Repository: shred/acme4j Branch: master Commit: 0f3b7de23b3c Files: 327 Total size: 1.2 MB Directory structure: gitextract_nzsxpl3o/ ├── .github/ │ ├── FUNDING.yml │ └── workflows/ │ └── ci.yml ├── .gitignore ├── .gitlab-ci.yml ├── CONTRIBUTING.md ├── LICENSE-APL.txt ├── README.md ├── acme4j-client/ │ ├── pom.xml │ └── src/ │ ├── main/ │ │ ├── java/ │ │ │ ├── .gitignore │ │ │ ├── module-info.java │ │ │ └── org/ │ │ │ └── shredzone/ │ │ │ └── acme4j/ │ │ │ ├── Account.java │ │ │ ├── AccountBuilder.java │ │ │ ├── AcmeJsonResource.java │ │ │ ├── AcmeResource.java │ │ │ ├── Authorization.java │ │ │ ├── Certificate.java │ │ │ ├── Identifier.java │ │ │ ├── Login.java │ │ │ ├── Metadata.java │ │ │ ├── Order.java │ │ │ ├── OrderBuilder.java │ │ │ ├── PollableResource.java │ │ │ ├── Problem.java │ │ │ ├── RenewalInfo.java │ │ │ ├── RevocationReason.java │ │ │ ├── Session.java │ │ │ ├── Status.java │ │ │ ├── challenge/ │ │ │ │ ├── Challenge.java │ │ │ │ ├── Dns01Challenge.java │ │ │ │ ├── DnsAccount01Challenge.java │ │ │ │ ├── DnsPersist01Challenge.java │ │ │ │ ├── Http01Challenge.java │ │ │ │ ├── TlsAlpn01Challenge.java │ │ │ │ ├── TokenChallenge.java │ │ │ │ └── package-info.java │ │ │ ├── connector/ │ │ │ │ ├── Connection.java │ │ │ │ ├── DefaultConnection.java │ │ │ │ ├── HttpConnector.java │ │ │ │ ├── NetworkSettings.java │ │ │ │ ├── NonceHolder.java │ │ │ │ ├── RequestSigner.java │ │ │ │ ├── Resource.java │ │ │ │ ├── ResourceIterator.java │ │ │ │ ├── TrimmingInputStream.java │ │ │ │ └── package-info.java │ │ │ ├── exception/ │ │ │ │ ├── AcmeException.java │ │ │ │ ├── AcmeLazyLoadingException.java │ │ │ │ ├── AcmeNetworkException.java │ │ │ │ ├── AcmeNotSupportedException.java │ │ │ │ ├── AcmeProtocolException.java │ │ │ │ ├── AcmeRateLimitedException.java │ │ │ │ ├── AcmeServerException.java │ │ │ │ ├── AcmeUnauthorizedException.java │ │ │ │ ├── AcmeUserActionRequiredException.java │ │ │ │ └── package-info.java │ │ │ ├── package-info.java │ │ │ ├── provider/ │ │ │ │ ├── AbstractAcmeProvider.java │ │ │ │ ├── AcmeProvider.java │ │ │ │ ├── ChallengeProvider.java │ │ │ │ ├── ChallengeType.java │ │ │ │ ├── GenericAcmeProvider.java │ │ │ │ ├── actalis/ │ │ │ │ │ ├── ActalisAcmeProvider.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── google/ │ │ │ │ │ ├── GoogleAcmeProvider.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── letsencrypt/ │ │ │ │ │ ├── LetsEncryptAcmeProvider.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── package-info.java │ │ │ │ ├── pebble/ │ │ │ │ │ ├── PebbleAcmeProvider.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── sslcom/ │ │ │ │ │ ├── SslComAcmeProvider.java │ │ │ │ │ └── package-info.java │ │ │ │ └── zerossl/ │ │ │ │ ├── ZeroSSLAcmeProvider.java │ │ │ │ └── package-info.java │ │ │ ├── toolbox/ │ │ │ │ ├── AcmeUtils.java │ │ │ │ ├── JSON.java │ │ │ │ ├── JSONBuilder.java │ │ │ │ ├── JoseUtils.java │ │ │ │ └── package-info.java │ │ │ └── util/ │ │ │ ├── CSRBuilder.java │ │ │ ├── CertificateUtils.java │ │ │ ├── KeyPairUtils.java │ │ │ └── package-info.java │ │ ├── resources/ │ │ │ ├── .gitignore │ │ │ ├── META-INF/ │ │ │ │ └── services/ │ │ │ │ └── org.shredzone.acme4j.provider.AcmeProvider │ │ │ └── org/ │ │ │ └── shredzone/ │ │ │ └── acme4j/ │ │ │ └── provider/ │ │ │ └── pebble/ │ │ │ └── pebble.minica.pem │ │ └── resources-filtered/ │ │ └── org/ │ │ └── shredzone/ │ │ └── acme4j/ │ │ └── version.properties │ └── test/ │ ├── java/ │ │ ├── .gitignore │ │ └── org/ │ │ └── shredzone/ │ │ └── acme4j/ │ │ ├── AccountBuilderTest.java │ │ ├── AccountTest.java │ │ ├── AcmeJsonResourceTest.java │ │ ├── AcmeResourceTest.java │ │ ├── AuthorizationTest.java │ │ ├── CertificateTest.java │ │ ├── IdentifierTest.java │ │ ├── LoginTest.java │ │ ├── OrderBuilderTest.java │ │ ├── OrderTest.java │ │ ├── ProblemTest.java │ │ ├── RenewalInfoTest.java │ │ ├── SessionTest.java │ │ ├── StatusTest.java │ │ ├── challenge/ │ │ │ ├── ChallengeTest.java │ │ │ ├── Dns01ChallengeTest.java │ │ │ ├── DnsAccount01ChallengeTest.java │ │ │ ├── DnsPersist01ChallengeTest.java │ │ │ ├── Http01ChallengeTest.java │ │ │ ├── TlsAlpn01ChallengeTest.java │ │ │ └── TokenChallengeTest.java │ │ ├── connector/ │ │ │ ├── DefaultConnectionTest.java │ │ │ ├── DummyConnection.java │ │ │ ├── HttpConnectorTest.java │ │ │ ├── NetworkSettingsTest.java │ │ │ ├── ResourceIteratorTest.java │ │ │ ├── ResourceTest.java │ │ │ ├── SessionProviderTest.java │ │ │ └── TrimmingInputStreamTest.java │ │ ├── exception/ │ │ │ ├── AcmeExceptionTest.java │ │ │ ├── AcmeLazyLoadingExceptionTest.java │ │ │ ├── AcmeNetworkExceptionTest.java │ │ │ ├── AcmeNotSupportedExceptionTest.java │ │ │ ├── AcmeProtocolExceptionTest.java │ │ │ ├── AcmeRateLimitedExceptionTest.java │ │ │ └── AcmeUserActionRequiredExceptionTest.java │ │ ├── provider/ │ │ │ ├── AbstractAcmeProviderTest.java │ │ │ ├── GenericAcmeProviderTest.java │ │ │ ├── TestableConnectionProvider.java │ │ │ ├── actalis/ │ │ │ │ └── ActalisAcmeProviderTest.java │ │ │ ├── google/ │ │ │ │ └── GoogleAcmeProviderTest.java │ │ │ ├── letsencrypt/ │ │ │ │ └── LetsEncryptAcmeProviderTest.java │ │ │ ├── pebble/ │ │ │ │ └── PebbleAcmeProviderTest.java │ │ │ ├── sslcom/ │ │ │ │ └── SslComAcmeProviderTest.java │ │ │ └── zerossl/ │ │ │ └── ZeroSSLAcmeProviderTest.java │ │ ├── toolbox/ │ │ │ ├── AcmeUtilsTest.java │ │ │ ├── JSONBuilderTest.java │ │ │ ├── JSONTest.java │ │ │ ├── JoseUtilsTest.java │ │ │ └── TestUtils.java │ │ └── util/ │ │ ├── CSRBuilderTest.java │ │ ├── CertificateUtilsTest.java │ │ └── KeyPairUtilsTest.java │ └── resources/ │ ├── .gitignore │ ├── META-INF/ │ │ └── services/ │ │ └── org.shredzone.acme4j.provider.AcmeProvider │ ├── ari-example-cert.pem │ ├── cert.pem │ ├── certid-cert.pem │ ├── csr.der │ ├── domain-private.key │ ├── domain-public.key │ ├── json/ │ │ ├── authorizationChallenges.json │ │ ├── canceledOrderResponse.json │ │ ├── datatypes.json │ │ ├── deactivateAccountResponse.json │ │ ├── directory.json │ │ ├── directoryNoMeta.json │ │ ├── dns01Challenge.json │ │ ├── dnsAccount01Challenge.json │ │ ├── dnsPersist01Challenge.json │ │ ├── finalizeAutoRenewResponse.json │ │ ├── finalizeRequest.json │ │ ├── finalizeResponse.json │ │ ├── genericChallenge.json │ │ ├── httpChallenge.json │ │ ├── httpNoTokenChallenge.json │ │ ├── modifyAccount.json │ │ ├── modifyAccountResponse.json │ │ ├── newAccount.json │ │ ├── newAccountOnlyExisting.json │ │ ├── newAccountResponse.json │ │ ├── newAuthorizationRequest.json │ │ ├── newAuthorizationRequestSub.json │ │ ├── newAuthorizationResponse.json │ │ ├── newAuthorizationResponseSub.json │ │ ├── problem.json │ │ ├── renewalInfo.json │ │ ├── replacedCertificateRequest.json │ │ ├── requestAutoRenewOrderRequest.json │ │ ├── requestAutoRenewOrderResponse.json │ │ ├── requestCertificateRequest.json │ │ ├── requestCertificateRequestWithDate.json │ │ ├── requestOrderRequest.json │ │ ├── requestOrderRequestSub.json │ │ ├── requestOrderResponse.json │ │ ├── requestOrderResponseSub.json │ │ ├── requestProfileOrderRequest.json │ │ ├── requestProfileOrderResponse.json │ │ ├── requestReplacesRequest.json │ │ ├── requestReplacesResponse.json │ │ ├── revokeCertificateRequest.json │ │ ├── revokeCertificateWithReasonRequest.json │ │ ├── tlsAlpnChallenge.json │ │ ├── triggerHttpChallenge.json │ │ ├── triggerHttpChallengeRequest.json │ │ ├── triggerHttpChallengeResponse.json │ │ ├── updateAccount.json │ │ ├── updateAccountResponse.json │ │ ├── updateAuthorizationResponse.json │ │ ├── updateAuthorizationWildcardResponse.json │ │ ├── updateAutoRenewOrderResponse.json │ │ ├── updateHttpChallengeResponse.json │ │ └── updateOrderResponse.json │ ├── private.key │ ├── public.key │ └── simplelogger.properties ├── acme4j-example/ │ ├── .gitignore │ ├── pom.xml │ └── src/ │ ├── main/ │ │ ├── java/ │ │ │ ├── .gitignore │ │ │ ├── module-info.java │ │ │ └── org/ │ │ │ └── shredzone/ │ │ │ └── acme4j/ │ │ │ └── example/ │ │ │ └── ClientTest.java │ │ └── resources/ │ │ ├── .gitignore │ │ └── simplelogger.properties │ └── test/ │ ├── java/ │ │ └── .gitignore │ └── resources/ │ └── .gitignore ├── acme4j-it/ │ ├── pom.xml │ └── src/ │ ├── main/ │ │ ├── docker/ │ │ │ ├── challtestsrv.dockerfile │ │ │ └── challtestsrv.sh │ │ ├── java/ │ │ │ ├── module-info.java │ │ │ └── org/ │ │ │ └── shredzone/ │ │ │ └── acme4j/ │ │ │ └── it/ │ │ │ ├── BammBammClient.java │ │ │ └── package-info.java │ │ └── resources/ │ │ └── .gitignore │ └── test/ │ ├── java/ │ │ └── org/ │ │ └── shredzone/ │ │ └── acme4j/ │ │ └── it/ │ │ ├── ProviderIT.java │ │ ├── SoftFail.java │ │ ├── SoftFailExtension.java │ │ ├── boulder/ │ │ │ └── OrderHttpIT.java │ │ └── pebble/ │ │ ├── AccountIT.java │ │ ├── OrderIT.java │ │ ├── OrderWildcardIT.java │ │ ├── PebbleITBase.java │ │ └── SessionIT.java │ └── resources/ │ └── simplelogger.properties ├── acme4j-smime/ │ ├── .gitattributes │ ├── pom.xml │ ├── src/ │ │ ├── main/ │ │ │ ├── java/ │ │ │ │ ├── .gitignore │ │ │ │ ├── module-info.java │ │ │ │ └── org/ │ │ │ │ └── shredzone/ │ │ │ │ └── acme4j/ │ │ │ │ └── smime/ │ │ │ │ ├── EmailIdentifier.java │ │ │ │ ├── challenge/ │ │ │ │ │ ├── EmailReply00Challenge.java │ │ │ │ │ ├── EmailReply00ChallengeProvider.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── csr/ │ │ │ │ │ ├── KeyUsageType.java │ │ │ │ │ ├── SMIMECSRBuilder.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── email/ │ │ │ │ │ ├── EmailProcessor.java │ │ │ │ │ ├── ResponseBodyGenerator.java │ │ │ │ │ ├── ResponseGenerator.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── exception/ │ │ │ │ │ ├── AcmeInvalidMessageException.java │ │ │ │ │ └── package-info.java │ │ │ │ ├── package-info.java │ │ │ │ └── wrapper/ │ │ │ │ ├── Mail.java │ │ │ │ ├── SignedMail.java │ │ │ │ ├── SignedMailBuilder.java │ │ │ │ ├── SimpleMail.java │ │ │ │ └── package-info.java │ │ │ └── resources/ │ │ │ ├── .gitignore │ │ │ └── META-INF/ │ │ │ └── services/ │ │ │ └── org.shredzone.acme4j.provider.ChallengeProvider │ │ └── test/ │ │ ├── java/ │ │ │ ├── .gitignore │ │ │ └── org/ │ │ │ └── shredzone/ │ │ │ └── acme4j/ │ │ │ └── smime/ │ │ │ ├── EmailIdentifierTest.java │ │ │ ├── SMIMETests.java │ │ │ ├── challenge/ │ │ │ │ └── EmailReply00ChallengeTest.java │ │ │ ├── csr/ │ │ │ │ └── SMIMECSRBuilderTest.java │ │ │ ├── email/ │ │ │ │ └── EmailProcessorTest.java │ │ │ └── wrapper/ │ │ │ ├── SignedMailBuilderTest.java │ │ │ └── SignedMailTest.java │ │ └── resources/ │ │ ├── .gitignore │ │ ├── 7508-fake-ca.jks │ │ ├── 7508-valid-ca.jks │ │ ├── email/ │ │ │ ├── challenge.eml │ │ │ ├── invalid-cert-mismatch.eml │ │ │ ├── invalid-nosan.eml │ │ │ ├── invalid-protected-mail-from.eml │ │ │ ├── invalid-protected-mail-subject.eml │ │ │ ├── invalid-protected-mail-to.eml │ │ │ ├── invalid-signed-mail.eml │ │ │ ├── valid-mail-7508.eml │ │ │ └── valid-mail.eml │ │ ├── invalid-signer-privkey.pem │ │ ├── invalid-signer.pem │ │ ├── json/ │ │ │ ├── emailReplyChallenge.json │ │ │ └── emailReplyChallengeMismatch.json │ │ ├── key.pem │ │ ├── valid-signer-nosan-privkey.pem │ │ ├── valid-signer-nosan.pem │ │ ├── valid-signer-privkey.pem │ │ └── valid-signer.pem │ └── tool/ │ ├── smime-generator.py │ └── test-key-generator.sh ├── pom.xml └── src/ └── doc/ ├── docs/ │ ├── ca/ │ │ ├── actalis.md │ │ ├── google.md │ │ ├── index.md │ │ ├── letsencrypt.md │ │ ├── pebble.md │ │ ├── sslcom.md │ │ └── zerossl.md │ ├── challenge/ │ │ ├── dns-01.md │ │ ├── dns-account-01.md │ │ ├── dns-persist-01.md │ │ ├── email-reply-00.md │ │ ├── http-01.md │ │ ├── index.md │ │ └── tls-alpn-01.md │ ├── development/ │ │ ├── challenge.md │ │ ├── index.md │ │ ├── provider.md │ │ └── testing.md │ ├── example.md │ ├── faq.md │ ├── index.md │ ├── migration.md │ └── usage/ │ ├── account.md │ ├── advanced.md │ ├── connecting.md │ ├── debugging.md │ ├── errors.md │ ├── exceptions.md │ ├── index.md │ ├── order.md │ ├── persistence.md │ ├── renewal.md │ └── revocation.md ├── mkdocs.yml └── theme/ ├── breadcrumbs.html ├── css/ │ ├── font.css │ ├── theme_custom.css │ └── theme_pygments.css ├── footer.html └── main.html ================================================ FILE CONTENTS ================================================ ================================================ FILE: .github/FUNDING.yml ================================================ github: shred ko_fi: shredzone ================================================ FILE: .github/workflows/ci.yml ================================================ name: CI on: pull_request: branches: - master push: branches: - master jobs: build: runs-on: ubuntu-22.04 strategy: matrix: java: [ '17', '21' ] steps: - uses: actions/checkout@v2 - name: Set up JDK uses: actions/setup-java@v2 with: distribution: 'temurin' java-version: ${{ matrix.java }} - name: Build run: mvn --no-transfer-progress -B -P ci verify ================================================ FILE: .gitignore ================================================ target ================================================ FILE: .gitlab-ci.yml ================================================ stages: - build - test variables: DOCKER_TLS_CERTDIR: "/certs" DOCKER_HOST: tcp://docker:2376 DOCKER_TLS_VERIFY: "1" DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client" image: maven:3-eclipse-temurin-17 cache: key: ${CI_COMMIT_REF_SLUG} paths: - /root/.m2/repository/ - acme4j-client/target/ - acme4j-example/target/ - acme4j-it/target/ - acme4j-smime/target/ - target/ build: stage: build script: - apt-get update -y && apt-get install -y mkdocs - mvn -B clean install mkdocs:build test: stage: test services: - name: docker:dind alias: pebble, bammbamm script: - (cd acme4j-it; mvn -B docker:remove) - mvn -B -P ci verify -DpebbleHost=pebble -DbammbammUrl=http://bammbamm:8055 -Ddocker.showLogs=true ================================================ FILE: CONTRIBUTING.md ================================================ # Contributing to _acme4j_ Thank you for taking your time to contribute! ## Acceptance Criteria These criteria must be met for a successful pull request: * Follow the [Style Guide](#style-guide). * If you add code, remember to add [unit tests](#unit-tests) that test your code. * All unit tests must run successfully. * Integration tests should run successfully, unless there is a good reason (e.g. waiting for a pending change in Pebble). * Your commits follow the [git commit](#git-commits) guide. * You accept that your code is distributed under the terms of [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). * You confirm that you did not use AI based code generators like GitHub Copilot for your contribution. ## Style Guide Our style guide bases on [Oracle's Code conventions for the Java Programming Language](http://www.oracle.com/technetwork/java/codeconventions-150003.pdf). These additional rules apply: * Indentation is 4 spaces. Do not use tabs! * Remove trailing spaces. * Line length is 90 characters. You may exceed this length by a few characters if it is easier to read than a wrapped line. * `if`, `for` and `while` statements always use blocks, even for a single statement. * All types and methods must have a descriptive JavaDoc, except of `@Override` annotated methods. For plain getter and setter methods, `@param` and `@return` can be omitted. ## Unit Tests More than 80% of the code is covered by unit tests, and we would like to keep it that way. * Main functionalities must be covered by unit tests. * Corner cases should be covered by unit tests. * Common exception handling does not need to be tested. * No tests are required for code that is not expected to be executed (e.g. `UnsupportedEncodingException` when handling utf-8, or the empty private default constructor of a utility class). * Unit tests should not depend on external resources, as they might be temporarily unavailable at runtime. There are no unit tests required for the `acme4j-example` and `acme4j-it` modules. ## git Commits Good programming does not end with a clean source code, but should have pretty commits as well. * Always put separate concerns into separate commits. * If you have interim commits in your history, squash them with an interactive rebase before sending the pull request. * Use present tense and imperative mood in commit messages ("fix bug #1234", not "fixed bug #1234"). * Always give meaningful commit messages (not just "bug fix"). * The commit message must be concise and should not exceed 50 characters. Further explanations may follow in subsequent lines, with an empty line as separator. * Commits must compile and must not break unit tests. * Do not commit IDE generated files and directories (like `.project` or `.idea`). ================================================ FILE: LICENSE-APL.txt ================================================ Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ================================================ FILE: README.md ================================================ # ACME Java Client ![build status](https://shredzone.org/badge/acme4j.svg) ![maven central](https://shredzone.org/maven-central/org.shredzone.acme4j/acme4j/badge.svg) This is a Java client for the _Automatic Certificate Management Environment_ (ACME) protocol as specified in [RFC 8555](https://tools.ietf.org/html/rfc8555). ACME is a protocol that a certificate authority (CA) and an applicant can use to automate the process of verification and certificate issuance. This Java client helps to connect to an ACME server, and performing all necessary steps to manage certificates. ## Features * Mature and stable code base. First release was in December 2015! * Fully [RFC 8555](https://tools.ietf.org/html/rfc8555) compliant * Supports the `http-01`, `dns-01`, and `tls-alpn-01` ([RFC 8737](https://tools.ietf.org/html/rfc8737)) challenges * Supports [RFC 8738](https://tools.ietf.org/html/rfc8738) IP identifier validation * Supports [RFC 8739](https://tools.ietf.org/html/rfc8739) short-term automatic certificate renewal (experimental) * Supports [RFC 8823](https://tools.ietf.org/html/rfc8823) for S/MIME certificates (experimental) * Supports [RFC 9444](https://tools.ietf.org/html/rfc9444) for subdomain validation * Supports [RFC 9773](https://tools.ietf.org/html/rfc9773) for renewal information * Supports [draft-ietf-acme-profiles-01](https://datatracker.ietf.org/doc/draft-ietf-acme-profiles/) for certificate profiles (experimental) * Supports [draft-ietf-acme-dns-account-label-02](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/) for DNS labeled with ACME account ID challenges (experimental) * Supports [draft-ietf-acme-dns-persist-01](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/) for dns-persist-01 challenges (experimental) * Easy to use Java API * Requires JRE 17 or higher * Supports [Actalis](https://www.actalis.com/), [Google Trust Services](https://pki.goog/), [Let's Encrypt](https://letsencrypt.org/), [SSL.com](https://www.ssl.com/), [ZeroSSL](https://zerossl.com/), and **all other CAs that comply with the ACME protocol (RFC 8555)**. Note that _acme4j_ is an independent project that is not supported or endorsed by any of the CAs. * Built with maven, packages available at [Maven Central](http://search.maven.org/#search|ga|1|g%3A%22org.shredzone.acme4j%22) * Extensive unit and integration tests * Adheres to [Semantic Versioning](https://semver.org/) ## Dependencies * [Bouncy Castle](https://www.bouncycastle.org/) * [jose4j](https://bitbucket.org/b_c/jose4j/wiki/Home) * [slf4j](http://www.slf4j.org/) * For `acme4j-smime`: [Jakarta Mail](https://eclipse-ee4j.github.io/mail/), [Bouncy Castle](https://www.bouncycastle.org/) ## Usage * See the [online documentation](https://shredzone.org/maven/acme4j/) about how to use _acme4j_. * For a quick start, take a look at [the source code of an example](https://shredzone.org/maven/acme4j/example.html). ## Announcements Follow our Mastodon feed for release notes and other acme4j related news. * Mastodon: `@acme4j@foojay.social` * RSS: https://foojay.social/@acme4j.rss ## Contribute * Fork the [Source code at Codeberg](https://codeberg.org/shred/acme4j) or [GitHub](https://github.com/shred/acme4j). Feel free to send pull requests (see [Contributing](CONTRIBUTING.md) for the rules). * Found a bug? [File a bug report!](https://codeberg.org/shred/acme4j/issues) ([GitHub](https://github.com/shred/acme4j/issues)) ## License _acme4j_ is open source software. The source code is distributed under the terms of [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). ## Acknowledgements * I would like to thank Brian Campbell and all the other [jose4j](https://bitbucket.org/b_c/jose4j/wiki/Home) developers. _acme4j_ would not exist without your excellent work. * Thanks to [Daniel McCarney](https://github.com/cpu) for his help with the ACME protocol, Pebble, and Boulder. * [Ulrich Krause](https://github.com/eknori) for his help to make _acme4j_ run on IBM Java VMs. * I also like to thank [everyone who contributed to _acme4j_](https://codeberg.org/shred/acme4j/activity/contributors). * The Mastodon account is hosted by [foojay.io](https://foojay.io). ================================================ FILE: acme4j-client/pom.xml ================================================ 4.0.0 org.shredzone.acme4j acme4j 5.1.1-SNAPSHOT acme4j-client acme4j Client ACME client for Java src/main/resources src/main/resources-filtered true org.apache.maven.plugins maven-surefire-plugin false org.bitbucket.b_c jose4j ${jose4j.version} org.bouncycastle bcprov-jdk18on ${bouncycastle.version} org.bouncycastle bcpkix-jdk18on ${bouncycastle.version} org.slf4j slf4j-api ${slf4j.version} org.slf4j slf4j-simple ${slf4j.version} test org.bouncycastle bcpg-jdk18on ${bouncycastle.version} test ================================================ FILE: acme4j-client/src/main/java/.gitignore ================================================ ================================================ FILE: acme4j-client/src/main/java/module-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This is the main module of the acme4j client. */ module org.shredzone.acme4j { requires static com.github.spotbugs.annotations; requires java.net.http; requires org.bouncycastle.pkix; requires org.bouncycastle.provider; requires org.jose4j; requires org.slf4j; exports org.shredzone.acme4j; exports org.shredzone.acme4j.challenge; exports org.shredzone.acme4j.connector; exports org.shredzone.acme4j.exception; exports org.shredzone.acme4j.provider; exports org.shredzone.acme4j.toolbox; exports org.shredzone.acme4j.util; uses org.shredzone.acme4j.provider.AcmeProvider; uses org.shredzone.acme4j.provider.ChallengeProvider; provides org.shredzone.acme4j.provider.AcmeProvider with org.shredzone.acme4j.provider.GenericAcmeProvider, org.shredzone.acme4j.provider.actalis.ActalisAcmeProvider, org.shredzone.acme4j.provider.google.GoogleAcmeProvider, org.shredzone.acme4j.provider.letsencrypt.LetsEncryptAcmeProvider, org.shredzone.acme4j.provider.pebble.PebbleAcmeProvider, org.shredzone.acme4j.provider.sslcom.SslComAcmeProvider, org.shredzone.acme4j.provider.zerossl.ZeroSSLAcmeProvider; } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Account.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.io.Serial; import java.net.URI; import java.net.URL; import java.security.KeyPair; import java.util.ArrayList; import java.util.Arrays; import java.util.Iterator; import java.util.List; import java.util.Objects; import java.util.Optional; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.connector.ResourceIterator; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.exception.AcmeServerException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON.Value; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.JoseUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * A representation of an account at the ACME server. */ public class Account extends AcmeJsonResource { @Serial private static final long serialVersionUID = 7042863483428051319L; private static final Logger LOG = LoggerFactory.getLogger(Account.class); private static final String KEY_TOS_AGREED = "termsOfServiceAgreed"; private static final String KEY_ORDERS = "orders"; private static final String KEY_CONTACT = "contact"; private static final String KEY_STATUS = "status"; private static final String KEY_EXTERNAL_ACCOUNT_BINDING = "externalAccountBinding"; protected Account(Login login, URL location) { super(login, location); } /** * Returns if the user agreed to the terms of service. * * @return {@code true} if the user agreed to the terms of service. May be * empty if the server did not provide such an information. */ public Optional getTermsOfServiceAgreed() { return getJSON().get(KEY_TOS_AGREED).map(Value::asBoolean); } /** * List of registered contact addresses (emails, phone numbers etc). *

