (regenerateKeys) {
boolean renew = true;
keystorepass = getDefaultKeyStorePassIfSWAndEmpty(keystorepass, caToken.getCATokenInfo());
// for internal CAs the new keys are always activated
caToken.generateKeys(keystorepass, renew, true);
// We need to save all this
ca.setCAToken(caToken);
cadata.setCA(ca);
// After this we need to reload all CAs?
// Make sure we store the new CA and token and reload or update
// the caches
Provider prov = Security.getProvider(caToken.getProvider());
if (log.isDebugEnabled() && (prov != null)) {
log.debug("Provider classname: " + prov.getClass().getName());
}
if ((prov != null) && StringUtils.contains(prov.getClass().getName(), "iaik")) {
// This is because IAIK PKCS#11 provider cuts ALL PKCS#11
// sessions when I generate new keys for one CA
CACacheManager.instance().removeAll();
CATokenManager.instance().removeAll();
} else {
// Using the Sun provider we don't have to reload every CA,
// just update values in the caches
CACacheManager.instance().removeCA(ca.getCAId());
CATokenManager.instance().removeCAToken(ca.getCAId());
}
cadata = CAData.findByIdOrThrow(entityManager, Integer.valueOf(caid));
ca = cadata.getCA();
// In order to generate a certificate with this keystore we must
// make sure it is activated
caToken = ca.getCAToken();
caToken.activate(keystorepass);
}
// if issuer is insystem CA or selfsigned, then generate new
// certificate.
if (ca.getSignedBy() != CAInfo.SIGNEDBYEXTERNALCA) {
if (ca.getSignedBy() == CAInfo.SELFSIGNED) {
// create selfsigned certificate
String subjectAltName = null;
if (ca instanceof X509CA) {
X509CA x509ca = (X509CA) ca;
subjectAltName = x509ca.getSubjectAltName();
}
UserDataVO cainfodata = new UserDataVO("nobody", ca.getSubjectDN(), ca.getSubjectDN().hashCode(), subjectAltName, null, 0, 0, 0, ca
.getCertificateProfileId(), null, null, 0, 0, null);
CertificateProfile certprofile = certificateProfileSession.getCertificateProfile(admin, ca.getCertificateProfileId());
// get from CAtoken to make sure it is fresh
String sequence = caToken.getCATokenInfo().getKeySequence();
cacertificate = ca.generateCertificate(cainfodata, ca.getCAToken().getPublicKey(SecConst.CAKEYPURPOSE_CERTSIGN), -1, ca.getValidity(),
certprofile, sequence);
// Build Certificate Chain
cachain = new ArrayList<Certificate>();
cachain.add(cacertificate);
} else {
// Resign with CA above.
if (ca.getSignedBy() > CAInfo.SPECIALCAIDBORDER || ca.getSignedBy() < 0) {
// Create CA signed by other internal CA.
CAData signcadata = CAData.findByIdOrThrow(entityManager, Integer.valueOf(ca.getSignedBy()));
CA signca = signcadata.getCA();
// Check that the signer is valid
checkSignerValidity(admin, signcadata);
// Create cacertificate
String subjectAltName = null;
if (ca instanceof X509CA) {
X509CA x509ca = (X509CA) ca;
subjectAltName = x509ca.getSubjectAltName();
}
UserDataVO cainfodata = new UserDataVO("nobody", ca.getSubjectDN(), ca.getSubjectDN().hashCode(), subjectAltName, null, 0, 0, 0, ca
.getCertificateProfileId(), null, null, 0, 0, null);
CertificateProfile certprofile = certificateProfileSession.getCertificateProfile(admin, ca.getCertificateProfileId());
String sequence = caToken.getCATokenInfo().getKeySequence(); // get from CAtoken to make sure it is fresh
cacertificate = signca.generateCertificate(cainfodata, ca.getCAToken().getPublicKey(SecConst.CAKEYPURPOSE_CERTSIGN), -1, ca
.getValidity(), certprofile, sequence);
// Build Certificate Chain
Collection<Certificate> rootcachain = signca.getCertificateChain();
cachain = new ArrayList<Certificate>();