* This list is unmodifiable. Use {@link #modify()} to change the contacts. May be * empty, but is never {@code null}. */ public List getContacts() { return getJSON().get(KEY_CONTACT) .asArray() .stream() .map(Value::asURI) .toList(); } /** * Returns the current status of the account. *

* Possible values are: {@link Status#VALID}, {@link Status#DEACTIVATED}, * {@link Status#REVOKED}. */ public Status getStatus() { return getJSON().get(KEY_STATUS).asStatus(); } /** * Returns {@code true} if the account is bound to an external non-ACME account. * * @since 2.8 */ public boolean hasExternalAccountBinding() { return getJSON().contains(KEY_EXTERNAL_ACCOUNT_BINDING); } /** * Returns the key identifier of the external non-ACME account. If this account is * not bound to an external account, the result is empty. * * @since 2.8 */ public Optional getKeyIdentifier() { return getJSON().get(KEY_EXTERNAL_ACCOUNT_BINDING) .optional().map(Value::asObject) .map(j -> j.get("protected")).map(Value::asEncodedObject) .map(j -> j.get("kid")).map(Value::asString); } /** * Returns an {@link Iterator} of all {@link Order} belonging to this * {@link Account}. *

* Using the iterator will initiate one or more requests to the ACME server. * * @return {@link Iterator} instance that returns {@link Order} objects in no specific * sorting order. {@link Iterator#hasNext()} and {@link Iterator#next()} may throw * {@link AcmeProtocolException} if a batch of authorization URIs could not be fetched * from the server. */ public Iterator getOrders() { var ordersUrl = getJSON().get(KEY_ORDERS).optional().map(Value::asURL); if (ordersUrl.isEmpty()) { // Let's Encrypt does not provide this field at the moment, although it's required. // See https://github.com/letsencrypt/boulder/issues/3335 throw new AcmeNotSupportedException("getOrders()"); } return new ResourceIterator<>(getLogin(), KEY_ORDERS, ordersUrl.get(), Login::bindOrder); } /** * Creates a builder for a new {@link Order}. * * @return {@link OrderBuilder} object */ public OrderBuilder newOrder() { return getLogin().newOrder(); } /** * Pre-authorizes a domain. The CA will check if it accepts the domain for * certification, and returns the necessary challenges. *

* Some servers may not allow pre-authorization. *

* It is not possible to pre-authorize wildcard domains. * * @param domain * Domain name to be pre-authorized. IDN names are accepted and will be ACE * encoded automatically. * @return {@link Authorization} object for this domain * @throws AcmeException * if the server does not allow pre-authorization * @throws AcmeServerException * if the server allows pre-authorization, but will refuse to issue a * certificate for this domain */ public Authorization preAuthorizeDomain(String domain) throws AcmeException { Objects.requireNonNull(domain, "domain"); if (domain.isEmpty()) { throw new IllegalArgumentException("domain must not be empty"); } return preAuthorize(Identifier.dns(domain)); } /** * Pre-authorizes an {@link Identifier}. The CA will check if it accepts the * identifier for certification, and returns the necessary challenges. *

* Some servers may not allow pre-authorization. *

* It is not possible to pre-authorize wildcard domains. * * @param identifier * {@link Identifier} to be pre-authorized. * @return {@link Authorization} object for this identifier * @throws AcmeException * if the server does not allow pre-authorization * @throws AcmeServerException * if the server allows pre-authorization, but will refuse to issue a * certificate for this identifier * @since 2.3 */ public Authorization preAuthorize(Identifier identifier) throws AcmeException { Objects.requireNonNull(identifier, "identifier"); var newAuthzUrl = getSession().resourceUrl(Resource.NEW_AUTHZ); if (identifier.toMap().containsKey(Identifier.KEY_SUBDOMAIN_AUTH_ALLOWED) && !getSession().getMetadata().isSubdomainAuthAllowed()) { throw new AcmeNotSupportedException("subdomain-auth"); } LOG.debug("preAuthorize {}", identifier); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); claims.put("identifier", identifier.toMap()); conn.sendSignedRequest(newAuthzUrl, claims, getLogin()); var auth = getLogin().bindAuthorization(conn.getLocation()); auth.setJSON(conn.readJsonResponse()); return auth; } } /** * Changes the {@link KeyPair} associated with the account. *

* After a successful call, the new key pair is already set in the associated * {@link Login}. The old key pair can be discarded. * * @param newKeyPair * new {@link KeyPair} to be used for identifying this account */ public void changeKey(KeyPair newKeyPair) throws AcmeException { Objects.requireNonNull(newKeyPair, "newKeyPair"); if (Arrays.equals(getLogin().getPublicKey().getEncoded(), newKeyPair.getPublic().getEncoded())) { throw new IllegalArgumentException("newKeyPair must actually be a new key pair"); } LOG.debug("key-change"); try (var conn = getSession().connect()) { var keyChangeUrl = getSession().resourceUrl(Resource.KEY_CHANGE); var payloadClaim = new JSONBuilder(); payloadClaim.put("account", getLocation()); payloadClaim.putKey("oldKey", getLogin().getPublicKey()); var jose = JoseUtils.createJoseRequest(keyChangeUrl, newKeyPair, payloadClaim, null, null); conn.sendSignedRequest(keyChangeUrl, jose, getLogin()); getLogin().setKeyPair(newKeyPair); } } /** * Permanently deactivates an account. Related certificates may still be valid after * account deactivation, and need to be revoked separately if neccessary. *

* A deactivated account cannot be reactivated! */ public void deactivate() throws AcmeException { LOG.debug("deactivate"); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); claims.put(KEY_STATUS, "deactivated"); conn.sendSignedRequest(getLocation(), claims, getLogin()); setJSON(conn.readJsonResponse()); } } /** * Modifies the account data of the account. * * @return {@link EditableAccount} where the account can be modified */ public EditableAccount modify() { return new EditableAccount(); } /** * Provides editable properties of an {@link Account}. */ public class EditableAccount { private final List editContacts = new ArrayList<>(); private EditableAccount() { editContacts.addAll(Account.this.getContacts()); } /** * Returns the list of all contact URIs for modification. Use the {@link List} * methods to modify the contact list. *

* The modified list is not validated. If you change entries, you have to make * sure that they are valid according to the RFC. It is recommended to use * the {@code addContact()} methods below to add new contacts to the list. */ @SuppressFBWarnings("EI_EXPOSE_REP") // behavior is intended public List getContacts() { return editContacts; } /** * Adds a new Contact to the account. * * @param contact * Contact URI * @return itself */ public EditableAccount addContact(URI contact) { AcmeUtils.validateContact(contact); editContacts.add(contact); return this; } /** * Adds a new Contact to the account. *

* This is a convenience call for {@link #addContact(URI)}. * * @param contact * Contact URI as string * @return itself */ public EditableAccount addContact(String contact) { addContact(URI.create(contact)); return this; } /** * Adds a new Contact email to the account. *

* This is a convenience call for {@link #addContact(String)} that doesn't * require to prepend the email address with the "mailto" scheme. * * @param email * Contact email without "mailto" scheme (e.g. test@gmail.com) * @return itself */ public EditableAccount addEmail(String email) { addContact("mailto:" + email); return this; } /** * Commits the changes and updates the account. */ public void commit() throws AcmeException { LOG.debug("modify/commit"); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); if (!editContacts.isEmpty()) { claims.put(KEY_CONTACT, editContacts); } conn.sendSignedRequest(getLocation(), claims, getLogin()); setJSON(conn.readJsonResponse()); } } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/AccountBuilder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Objects.requireNonNull; import static org.jose4j.jws.AlgorithmIdentifiers.*; import static org.shredzone.acme4j.toolbox.JoseUtils.macKeyAlgorithm; import java.net.URI; import java.security.KeyPair; import java.util.ArrayList; import java.util.List; import java.util.Optional; import java.util.Set; import javax.crypto.SecretKey; import javax.crypto.spec.SecretKeySpec; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.JoseUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * A builder for registering a new account with the CA. *

* You need to create a new key pair and set it via {@link #useKeyPair(KeyPair)}. Your * account will be identified by the public part of that key pair, so make sure to store * it safely! There is no automatic way to regain access to your account if the key pair * is lost. *

* Depending on the CA you register with, you might need to give additional information. *

*

* It is not possible to modify an existing account with the {@link AccountBuilder}. To * modify an existing account, use {@link Account#modify()} and * {@link Account#changeKey(KeyPair)}. */ public class AccountBuilder { private static final Logger LOG = LoggerFactory.getLogger(AccountBuilder.class); private static final Set VALID_ALGORITHMS = Set.of(HMAC_SHA256, HMAC_SHA384, HMAC_SHA512); private final List contacts = new ArrayList<>(); private @Nullable Boolean termsOfServiceAgreed; private @Nullable Boolean onlyExisting; private @Nullable String keyIdentifier; private @Nullable KeyPair keyPair; private @Nullable SecretKey macKey; private @Nullable String macAlgorithm; /** * Add a contact URI to the list of contacts. *

* A contact URI may be e.g. an email address or a phone number. It depends on the CA * what kind of contact URIs are accepted, and how many must be provided as minimum. * * @param contact * Contact URI * @return itself */ public AccountBuilder addContact(URI contact) { AcmeUtils.validateContact(contact); contacts.add(contact); return this; } /** * Add a contact address to the list of contacts. *

* This is a convenience call for {@link #addContact(URI)}. * * @param contact * Contact URI as string * @return itself * @throws IllegalArgumentException * if there is a syntax error in the URI string */ public AccountBuilder addContact(String contact) { addContact(URI.create(contact)); return this; } /** * Add an email address to the list of contacts. *

* This is a convenience call for {@link #addContact(String)} that doesn't require * to prepend the "mailto" scheme to an email address. * * @param email * Contact email without "mailto" scheme (e.g. test@gmail.com) * @return itself * @throws IllegalArgumentException * if there is a syntax error in the URI string */ public AccountBuilder addEmail(String email) { if (email.startsWith("mailto:")) { addContact(email); } else { addContact("mailto:" + email); } return this; } /** * Documents that the user has agreed to the terms of service. *

* If the CA requires the user to agree to the terms of service, it is your * responsibility to present them to the user, and actively ask for their agreement. A * link to the terms of service is provided via * {@code session.getMetadata().getTermsOfService()}. * * @return itself */ public AccountBuilder agreeToTermsOfService() { this.termsOfServiceAgreed = true; return this; } /** * Signals that only an existing account should be returned. The server will not * create a new account if the key is not known. *

* If you have lost your account's location URL, but still have your account's key * pair, you can register your account again with the same key, and use * {@link #onlyExisting()} to make sure that your existing account is returned. If * your key is unknown to the server, an error is thrown once the account is to be * created. * * @return itself */ public AccountBuilder onlyExisting() { this.onlyExisting = true; return this; } /** * Sets the {@link KeyPair} to be used for this account. *

* Only the public key of the pair is sent to the server for registration. acme4j will * never send the private key part. *

* Make sure to store your key pair safely after registration! There is no automatic * way to regain access to your account if the key pair is lost. * * @param keyPair * Account's {@link KeyPair} * @return itself */ public AccountBuilder useKeyPair(KeyPair keyPair) { this.keyPair = requireNonNull(keyPair, "keyPair"); return this; } /** * Sets a Key Identifier and MAC key provided by the CA. Use this if your CA requires * an individual account identification (e.g. your customer number) and a shared * secret for registration. See the documentation of your CA about how to retrieve the * key identifier and MAC key. * * @param kid * Key Identifier * @param macKey * MAC key * @return itself * @see #withKeyIdentifier(String, String) */ public AccountBuilder withKeyIdentifier(String kid, SecretKey macKey) { if (kid != null && kid.isEmpty()) { throw new IllegalArgumentException("kid must not be empty"); } this.macKey = requireNonNull(macKey, "macKey"); this.keyIdentifier = kid; return this; } /** * Sets a Key Identifier and MAC key provided by the CA. Use this if your CA requires * an individual account identification (e.g. your customer number) and a shared * secret for registration. See the documentation of your CA about how to retrieve the * key identifier and MAC key. *

* This is a convenience call of {@link #withKeyIdentifier(String, SecretKey)} that * accepts a base64url encoded MAC key, so both parameters can be passed in as * strings. * * @param kid * Key Identifier * @param encodedMacKey * Base64url encoded MAC key. * @return itself * @see #withKeyIdentifier(String, SecretKey) */ public AccountBuilder withKeyIdentifier(String kid, String encodedMacKey) { var encodedKey = AcmeUtils.base64UrlDecode(requireNonNull(encodedMacKey, "encodedMacKey")); return withKeyIdentifier(kid, new SecretKeySpec(encodedKey, "HMAC")); } /** * Sets the MAC key algorithm that is provided by the CA. To be used in combination * with key identifier. By default, the algorithm is deduced from the size of the * MAC key. If a different size is needed, it can be set using this method. * * @param macAlgorithm * the algorithm to be set in the {@code alg} field, e.g. {@code "HS512"}. * @return itself * @since 3.1.0 */ public AccountBuilder withMacAlgorithm(String macAlgorithm) { var algorithm = requireNonNull(macAlgorithm, "macAlgorithm"); if (!VALID_ALGORITHMS.contains(algorithm)) { throw new IllegalArgumentException("Invalid MAC algorithm: " + macAlgorithm); } this.macAlgorithm = algorithm; return this; } /** * Creates a new account. *

* Use this method to finally create your account with the given parameters. Do not * use the {@link AccountBuilder} after invoking this method. * * @param session * {@link Session} to be used for registration * @return {@link Account} referring to the new account * @see #createLogin(Session) */ public Account create(Session session) throws AcmeException { return createLogin(session).getAccount(); } /** * Creates a new account. *

* This method is identical to {@link #create(Session)}, but returns a {@link Login} * that is ready to be used. * * @param session * {@link Session} to be used for registration * @return {@link Login} referring to the new account */ public Login createLogin(Session session) throws AcmeException { requireNonNull(session, "session"); if (keyPair == null) { throw new IllegalStateException("Use AccountBuilder.useKeyPair() to set the account's key pair."); } LOG.debug("create"); try (var conn = session.connect()) { var resourceUrl = session.resourceUrl(Resource.NEW_ACCOUNT); var claims = new JSONBuilder(); if (!contacts.isEmpty()) { claims.put("contact", contacts); } if (termsOfServiceAgreed != null) { claims.put("termsOfServiceAgreed", termsOfServiceAgreed); } if (keyIdentifier != null && macKey != null) { var algorithm = Optional.ofNullable(macAlgorithm) .or(session.provider()::getProposedEabMacAlgorithm) .orElseGet(() -> macKeyAlgorithm(macKey)); claims.put("externalAccountBinding", JoseUtils.createExternalAccountBinding( keyIdentifier, keyPair.getPublic(), macKey, algorithm, resourceUrl)); } if (onlyExisting != null) { claims.put("onlyReturnExisting", onlyExisting); } conn.sendSignedRequest(resourceUrl, claims, session, (url, payload, nonce) -> JoseUtils.createJoseRequest(url, keyPair, payload, nonce, null)); var login = new Login(conn.getLocation(), keyPair, session); login.getAccount().setJSON(conn.readJsonResponse()); return login; } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/AcmeJsonResource.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.io.Serial; import java.net.URL; import java.time.Instant; import java.util.Objects; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeLazyLoadingException; import org.shredzone.acme4j.toolbox.JSON; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * An extension of {@link AcmeResource} that also contains the current state of a resource * as JSON document. If the current state is not present, this class takes care of * fetching it from the server if necessary. */ public abstract class AcmeJsonResource extends AcmeResource { @Serial private static final long serialVersionUID = -5060364275766082345L; private static final Logger LOG = LoggerFactory.getLogger(AcmeJsonResource.class); private @Nullable JSON data = null; private @Nullable Instant retryAfter = null; /** * Create a new {@link AcmeJsonResource}. * * @param login * {@link Login} the resource is bound with * @param location * Location {@link URL} of this resource */ protected AcmeJsonResource(Login login, URL location) { super(login, location); } /** * Returns the JSON representation of the resource data. *

* If there is no data, {@link #fetch()} is invoked to fetch it from the server. *

* This method can be used to read proprietary data from the resources. * * @return Resource data, as {@link JSON}. * @throws AcmeLazyLoadingException * if an {@link AcmeException} occured while fetching the current state from * the server. */ public JSON getJSON() { if (data == null) { try { fetch(); } catch (AcmeException ex) { throw new AcmeLazyLoadingException(this, ex); } } return Objects.requireNonNull(data); } /** * Sets the JSON representation of the resource data. * * @param data * New {@link JSON} data, must not be {@code null}. */ protected void setJSON(JSON data) { invalidate(); this.data = Objects.requireNonNull(data, "data"); } /** * Checks if this resource is valid. * * @return {@code true} if the resource state has been loaded from the server. If * {@code false}, {@link #getJSON()} would implicitly call {@link #fetch()} * to fetch the current state from the server. */ protected boolean isValid() { return data != null; } /** * Invalidates the state of this resource. Enforces a {@link #fetch()} when * {@link #getJSON()} is invoked. *

* Subclasses can override this method to purge internal caches that are based on the * JSON structure. Remember to invoke {@code super.invalidate()}! */ protected void invalidate() { data = null; retryAfter = null; } /** * Updates this resource, by fetching the current resource data from the server. * * @return An {@link Optional} estimation when the resource status will change. If you * are polling for the resource to complete, you should wait for the given instant * before trying again. Empty if the server did not return a "Retry-After" header. * @throws AcmeException * if the resource could not be fetched. * @since 3.2.0 */ public Optional fetch() throws AcmeException { var resourceType = getClass().getSimpleName(); LOG.debug("update {}", resourceType); try (var conn = getSession().connect()) { conn.sendSignedPostAsGetRequest(getLocation(), getLogin()); setJSON(conn.readJsonResponse()); var retryAfterOpt = conn.getRetryAfter(); retryAfterOpt.ifPresent(instant -> LOG.debug("Retry-After: {}", instant)); setRetryAfter(retryAfterOpt.orElse(null)); return retryAfterOpt; } } /** * Sets a Retry-After instant. * * @since 3.2.0 */ protected void setRetryAfter(@Nullable Instant retryAfter) { this.retryAfter = retryAfter; } /** * Gets an estimation when the resource status will change. If you are polling for * the resource to complete, you should wait for the given instant before trying * a status refresh. *

* This instant was sent with the Retry-After header at the last update. * * @return Retry-after {@link Instant}, or empty if there was no such header. * @since 3.2.0 */ public Optional getRetryAfter() { return Optional.ofNullable(retryAfter); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/AcmeResource.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.io.Serial; import java.io.Serializable; import java.net.URL; import java.util.Objects; import edu.umd.cs.findbugs.annotations.Nullable; /** * This is the root class of all ACME resources (like accounts, orders, certificates). * Every resource is identified by its location URL. *

* This class also takes care for proper serialization and de-serialization of the * resource. After de-serialization, the resource must be bound to a {@link Login} again, * using {@link #rebind(Login)}. */ public abstract class AcmeResource implements Serializable { @Serial private static final long serialVersionUID = -7930580802257379731L; private transient @Nullable Login login; private final URL location; /** * Create a new {@link AcmeResource}. * * @param login * {@link Login} the resource is bound with * @param location * Location {@link URL} of this resource */ protected AcmeResource(Login login, URL location) { this.location = Objects.requireNonNull(location, "location"); rebind(login); } /** * Gets the {@link Login} this resource is bound with. */ protected Login getLogin() { if (login == null) { throw new IllegalStateException("Use rebind() for binding this object to a login."); } return login; } /** * Gets the {@link Session} this resource is bound with. */ protected Session getSession() { return getLogin().getSession(); } /** * Rebinds this resource to a {@link Login}. *

* Logins are not serialized, because they contain volatile session data and also a * private key. After de-serialization of an {@link AcmeResource}, use this method to * rebind it to a {@link Login}. * * @param login * {@link Login} to bind this resource to */ public void rebind(Login login) { if (this.login != null) { throw new IllegalStateException("Resource is already bound to a login"); } this.login = Objects.requireNonNull(login, "login"); } /** * Gets the resource's location. */ public URL getLocation() { return location; } @Override protected final void finalize() { // CT_CONSTRUCTOR_THROW: Prevents finalizer attack } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Authorization.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.stream.Collectors.toUnmodifiableList; import java.io.Serial; import java.net.URL; import java.time.Duration; import java.time.Instant; import java.util.EnumSet; import java.util.List; import java.util.Optional; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON.Value; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * Represents an authorization request at the ACME server. */ public class Authorization extends AcmeJsonResource implements PollableResource { @Serial private static final long serialVersionUID = -3116928998379417741L; private static final Logger LOG = LoggerFactory.getLogger(Authorization.class); protected Authorization(Login login, URL location) { super(login, location); } /** * Gets the {@link Identifier} to be authorized. *

* For wildcard domain orders, the domain itself (without wildcard prefix) is returned * here. To find out if this {@link Authorization} is related to a wildcard domain * order, check the {@link #isWildcard()} method. * * @since 2.3 */ public Identifier getIdentifier() { return getJSON().get("identifier").asIdentifier(); } /** * Gets the authorization status. *

* Possible values are: {@link Status#PENDING}, {@link Status#VALID}, * {@link Status#INVALID}, {@link Status#DEACTIVATED}, {@link Status#EXPIRED}, * {@link Status#REVOKED}. */ @Override public Status getStatus() { return getJSON().get("status").asStatus(); } /** * Gets the expiry date of the authorization, if set by the server. */ public Optional getExpires() { return getJSON().get("expires") .map(Value::asString) .map(AcmeUtils::parseTimestamp); } /** * Returns {@code true} if this {@link Authorization} is related to a wildcard domain, * {@code false} otherwise. */ public boolean isWildcard() { return getJSON().get("wildcard") .map(Value::asBoolean) .orElse(false); } /** * Returns {@code true} if certificates for subdomains can be issued according to * RFC9444. * * @since 3.3.0 */ public boolean isSubdomainAuthAllowed() { return getJSON().get("subdomainAuthAllowed") .map(Value::asBoolean) .orElse(false); } /** * Gets a list of all challenges offered by the server, in no specific order. */ public List getChallenges() { var login = getLogin(); return getJSON().get("challenges") .asArray() .stream() .map(Value::asObject) .map(login::createChallenge) .collect(toUnmodifiableList()); } /** * Finds a {@link Challenge} of the given type. Responding to this {@link Challenge} * is sufficient for authorization. *

* {@link Authorization#findChallenge(Class)} should be preferred, as this variant * is not type safe. * * @param type * Challenge name (e.g. "http-01") * @return {@link Challenge} matching that name, or empty if there is no such * challenge, or if the challenge alone is not sufficient for authorization. * @throws ClassCastException * if the type does not match the expected Challenge class type */ @SuppressWarnings("unchecked") public Optional findChallenge(final String type) { return (Optional) getChallenges().stream() .filter(ch -> type.equals(ch.getType())) .reduce((a, b) -> { throw new AcmeProtocolException("Found more than one challenge of type " + type); }); } /** * Finds a {@link Challenge} of the given class type. Responding to this {@link * Challenge} is sufficient for authorization. * * @param type * Challenge type (e.g. "Http01Challenge.class") * @return {@link Challenge} of that type, or empty if there is no such * challenge, or if the challenge alone is not sufficient for authorization. * @since 2.8 */ public Optional findChallenge(Class type) { return getChallenges().stream() .filter(type::isInstance) .map(type::cast) .reduce((a, b) -> { throw new AcmeProtocolException("Found more than one challenge of type " + type.getName()); }); } /** * Waits until the authorization is completed. *

* It is completed if it reaches either {@link Status#VALID} or * {@link Status#INVALID}. *

* This method is synchronous and blocks the current thread. * * @param timeout * Timeout until a terminal status must have been reached * @return Status that was reached * @since 3.4.0 */ public Status waitForCompletion(Duration timeout) throws AcmeException, InterruptedException { return waitForStatus(EnumSet.of(Status.VALID, Status.INVALID), timeout); } /** * Permanently deactivates the {@link Authorization}. */ public void deactivate() throws AcmeException { LOG.debug("deactivate"); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); claims.put("status", "deactivated"); conn.sendSignedRequest(getLocation(), claims, getLogin()); setJSON(conn.readJsonResponse()); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Certificate.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Collections.unmodifiableList; import static java.util.Objects.requireNonNull; import static java.util.stream.Collectors.toList; import static java.util.stream.Collectors.toUnmodifiableList; import static org.shredzone.acme4j.toolbox.AcmeUtils.getRenewalUniqueIdentifier; import java.io.IOException; import java.io.Serial; import java.io.Writer; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.security.KeyPair; import java.security.Principal; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; import java.util.Collection; import java.util.List; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeLazyLoadingException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.JoseUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * Represents an issued certificate and its certificate chain. *

* A certificate is immutable once it is issued. For renewal, a new certificate must be * ordered. */ public class Certificate extends AcmeResource { @Serial private static final long serialVersionUID = 7381527770159084201L; private static final Logger LOG = LoggerFactory.getLogger(Certificate.class); private @Nullable List certChain; private @Nullable Collection alternates; private transient @Nullable RenewalInfo renewalInfo = null; private transient @Nullable List alternateCerts = null; protected Certificate(Login login, URL certUrl) { super(login, certUrl); } /** * Downloads the certificate chain. *

* The certificate is downloaded lazily by the other methods. Usually there is no need * to invoke this method, unless the download is to be enforced. If the certificate * has been downloaded already, nothing will happen. * * @throws AcmeException * if the certificate could not be downloaded */ public void download() throws AcmeException { if (certChain == null) { LOG.debug("download"); try (var conn = getSession().connect()) { conn.sendCertificateRequest(getLocation(), getLogin()); alternates = conn.getLinks("alternate"); certChain = conn.readCertificates(); } } } /** * Returns the created certificate. * * @return The created end-entity {@link X509Certificate} without issuer chain. */ public X509Certificate getCertificate() { lazyDownload(); return requireNonNull(certChain).get(0); } /** * Returns the created certificate and issuer chain. * * @return The created end-entity {@link X509Certificate} and issuer chain. The first * certificate is always the end-entity certificate, followed by the * intermediate certificates required to build a path to a trusted root. */ public List getCertificateChain() { lazyDownload(); return unmodifiableList(requireNonNull(certChain)); } /** * Returns URLs to alternate certificate chains. * * @return Alternate certificate chains, or empty if there are none. */ public List getAlternates() { lazyDownload(); return requireNonNull(alternates).stream().collect(toUnmodifiableList()); } /** * Returns alternate certificate chains, if available. * * @return Alternate certificate chains, or empty if there are none. * @since 2.11 */ public List getAlternateCertificates() { if (alternateCerts == null) { var login = getLogin(); alternateCerts = getAlternates().stream() .map(login::bindCertificate) .collect(toList()); } return unmodifiableList(alternateCerts); } /** * Checks if this certificate was issued by the given issuer name. * * @param issuer * Issuer name to check against, case-sensitive * @return {@code true} if this issuer name was found in the certificate chain as * issuer, {@code false} otherwise. * @since 3.0.0 */ public boolean isIssuedBy(String issuer) { var issuerCn = "CN=" + issuer; return getCertificateChain().stream() .map(X509Certificate::getIssuerX500Principal) .map(Principal::getName) .anyMatch(issuerCn::equals); } /** * Finds a {@link Certificate} that was issued by the given issuer name. * * @param issuer * Issuer name to check against, case-sensitive * @return Certificate that was issued by that issuer, or {@code empty} if there was * none. The returned {@link Certificate} may be this instance, or one of the * {@link #getAlternateCertificates()} instances. If multiple certificates are issued * by that issuer, the first one that was found is returned. * @since 3.0.0 */ public Optional findCertificate(String issuer) { if (isIssuedBy(issuer)) { return Optional.of(this); } return getAlternateCertificates().stream() .filter(c -> c.isIssuedBy(issuer)) .findFirst(); } /** * Writes the certificate to the given writer. It is written in PEM format, with the * end-entity cert coming first, followed by the intermediate certificates. * * @param out * {@link Writer} to write to. The writer is not closed after use. */ public void writeCertificate(Writer out) throws IOException { try { for (var cert : getCertificateChain()) { AcmeUtils.writeToPem(cert.getEncoded(), AcmeUtils.PemLabel.CERTIFICATE, out); } } catch (CertificateEncodingException ex) { throw new IOException("Encoding error", ex); } } /** * Returns the location of the certificate's RenewalInfo. Empty if the CA does not * provide this information. * * @since 3.0.0 */ public Optional getRenewalInfoLocation() { try { return getSession().resourceUrlOptional(Resource.RENEWAL_INFO) .map(baseUrl -> { try { var url = baseUrl.toExternalForm(); if (!url.endsWith("/")) { url += '/'; } url += getRenewalUniqueIdentifier(getCertificate()); return URI.create(url).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException("Invalid RenewalInfo URL", ex); } }); } catch (AcmeException ex) { throw new AcmeLazyLoadingException(this, ex); } } /** * Returns {@code true} if the CA provides renewal information. * * @since 3.0.0 */ public boolean hasRenewalInfo() { return getRenewalInfoLocation().isPresent(); } /** * Reads the RenewalInfo for this certificate. * * @return The {@link RenewalInfo} of this certificate. * @throws AcmeNotSupportedException if the CA does not support renewal information. * @since 3.0.0 */ @SuppressFBWarnings("EI_EXPOSE_REP") // behavior is intended public RenewalInfo getRenewalInfo() { if (renewalInfo == null) { renewalInfo = getRenewalInfoLocation() .map(getLogin()::bindRenewalInfo) .orElseThrow(() -> new AcmeNotSupportedException("renewal-info")); } return renewalInfo; } /** * Revokes this certificate. */ public void revoke() throws AcmeException { revoke(null); } /** * Revokes this certificate. * * @param reason * {@link RevocationReason} stating the reason of the revocation that is * used when generating OCSP responses and CRLs. {@code null} to give no * reason. * @see #revoke(Login, X509Certificate, RevocationReason) * @see #revoke(Session, KeyPair, X509Certificate, RevocationReason) */ public void revoke(@Nullable RevocationReason reason) throws AcmeException { revoke(getLogin(), getCertificate(), reason); } /** * Revoke a certificate. *

* Use this method if the certificate's location is unknown, so you cannot regenerate * a {@link Certificate} instance. This method requires a {@link Login} to your * account and the issued certificate. * * @param login * {@link Login} to the account * @param cert * The {@link X509Certificate} to be revoked * @param reason * {@link RevocationReason} stating the reason of the revocation that is used * when generating OCSP responses and CRLs. {@code null} to give no reason. * @see #revoke(Session, KeyPair, X509Certificate, RevocationReason) * @since 2.6 */ public static void revoke(Login login, X509Certificate cert, @Nullable RevocationReason reason) throws AcmeException { LOG.debug("revoke"); var session = login.getSession(); var resUrl = session.resourceUrl(Resource.REVOKE_CERT); try (var conn = session.connect()) { var claims = new JSONBuilder(); claims.putBase64("certificate", cert.getEncoded()); if (reason != null) { claims.put("reason", reason.getReasonCode()); } conn.sendSignedRequest(resUrl, claims, login); } catch (CertificateEncodingException ex) { throw new AcmeProtocolException("Invalid certificate", ex); } } /** * Revoke a certificate. *

* Use this method if the key pair of your account was lost (so you are unable to * login into your account), but you still have the key pair of the affected domain * and the issued certificate. * * @param session * {@link Session} connected to the ACME server * @param domainKeyPair * Key pair the CSR was signed with * @param cert * The {@link X509Certificate} to be revoked * @param reason * {@link RevocationReason} stating the reason of the revocation that is used * when generating OCSP responses and CRLs. {@code null} to give no reason. * @see #revoke(Login, X509Certificate, RevocationReason) */ public static void revoke(Session session, KeyPair domainKeyPair, X509Certificate cert, @Nullable RevocationReason reason) throws AcmeException { LOG.debug("revoke using the domain key pair"); var resUrl = session.resourceUrl(Resource.REVOKE_CERT); try (var conn = session.connect()) { var claims = new JSONBuilder(); claims.putBase64("certificate", cert.getEncoded()); if (reason != null) { claims.put("reason", reason.getReasonCode()); } conn.sendSignedRequest(resUrl, claims, session, (url, payload, nonce) -> JoseUtils.createJoseRequest(url, domainKeyPair, payload, nonce, null)); } catch (CertificateEncodingException ex) { throw new AcmeProtocolException("Invalid certificate", ex); } } /** * Lazily downloads the certificate. Throws a runtime {@link AcmeLazyLoadingException} * if the download failed. */ private void lazyDownload() { try { download(); } catch (AcmeException ex) { throw new AcmeLazyLoadingException(this, ex); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Identifier.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Collections.unmodifiableMap; import static java.util.Objects.requireNonNull; import static org.shredzone.acme4j.toolbox.AcmeUtils.toAce; import java.io.Serial; import java.io.Serializable; import java.net.InetAddress; import java.net.UnknownHostException; import java.util.Map; import java.util.TreeMap; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; /** * Represents an identifier. *

* The ACME protocol only defines the DNS identifier, which identifies a domain name. * acme4j also supports IP identifiers. *

* CAs, and other acme4j modules, may define further, proprietary identifier types. * * @since 2.3 */ public class Identifier implements Serializable { @Serial private static final long serialVersionUID = -7777851842076362412L; /** * Type constant for DNS identifiers. */ public static final String TYPE_DNS = "dns"; /** * Type constant for IP identifiers. * * @see RFC 8738 */ public static final String TYPE_IP = "ip"; static final String KEY_TYPE = "type"; static final String KEY_VALUE = "value"; static final String KEY_ANCESTOR_DOMAIN = "ancestorDomain"; static final String KEY_SUBDOMAIN_AUTH_ALLOWED = "subdomainAuthAllowed"; private final Map content = new TreeMap<>(); /** * Creates a new {@link Identifier}. *

* This is a generic constructor for identifiers. Refer to the documentation of your * CA to find out about the accepted identifier types and values. *

* Note that for DNS identifiers, no ASCII encoding of unicode domain takes place * here. Use {@link #dns(String)} instead. * * @param type * Identifier type * @param value * Identifier value */ public Identifier(String type, String value) { content.put(KEY_TYPE, requireNonNull(type, KEY_TYPE)); content.put(KEY_VALUE, requireNonNull(value, KEY_VALUE)); } /** * Creates a new {@link Identifier} from the given {@link JSON} structure. * * @param json * {@link JSON} containing the identifier data */ public Identifier(JSON json) { if (!json.contains(KEY_TYPE)) { throw new AcmeProtocolException("Required key " + KEY_TYPE + " is missing"); } if (!json.contains(KEY_VALUE)) { throw new AcmeProtocolException("Required key " + KEY_VALUE + " is missing"); } content.putAll(json.toMap()); } /** * Makes a copy of the given Identifier. */ private Identifier(Identifier identifier) { content.putAll(identifier.content); } /** * Creates a new DNS identifier for the given domain name. * * @param domain * Domain name. Unicode domains are automatically ASCII encoded. * @return New {@link Identifier} */ public static Identifier dns(String domain) { return new Identifier(TYPE_DNS, toAce(domain)); } /** * Creates a new IP identifier for the given {@link InetAddress}. * * @param ip * {@link InetAddress} * @return New {@link Identifier} */ public static Identifier ip(InetAddress ip) { return new Identifier(TYPE_IP, ip.getHostAddress()); } /** * Creates a new IP identifier for the given {@link InetAddress}. * * @param ip * IP address as {@link String} * @return New {@link Identifier} * @since 2.7 */ public static Identifier ip(String ip) { try { return ip(InetAddress.getByName(ip)); } catch (UnknownHostException ex) { throw new IllegalArgumentException("Bad IP: " + ip, ex); } } /** * Sets an ancestor domain, as required in RFC-9444. * * @param domain * The ancestor domain to be set. Unicode domains are automatically ASCII * encoded. * @return An {@link Identifier} that contains the ancestor domain. * @since 3.3.0 */ public Identifier withAncestorDomain(String domain) { expectType(TYPE_DNS); var result = new Identifier(this); result.content.put(KEY_ANCESTOR_DOMAIN, toAce(domain)); return result; } /** * Gives the permission to authorize subdomains of this domain, as required in * RFC-9444. * * @return An {@link Identifier} that allows subdomain auths. * @since 3.3.0 */ public Identifier allowSubdomainAuth() { expectType(TYPE_DNS); var result = new Identifier(this); result.content.put(KEY_SUBDOMAIN_AUTH_ALLOWED, true); return result; } /** * Returns the identifier type. */ public String getType() { return content.get(KEY_TYPE).toString(); } /** * Returns the identifier value. */ public String getValue() { return content.get(KEY_VALUE).toString(); } /** * Returns the domain name if this is a DNS identifier. * * @return Domain name. Unicode domains are ASCII encoded. * @throws AcmeProtocolException * if this is not a DNS identifier. */ public String getDomain() { expectType(TYPE_DNS); return getValue(); } /** * Returns the IP address if this is an IP identifier. * * @return {@link InetAddress} * @throws AcmeProtocolException * if this is not a DNS identifier. */ public InetAddress getIP() { expectType(TYPE_IP); try { return InetAddress.getByName(getValue()); } catch (UnknownHostException ex) { throw new AcmeProtocolException("bad ip identifier value", ex); } } /** * Returns the identifier as JSON map. */ public Map toMap() { return unmodifiableMap(content); } /** * Makes sure this identifier is of the given type. * * @param type * Expected type * @throws AcmeProtocolException * if this identifier is of a different type */ private void expectType(String type) { if (!type.equals(getType())) { throw new AcmeProtocolException("expected '" + type + "' identifier, but found '" + getType() + "'"); } } @Override public String toString() { if (content.size() == 2) { return getType() + '=' + getValue(); } return content.toString(); } @Override public boolean equals(Object obj) { if (!(obj instanceof Identifier i)) { return false; } return content.equals(i.content); } @Override public int hashCode() { return content.hashCode(); } @Override protected final void finalize() { // CT_CONSTRUCTOR_THROW: Prevents finalizer attack } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Login.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Objects.requireNonNull; import static org.shredzone.acme4j.toolbox.AcmeUtils.getRenewalUniqueIdentifier; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.security.KeyPair; import java.security.PublicKey; import java.security.cert.X509Certificate; import edu.umd.cs.findbugs.annotations.Nullable; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeLazyLoadingException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.JoseUtils; /** * A {@link Login} into an account. *

* A login is bound to a {@link Session}. However, a {@link Session} can handle multiple * logins in parallel. *

* To create a login, you need to specify the location URI of the {@link Account}, and * need to provide the {@link KeyPair} the account was created with. If the account's * location URL is unknown, the account can be re-registered with the * {@link AccountBuilder}, using {@link AccountBuilder#onlyExisting()} to make sure that * no new account will be created. If the key pair was lost though, there is no automatic * way to regain access to your account, and you have to contact your CA's support hotline * for assistance. *

* Note that {@link Login} objects are intentionally not serializable, as they contain a * keypair and volatile data. On distributed systems, you can create a {@link Login} to * the same account for every service instance. */ public class Login { private final Session session; private final Account account; private KeyPair keyPair; /** * Creates a new {@link Login}. * * @param accountLocation * Account location {@link URL} * @param keyPair * {@link KeyPair} of the account * @param session * {@link Session} to be used */ public Login(URL accountLocation, KeyPair keyPair, Session session) { this.keyPair = requireNonNull(keyPair, "keyPair"); this.session = requireNonNull(session, "session"); this.account = new Account(this, requireNonNull(accountLocation, "accountLocation")); } /** * Gets the {@link Session} that is used. */ @SuppressFBWarnings("EI_EXPOSE_REP") // behavior is intended public Session getSession() { return session; } /** * Gets the {@link PublicKey} of the ACME account. * * @since 5.0.0 */ public PublicKey getPublicKey() { return keyPair.getPublic(); } /** * Gets the {@link Account} that is bound to this login. * * @return {@link Account} bound to the login */ @SuppressFBWarnings("EI_EXPOSE_REP") // behavior is intended public Account getAccount() { return account; } /** * Creates a new instance of an existing {@link Authorization} and binds it to this * login. * * @param location * Location of the Authorization * @return {@link Authorization} bound to the login */ public Authorization bindAuthorization(URL location) { return new Authorization(this, requireNonNull(location, "location")); } /** * Creates a new instance of an existing {@link Certificate} and binds it to this * login. * * @param location * Location of the Certificate * @return {@link Certificate} bound to the login */ public Certificate bindCertificate(URL location) { return new Certificate(this, requireNonNull(location, "location")); } /** * Creates a new instance of an existing {@link Order} and binds it to this login. * * @param location * Location URL of the order * @return {@link Order} bound to the login */ public Order bindOrder(URL location) { return new Order(this, requireNonNull(location, "location")); } /** * Creates a new instance of an existing {@link RenewalInfo} and binds it to this * login. * * @param location * Location URL of the renewal info * @return {@link RenewalInfo} bound to the login * @since 3.0.0 */ public RenewalInfo bindRenewalInfo(URL location) { return new RenewalInfo(this, requireNonNull(location, "location")); } /** * Creates a new instance of an existing {@link RenewalInfo} and binds it to this * login. * * @param certificate * {@link X509Certificate} to get the {@link RenewalInfo} for * @return {@link RenewalInfo} bound to the login * @since 3.2.0 */ public RenewalInfo bindRenewalInfo(X509Certificate certificate) throws AcmeException { try { var url = getSession().resourceUrl(Resource.RENEWAL_INFO).toExternalForm(); if (!url.endsWith("/")) { url += '/'; } url += getRenewalUniqueIdentifier(certificate); return bindRenewalInfo(URI.create(url).toURL()); } catch (MalformedURLException ex) { throw new AcmeProtocolException("Invalid RenewalInfo URL", ex); } } /** * Creates a new instance of an existing {@link Challenge} and binds it to this * login. Use this method only if the resulting challenge type is unknown. * * @param location * Location URL of the challenge * @return {@link Challenge} bound to the login * @since 2.8 * @see #bindChallenge(URL, Class) */ public Challenge bindChallenge(URL location) { try (var connect = session.connect()) { connect.sendSignedPostAsGetRequest(location, this); return createChallenge(connect.readJsonResponse()); } catch (AcmeException ex) { throw new AcmeLazyLoadingException(Challenge.class, location, ex); } } /** * Creates a new instance of an existing {@link Challenge} and binds it to this * login. Use this method if the resulting challenge type is known. * * @param location * Location URL of the challenge * @param type * Expected challenge type * @return Challenge bound to the login * @throws AcmeProtocolException * if the challenge found at the location does not match the expected * challenge type. * @since 2.12 */ public C bindChallenge(URL location, Class type) { var challenge = bindChallenge(location); if (!type.isInstance(challenge)) { throw new AcmeProtocolException("Challenge type " + challenge.getType() + " does not match requested class " + type); } return type.cast(challenge); } /** * Creates a {@link Challenge} instance for the given challenge data. * * @param data * Challenge JSON data * @return {@link Challenge} instance */ public Challenge createChallenge(JSON data) { var challenge = session.provider().createChallenge(this, data); if (challenge == null) { throw new AcmeProtocolException("Could not create challenge for: " + data); } return challenge; } /** * Creates a builder for a new {@link Order}. * * @return {@link OrderBuilder} object * @since 3.0.0 */ public OrderBuilder newOrder() { return new OrderBuilder(this); } /** * Sets a different {@link KeyPair}. The new key pair is only used locally in this * instance, but is not set on server side! */ protected void setKeyPair(KeyPair keyPair) { this.keyPair = requireNonNull(keyPair, "keyPair"); } /** * Creates an ACME JOSE request. This method is meant for internal purposes only. * * @param url * {@link URL} of the ACME call * @param payload * ACME JSON payload. If {@code null}, a POST-as-GET request is generated * instead. * @param nonce * Nonce to be used. {@code null} if no nonce is to be used in the JOSE * header. * @return JSON structure of the JOSE request, ready to be sent. * @since 5.0.0 */ public JSONBuilder createJoseRequest(URL url, @Nullable JSONBuilder payload, @Nullable String nonce) { return JoseUtils.createJoseRequest(url, keyPair, payload, nonce, getAccount().getLocation().toString()); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Metadata.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.stream.Collectors.toList; import java.net.URI; import java.net.URL; import java.time.Duration; import java.util.Collection; import java.util.Optional; import java.util.Set; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSON.Value; /** * A collection of metadata related to the CA provider. */ public class Metadata { private final JSON meta; /** * Creates a new {@link Metadata} instance. * * @param meta * JSON map of metadata */ public Metadata(JSON meta) { this.meta = meta; } /** * Returns an {@link URI} of the current terms of service, or empty if not available. */ public Optional getTermsOfService() { return meta.get("termsOfService").map(Value::asURI); } /** * Returns an {@link URL} of a website providing more information about the ACME * server. Empty if not available. */ public Optional getWebsite() { return meta.get("website").map(Value::asURL); } /** * Returns a collection of hostnames, which the ACME server recognises as referring to * itself for the purposes of CAA record validation. Empty if not available. */ public Collection getCaaIdentities() { return meta.get("caaIdentities") .asArray() .stream() .map(Value::asString) .collect(toList()); } /** * Returns whether an external account is required by this CA. */ public boolean isExternalAccountRequired() { return meta.get("externalAccountRequired").map(Value::asBoolean).orElse(false); } /** * Returns whether the CA supports short-term auto-renewal of certificates. * * @since 2.3 */ public boolean isAutoRenewalEnabled() { return meta.get("auto-renewal").isPresent(); } /** * Returns the minimum acceptable value for the maximum validity of a certificate * before auto-renewal. * * @since 2.3 * @throws AcmeNotSupportedException if the server does not support auto-renewal. */ public Duration getAutoRenewalMinLifetime() { return meta.getFeature("auto-renewal") .map(Value::asObject) .orElseGet(JSON::empty) .get("min-lifetime") .asDuration(); } /** * Returns the maximum delta between auto-renewal end date and auto-renewal start * date. * * @since 2.3 * @throws AcmeNotSupportedException if the server does not support auto-renewal. */ public Duration getAutoRenewalMaxDuration() { return meta.getFeature("auto-renewal") .map(Value::asObject) .orElseGet(JSON::empty) .get("max-duration") .asDuration(); } /** * Returns whether the CA also allows to fetch STAR certificates via GET request. * * @since 2.6 * @throws AcmeNotSupportedException if the server does not support auto-renewal. */ public boolean isAutoRenewalGetAllowed() { return meta.getFeature("auto-renewal").optional() .map(Value::asObject) .orElseGet(JSON::empty) .get("allow-certificate-get") .optional() .map(Value::asBoolean) .orElse(false); } /** * Returns whether the CA supports the profile feature. * * @since 3.5.0 * @draft This method is currently based on RFC draft draft-ietf-acme-profiles. It * may be changed or removed without notice to reflect future changes to the draft. * SemVer rules do not apply here. */ public boolean isProfileAllowed() { return meta.get("profiles").isPresent(); } /** * Returns whether the CA supports the requested profile. *

* Also returns {@code false} if profiles are not allowed in general. * * @since 3.5.0 * @draft This method is currently based on RFC draft draft-ietf-acme-profiles. It * may be changed or removed without notice to reflect future changes to the draft. * SemVer rules do not apply here. */ public boolean isProfileAllowed(String profile) { return getProfiles().contains(profile); } /** * Returns all profiles supported by the CA. May be empty if the CA does not support * profiles. * * @since 3.5.0 * @draft This method is currently based on RFC draft draft-ietf-acme-profiles. It * may be changed or removed without notice to reflect future changes to the draft. * SemVer rules do not apply here. */ public Set getProfiles() { return meta.get("profiles") .optional() .map(Value::asObject) .orElseGet(JSON::empty) .keySet(); } /** * Returns a description of the requested profile. This can be a human-readable string * or a URL linking to a documentation. *

* Empty if the profile is not allowed. * * @since 3.5.0 * @draft This method is currently based on RFC draft draft-ietf-acme-profiles. It * may be changed or removed without notice to reflect future changes to the draft. * SemVer rules do not apply here. */ public Optional getProfileDescription(String profile) { return meta.get("profiles").optional() .map(Value::asObject) .orElseGet(JSON::empty) .get(profile) .optional() .map(Value::asString); } /** * Returns whether the CA supports subdomain auth according to RFC9444. * * @since 3.3.0 */ public boolean isSubdomainAuthAllowed() { return meta.get("subdomainAuthAllowed").map(Value::asBoolean).orElse(false); } /** * Returns the JSON representation of the metadata. This is useful for reading * proprietary metadata properties. */ public JSON getJSON() { return meta; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Order.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Collections.unmodifiableList; import static java.util.stream.Collectors.toList; import java.io.IOException; import java.io.Serial; import java.net.URL; import java.security.KeyPair; import java.time.Duration; import java.time.Instant; import java.util.EnumSet; import java.util.List; import java.util.Optional; import java.util.function.Consumer; import edu.umd.cs.findbugs.annotations.Nullable; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSON.Value; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.util.CSRBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * A representation of a certificate order at the CA. */ public class Order extends AcmeJsonResource implements PollableResource { @Serial private static final long serialVersionUID = 5435808648658292177L; private static final Logger LOG = LoggerFactory.getLogger(Order.class); private transient @Nullable Certificate certificate = null; private transient @Nullable List authorizations = null; protected Order(Login login, URL location) { super(login, location); } /** * Returns the current status of the order. *

* Possible values are: {@link Status#PENDING}, {@link Status#READY}, * {@link Status#PROCESSING}, {@link Status#VALID}, {@link Status#INVALID}. * If the server supports STAR, another possible value is {@link Status#CANCELED}. */ @Override public Status getStatus() { return getJSON().get("status").asStatus(); } /** * Returns a {@link Problem} document with the reason if the order has failed. */ public Optional getError() { return getJSON().get("error").map(v -> v.asProblem(getLocation())); } /** * Gets the expiry date of the authorization, if set by the server. */ public Optional getExpires() { return getJSON().get("expires").map(Value::asInstant); } /** * Gets a list of {@link Identifier} that are connected to this order. * * @since 2.3 */ public List getIdentifiers() { return getJSON().get("identifiers") .asArray() .stream() .map(Value::asIdentifier) .toList(); } /** * Gets the "not before" date that was used for the order. */ public Optional getNotBefore() { return getJSON().get("notBefore").map(Value::asInstant); } /** * Gets the "not after" date that was used for the order. */ public Optional getNotAfter() { return getJSON().get("notAfter").map(Value::asInstant); } /** * Gets the {@link Authorization} that are required to fulfil this order, in no * specific order. */ public List getAuthorizations() { if (authorizations == null) { var login = getLogin(); authorizations = getJSON().get("authorizations") .asArray() .stream() .map(Value::asURL) .map(login::bindAuthorization) .collect(toList()); } return unmodifiableList(authorizations); } /** * Gets the location {@link URL} of where to send the finalization call to. *

* For internal purposes. Use {@link #execute(byte[])} to finalize an order. */ public URL getFinalizeLocation() { return getJSON().get("finalize").asURL(); } /** * Gets the {@link Certificate}. * * @throws IllegalStateException * if the order is not ready yet. You must finalize the order first, and wait * for the status to become {@link Status#VALID}. */ @SuppressFBWarnings("EI_EXPOSE_REP") // behavior is intended public Certificate getCertificate() { if (certificate == null) { certificate = getJSON().get("star-certificate") .optional() .or(() -> getJSON().get("certificate").optional()) .map(Value::asURL) .map(getLogin()::bindCertificate) .orElseThrow(() -> new IllegalStateException("Order is not completed")); } return certificate; } /** * Returns whether this is a STAR certificate ({@code true}) or a standard certificate * ({@code false}). * * @since 3.5.0 */ public boolean isAutoRenewalCertificate() { return getJSON().contains("star-certificate"); } /** * Finalizes the order. *

* If the finalization was successful, the certificate is provided via * {@link #getCertificate()}. *

* Even though the ACME protocol uses the term "finalize an order", this method is * called {@link #execute(KeyPair)} to avoid confusion with the problematic * {@link Object#finalize()} method. * * @param domainKeyPair * The {@link KeyPair} that is going to be certified. This is not * your account's keypair! * @see #execute(KeyPair, Consumer) * @see #execute(PKCS10CertificationRequest) * @see #execute(byte[]) * @see #waitUntilReady(Duration) * @see #waitForCompletion(Duration) * @since 3.0.0 */ public void execute(KeyPair domainKeyPair) throws AcmeException { execute(domainKeyPair, csrBuilder -> {}); } /** * Finalizes the order (see {@link #execute(KeyPair)}). *

* This method also accepts a builderConsumer that can be used to add further details * to the CSR (e.g. your organization). The identifiers (IPs, domain names, etc.) are * automatically added to the CSR. * * @param domainKeyPair * The {@link KeyPair} that is going to be used together with the certificate. * This is not your account's keypair! * @param builderConsumer * {@link Consumer} that adds further details to the provided * {@link CSRBuilder}. * @see #execute(KeyPair) * @see #execute(PKCS10CertificationRequest) * @see #execute(byte[]) * @see #waitUntilReady(Duration) * @see #waitForCompletion(Duration) * @since 3.0.0 */ public void execute(KeyPair domainKeyPair, Consumer builderConsumer) throws AcmeException { try { var csrBuilder = new CSRBuilder(); csrBuilder.addIdentifiers(getIdentifiers()); builderConsumer.accept(csrBuilder); csrBuilder.sign(domainKeyPair); execute(csrBuilder.getCSR()); } catch (IOException ex) { throw new AcmeException("Failed to create CSR", ex); } } /** * Finalizes the order (see {@link #execute(KeyPair)}). *

* This method receives a {@link PKCS10CertificationRequest} instance of a CSR that * was generated externally. Use this method to gain full control over the content of * the CSR. The CSR is not checked by acme4j, but just transported to the CA. It is * your responsibility that it matches to the order. * * @param csr * {@link PKCS10CertificationRequest} to be used for this order. * @see #execute(KeyPair) * @see #execute(KeyPair, Consumer) * @see #execute(byte[]) * @see #waitUntilReady(Duration) * @see #waitForCompletion(Duration) * @since 3.0.0 */ public void execute(PKCS10CertificationRequest csr) throws AcmeException { try { execute(csr.getEncoded()); } catch (IOException ex) { throw new AcmeException("Invalid CSR", ex); } } /** * Finalizes the order (see {@link #execute(KeyPair)}). *

* This method receives a byte array containing an encoded CSR that was generated * externally. Use this method to gain full control over the content of the CSR. The * CSR is not checked by acme4j, but just transported to the CA. It is your * responsibility that it matches to the order. * * @param csr * Binary representation of a CSR containing the parameters for the * certificate being requested, in DER format * @see #waitUntilReady(Duration) * @see #waitForCompletion(Duration) */ public void execute(byte[] csr) throws AcmeException { LOG.debug("finalize"); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); claims.putBase64("csr", csr); conn.sendSignedRequest(getFinalizeLocation(), claims, getLogin()); } invalidate(); } /** * Waits until the order is ready for finalization. *

* Is is ready if it reaches {@link Status#READY}. The method will also return if the * order already has another terminal state, which is either {@link Status#VALID} or * {@link Status#INVALID}. *

* This method is synchronous and blocks the current thread. * * @param timeout * Timeout until a terminal status must have been reached * @return Status that was reached * @since 3.4.0 */ public Status waitUntilReady(Duration timeout) throws AcmeException, InterruptedException { return waitForStatus(EnumSet.of(Status.READY, Status.VALID, Status.INVALID), timeout); } /** * Waits until the order finalization is completed. *

* Is is completed if it reaches either {@link Status#VALID} or * {@link Status#INVALID}. *

* This method is synchronous and blocks the current thread. * * @param timeout * Timeout until a terminal status must have been reached * @return Status that was reached * @since 3.4.0 */ public Status waitForCompletion(Duration timeout) throws AcmeException, InterruptedException { return waitForStatus(EnumSet.of(Status.VALID, Status.INVALID), timeout); } /** * Checks if this order is auto-renewing, according to the ACME STAR specifications. * * @since 2.3 */ public boolean isAutoRenewing() { return getJSON().get("auto-renewal") .optional() .isPresent(); } /** * Returns the earliest date of validity of the first certificate issued. * * @since 2.3 * @throws AcmeNotSupportedException if auto-renewal is not supported */ public Optional getAutoRenewalStartDate() { return getJSON().getFeature("auto-renewal") .map(Value::asObject) .orElseGet(JSON::empty) .get("start-date") .optional() .map(Value::asInstant); } /** * Returns the latest date of validity of the last certificate issued. * * @since 2.3 * @throws AcmeNotSupportedException if auto-renewal is not supported */ public Instant getAutoRenewalEndDate() { return getJSON().getFeature("auto-renewal") .map(Value::asObject) .orElseGet(JSON::empty) .get("end-date") .asInstant(); } /** * Returns the maximum lifetime of each certificate. * * @since 2.3 * @throws AcmeNotSupportedException if auto-renewal is not supported */ public Duration getAutoRenewalLifetime() { return getJSON().getFeature("auto-renewal") .optional() .map(Value::asObject) .orElseGet(JSON::empty) .get("lifetime") .asDuration(); } /** * Returns the pre-date period of each certificate. * * @since 2.7 * @throws AcmeNotSupportedException if auto-renewal is not supported */ public Optional getAutoRenewalLifetimeAdjust() { return getJSON().getFeature("auto-renewal") .optional() .map(Value::asObject) .orElseGet(JSON::empty) .get("lifetime-adjust") .optional() .map(Value::asDuration); } /** * Returns {@code true} if STAR certificates from this order can also be fetched via * GET requests. * * @since 2.6 */ public boolean isAutoRenewalGetEnabled() { return getJSON().getFeature("auto-renewal") .optional() .map(Value::asObject) .orElseGet(JSON::empty) .get("allow-certificate-get") .optional() .map(Value::asBoolean) .orElse(false); } /** * Cancels an auto-renewing order. * * @since 2.3 */ public void cancelAutoRenewal() throws AcmeException { if (!getSession().getMetadata().isAutoRenewalEnabled()) { throw new AcmeNotSupportedException("auto-renewal"); } LOG.debug("cancel"); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); claims.put("status", "canceled"); conn.sendSignedRequest(getLocation(), claims, getLogin()); setJSON(conn.readJsonResponse()); } } /** * Returns the selected profile. * * @since 3.5.0 * @throws AcmeNotSupportedException if profile is not supported */ public String getProfile() { return getJSON().getFeature("profile").asString(); } @Override protected void invalidate() { super.invalidate(); certificate = null; authorizations = null; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/OrderBuilder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Objects.requireNonNull; import static java.util.stream.Collectors.toList; import static org.shredzone.acme4j.toolbox.AcmeUtils.getRenewalUniqueIdentifier; import java.security.cert.X509Certificate; import java.time.Duration; import java.time.Instant; import java.util.Collection; import java.util.LinkedHashSet; import java.util.Objects; import java.util.Set; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * Start a new certificate {@link Order}. *

* Use {@link Login#newOrder()} or {@link Account#newOrder()} to create a new * {@link OrderBuilder} instance. Both methods are identical. */ public class OrderBuilder { private static final Logger LOG = LoggerFactory.getLogger(OrderBuilder.class); private final Login login; private final Set identifierSet = new LinkedHashSet<>(); private @Nullable Instant notBefore; private @Nullable Instant notAfter; private @Nullable String replaces; private boolean autoRenewal; private @Nullable Instant autoRenewalStart; private @Nullable Instant autoRenewalEnd; private @Nullable Duration autoRenewalLifetime; private @Nullable Duration autoRenewalLifetimeAdjust; private boolean autoRenewalGet; private @Nullable String profile; /** * Create a new {@link OrderBuilder}. * * @param login * {@link Login} to bind with */ protected OrderBuilder(Login login) { this.login = login; } /** * Adds a domain name to the order. * * @param domain * Name of a domain to be ordered. May be a wildcard domain if supported by * the CA. IDN names are accepted and will be ACE encoded automatically. * @return itself */ public OrderBuilder domain(String domain) { return identifier(Identifier.dns(domain)); } /** * Adds domain names to the order. * * @param domains * Collection of domain names to be ordered. May be wildcard domains if * supported by the CA. IDN names are accepted and will be ACE encoded * automatically. * @return itself */ public OrderBuilder domains(String... domains) { for (var domain : requireNonNull(domains, "domains")) { domain(domain); } return this; } /** * Adds a collection of domain names to the order. * * @param domains * Collection of domain names to be ordered. May be wildcard domains if * supported by the CA. IDN names are accepted and will be ACE encoded * automatically. * @return itself */ public OrderBuilder domains(Collection domains) { requireNonNull(domains, "domains").forEach(this::domain); return this; } /** * Adds an {@link Identifier} to the order. * * @param identifier * {@link Identifier} to be added to the order. * @return itself * @since 2.3 */ public OrderBuilder identifier(Identifier identifier) { identifierSet.add(requireNonNull(identifier, "identifier")); return this; } /** * Adds a collection of {@link Identifier} to the order. * * @param identifiers * Collection of {@link Identifier} to be added to the order. * @return itself * @since 2.3 */ public OrderBuilder identifiers(Collection identifiers) { requireNonNull(identifiers, "identifiers").forEach(this::identifier); return this; } /** * Sets a "not before" date in the certificate. May be ignored by the CA. * * @param notBefore "not before" date * @return itself */ public OrderBuilder notBefore(Instant notBefore) { if (autoRenewal) { throw new IllegalArgumentException("cannot combine notBefore with autoRenew"); } this.notBefore = requireNonNull(notBefore, "notBefore"); return this; } /** * Sets a "not after" date in the certificate. May be ignored by the CA. * * @param notAfter "not after" date * @return itself */ public OrderBuilder notAfter(Instant notAfter) { if (autoRenewal) { throw new IllegalArgumentException("cannot combine notAfter with autoRenew"); } this.notAfter = requireNonNull(notAfter, "notAfter"); return this; } /** * Enables short-term automatic renewal of the certificate, if supported by the CA. *

* Automatic renewals cannot be combined with {@link #notBefore(Instant)} or * {@link #notAfter(Instant)}. * * @return itself * @since 2.3 */ public OrderBuilder autoRenewal() { if (notBefore != null || notAfter != null) { throw new IllegalArgumentException("cannot combine notBefore/notAfter with autoRenewal"); } this.autoRenewal = true; return this; } /** * Sets the earliest date of validity of the first issued certificate. If not set, * the start date is the earliest possible date. *

* Implies {@link #autoRenewal()}. * * @param start * Start date of validity * @return itself * @since 2.3 */ public OrderBuilder autoRenewalStart(Instant start) { autoRenewal(); this.autoRenewalStart = requireNonNull(start, "start"); return this; } /** * Sets the latest date of validity of the last issued certificate. If not set, the * CA's default is used. *

* Implies {@link #autoRenewal()}. * * @param end * End date of validity * @return itself * @see Metadata#getAutoRenewalMaxDuration() * @since 2.3 */ public OrderBuilder autoRenewalEnd(Instant end) { autoRenewal(); this.autoRenewalEnd = requireNonNull(end, "end"); return this; } /** * Sets the maximum validity period of each certificate. If not set, the CA's * default is used. *

* Implies {@link #autoRenewal()}. * * @param duration * Duration of validity of each certificate * @return itself * @see Metadata#getAutoRenewalMinLifetime() * @since 2.3 */ public OrderBuilder autoRenewalLifetime(Duration duration) { autoRenewal(); this.autoRenewalLifetime = requireNonNull(duration, "duration"); return this; } /** * Sets the amount of pre-dating each certificate. If not set, the CA's * default (0) is used. *

* Implies {@link #autoRenewal()}. * * @param duration * Duration of certificate pre-dating * @return itself * @since 2.7 */ public OrderBuilder autoRenewalLifetimeAdjust(Duration duration) { autoRenewal(); this.autoRenewalLifetimeAdjust = requireNonNull(duration, "duration"); return this; } /** * Announces that the client wishes to fetch the auto-renewed certificate via GET * request. If not used, the STAR certificate can only be fetched via POST-as-GET * request. {@link Metadata#isAutoRenewalGetAllowed()} must return {@code true} in * order for this option to work. *

* This option is only needed if you plan to fetch the STAR certificate via other * means than by using acme4j. acme4j is fetching certificates via POST-as-GET * request. *

* Implies {@link #autoRenewal()}. * * @return itself * @since 2.6 */ public OrderBuilder autoRenewalEnableGet() { autoRenewal(); this.autoRenewalGet = true; return this; } /** * Notifies the CA of the desired profile of the ordered certificate. *

* Optional, only supported if the CA supports profiles. However, in this case the * client may include this field. * * @param profile * Identifier of the desired profile * @return itself * @draft This method is currently based on RFC draft draft-ietf-acme-profiles. It * may be changed or removed without notice to reflect future changes to the draft. * SemVer rules do not apply here. * @since 3.5.0 */ public OrderBuilder profile(String profile) { this.profile = Objects.requireNonNull(profile); return this; } /** * Notifies the CA that the ordered certificate will replace a previously issued * certificate. The certificate is identified by its ARI unique identifier. *

* Optional, only supported if the CA provides renewal information. However, in this * case the client should include this field. * * @param uniqueId * Certificate's renewal unique identifier. * @return itself * @since 3.2.0 */ public OrderBuilder replaces(String uniqueId) { this.replaces = Objects.requireNonNull(uniqueId); return this; } /** * Notifies the CA that the ordered certificate will replace a previously issued * certificate. *

* Optional, only supported if the CA provides renewal information. However, in this * case the client should include this field. * * @param certificate * Certificate to be replaced * @return itself * @since 3.2.0 */ public OrderBuilder replaces(X509Certificate certificate) { return replaces(getRenewalUniqueIdentifier(certificate)); } /** * Notifies the CA that the ordered certificate will replace a previously issued * certificate. *

* Optional, only supported if the CA provides renewal information. However, in this * case the client should include this field. * * @param certificate * Certificate to be replaced * @return itself * @since 3.2.0 */ public OrderBuilder replaces(Certificate certificate) { return replaces(certificate.getCertificate()); } /** * Sends a new order to the server, and returns an {@link Order} object. * * @return {@link Order} that was created */ public Order create() throws AcmeException { if (identifierSet.isEmpty()) { throw new IllegalArgumentException("At least one identifer is required"); } var session = login.getSession(); if (autoRenewal && !session.getMetadata().isAutoRenewalEnabled()) { throw new AcmeNotSupportedException("auto-renewal"); } if (autoRenewalGet && !session.getMetadata().isAutoRenewalGetAllowed()) { throw new AcmeNotSupportedException("auto-renewal-get"); } if (replaces != null && session.resourceUrlOptional(Resource.RENEWAL_INFO).isEmpty()) { throw new AcmeNotSupportedException("renewal-information"); } if (profile != null && !session.getMetadata().isProfileAllowed()) { throw new AcmeNotSupportedException("profile"); } if (profile != null && !session.getMetadata().isProfileAllowed(profile)) { throw new AcmeNotSupportedException("profile: " + profile); } var hasAncestorDomain = identifierSet.stream() .filter(id -> Identifier.TYPE_DNS.equals(id.getType())) .anyMatch(id -> id.toMap().containsKey(Identifier.KEY_ANCESTOR_DOMAIN)); if (hasAncestorDomain && !login.getSession().getMetadata().isSubdomainAuthAllowed()) { throw new AcmeNotSupportedException("ancestor-domain"); } LOG.debug("create"); try (var conn = session.connect()) { var claims = new JSONBuilder(); claims.array("identifiers", identifierSet.stream().map(Identifier::toMap).collect(toList())); if (notBefore != null) { claims.put("notBefore", notBefore); } if (notAfter != null) { claims.put("notAfter", notAfter); } if (autoRenewal) { var arClaims = claims.object("auto-renewal"); if (autoRenewalStart != null) { arClaims.put("start-date", autoRenewalStart); } if (autoRenewalStart != null) { arClaims.put("end-date", autoRenewalEnd); } if (autoRenewalLifetime != null) { arClaims.put("lifetime", autoRenewalLifetime); } if (autoRenewalLifetimeAdjust != null) { arClaims.put("lifetime-adjust", autoRenewalLifetimeAdjust); } if (autoRenewalGet) { arClaims.put("allow-certificate-get", autoRenewalGet); } } if (replaces != null) { claims.put("replaces", replaces); } if (profile != null) { claims.put("profile", profile); } conn.sendSignedRequest(session.resourceUrl(Resource.NEW_ORDER), claims, login); var order = new Order(login, conn.getLocation()); order.setJSON(conn.readJsonResponse()); return order; } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/PollableResource.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.time.Instant.now; import java.time.Duration; import java.time.Instant; import java.time.temporal.ChronoUnit; import java.util.Objects; import java.util.Optional; import java.util.Set; import org.shredzone.acme4j.exception.AcmeException; /** * Marks an ACME Resource with a pollable status. *

* The resource provides a status, and a method for updating the internal cache to read * the current status from the server. * * @since 3.4.0 */ public interface PollableResource { /** * Default delay between status polls if there is no Retry-After header. */ Duration DEFAULT_RETRY_AFTER = Duration.ofSeconds(3L); /** * Returns the current status of the resource. */ Status getStatus(); /** * Fetches the current status from the server. * * @return Retry-After time, if given by the CA, otherwise empty. */ Optional fetch() throws AcmeException; /** * Waits until a terminal status has been reached, by polling until one of the given * status or the given timeout has been reached. This call honors the Retry-After * header if set by the CA. *

* This method is synchronous and blocks the current thread. *

* If the resource is already in a terminal status, the method returns immediately. * * @param statusSet * Set of {@link Status} that are accepted as terminal * @param timeout * Timeout until a terminal status must have been reached * @return Status that was reached */ default Status waitForStatus(Set statusSet, Duration timeout) throws AcmeException, InterruptedException { Objects.requireNonNull(timeout, "timeout"); Objects.requireNonNull(statusSet, "statusSet"); if (statusSet.isEmpty()) { throw new IllegalArgumentException("At least one Status is required"); } var currentStatus = getStatus(); if (statusSet.contains(currentStatus)) { return currentStatus; } var timebox = now().plus(timeout); Instant now; while ((now = now()).isBefore(timebox)) { // Poll status and get the time of the next poll var retryAfter = fetch() .orElse(now.plus(DEFAULT_RETRY_AFTER)); currentStatus = getStatus(); if (statusSet.contains(currentStatus)) { return currentStatus; } // Preemptively end the loop if the next iteration would be after timebox if (retryAfter.isAfter(timebox)) { break; } // Wait until retryAfter is reached Thread.sleep(now.until(retryAfter, ChronoUnit.MILLIS)); } throw new AcmeException("Timeout has been reached"); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Problem.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.io.Serial; import java.io.Serializable; import java.net.URI; import java.net.URISyntaxException; import java.net.URL; import java.util.List; import java.util.Optional; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSON.Value; /** * A JSON problem. It contains further, machine- and human-readable details about the * reason of an error or failure. * * @see RFC 7807 */ public class Problem implements Serializable { @Serial private static final long serialVersionUID = -8418248862966754214L; private final URL baseUrl; private final JSON problemJson; /** * Creates a new {@link Problem} object. * * @param problem * Problem as JSON structure * @param baseUrl * Document's base {@link URL} to resolve relative URIs against */ public Problem(JSON problem, URL baseUrl) { this.problemJson = problem; this.baseUrl = baseUrl; } /** * Returns the problem type. It is always an absolute URI. */ public URI getType() { return problemJson.get("type") .map(Value::asString) .map(it -> { try { return baseUrl.toURI().resolve(it); } catch (URISyntaxException ex) { throw new IllegalArgumentException("Bad base URL", ex); } }) .orElseThrow(() -> new AcmeProtocolException("Problem without type")); } /** * Returns a short, human-readable summary of the problem. The text may be localized * if supported by the server. Empty if the server did not provide a title. * * @see #toString() */ public Optional getTitle() { return problemJson.get("title").map(Value::asString); } /** * Returns a detailed and specific human-readable explanation of the problem. The * text may be localized if supported by the server. * * @see #toString() */ public Optional getDetail() { return problemJson.get("detail").map(Value::asString); } /** * Returns a URI that identifies the specific occurence of the problem. It is always * an absolute URI. */ public Optional getInstance() { return problemJson.get("instance") .map(Value::asString) .map(it -> { try { return baseUrl.toURI().resolve(it); } catch (URISyntaxException ex) { throw new IllegalArgumentException("Bad base URL", ex); } }); } /** * Returns the {@link Identifier} this problem relates to. * * @since 2.3 */ public Optional getIdentifier() { return problemJson.get("identifier") .optional() .map(Value::asIdentifier); } /** * Returns a list of sub-problems. */ public List getSubProblems() { return problemJson.get("subproblems") .asArray() .stream() .map(o -> o.asProblem(baseUrl)) .toList(); } /** * Returns the problem as {@link JSON} object, to access other, non-standard fields. * * @return Problem as {@link JSON} object */ public JSON asJSON() { return problemJson; } /** * Returns a human-readable description of the problem, that is as specific as * possible. The description may be localized if supported by the server. *

* If {@link #getSubProblems()} exist, they will be appended. *

* Technically, it returns {@link #getDetail()}. If not set, {@link #getTitle()} is * returned instead. As a last resort, {@link #getType()} is returned. */ @Override public String toString() { var sb = new StringBuilder(); if (getDetail().isPresent()) { sb.append(getDetail().get()); } else if (getTitle().isPresent()) { sb.append(getTitle().get()); } else { sb.append(getType()); } var subproblems = getSubProblems(); if (!subproblems.isEmpty()) { sb.append(" ("); var first = true; for (var sub : subproblems) { if (!first) { sb.append(" ‒ "); } sb.append(sub.toString()); first = false; } sb.append(')'); } return sb.toString(); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/RenewalInfo.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.net.URL; import java.time.Instant; import java.time.temporal.TemporalAmount; import java.util.Optional; import java.util.concurrent.ThreadLocalRandom; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON.Value; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * Renewal Information of a certificate. * * @since 3.0.0 */ public class RenewalInfo extends AcmeJsonResource { private static final Logger LOG = LoggerFactory.getLogger(RenewalInfo.class); protected RenewalInfo(Login login, URL location) { super(login, location); } /** * Returns the starting {@link Instant} of the time window the CA recommends for * certificate renewal. */ public Instant getSuggestedWindowStart() { return getJSON().get("suggestedWindow").asObject().get("start").asInstant(); } /** * Returns the ending {@link Instant} of the time window the CA recommends for * certificate renewal. */ public Instant getSuggestedWindowEnd() { return getJSON().get("suggestedWindow").asObject().get("end").asInstant(); } /** * An optional {@link URL} pointing to a page which may explain why the suggested * renewal window is what it is. */ public Optional getExplanation() { return getJSON().get("explanationURL").optional().map(Value::asURL); } /** * Checks if the given {@link Instant} is before the suggested time window, so a * certificate renewal is not required yet. * * @param instant * {@link Instant} to check * @return {@code true} if the {@link Instant} is before the time window, {@code * false} otherwise. */ public boolean renewalIsNotRequired(Instant instant) { assertValidTimeWindow(); return instant.isBefore(getSuggestedWindowStart()); } /** * Checks if the given {@link Instant} is within the suggested time window, and a * certificate renewal is recommended. *

* An {@link Instant} is deemed to be within the time window if it is equal to, or * after {@link #getSuggestedWindowStart()}, and before {@link * #getSuggestedWindowEnd()}. * * @param instant * {@link Instant} to check * @return {@code true} if the {@link Instant} is within the time window, {@code * false} otherwise. */ public boolean renewalIsRecommended(Instant instant) { assertValidTimeWindow(); return !instant.isBefore(getSuggestedWindowStart()) && instant.isBefore(getSuggestedWindowEnd()); } /** * Checks if the given {@link Instant} is past the time window, and a certificate * renewal is overdue. *

* An {@link Instant} is deemed to be past the time window if it is equal to, or after * {@link #getSuggestedWindowEnd()}. * * @param instant * {@link Instant} to check * @return {@code true} if the {@link Instant} is past the time window, {@code false} * otherwise. */ public boolean renewalIsOverdue(Instant instant) { assertValidTimeWindow(); return !instant.isBefore(getSuggestedWindowEnd()); } /** * Returns a proposed {@link Instant} when the certificate related to this * {@link RenewalInfo} should be renewed. *

* This method is useful for setting alarms for renewal cron jobs. As a parameter, the * frequency of the cron job is set. The resulting {@link Instant} is guaranteed to be * executed in time, considering the cron job intervals. *

* This method uses {@link ThreadLocalRandom} for random numbers. It is sufficient for * most cases, as only an "earliest" {@link Instant} is returned, but the actual * renewal process also depends on cron job execution times and other factors like * system load. *

* The result is empty if it is impossible to renew the certificate in time, under the * given circumstances. This is either because the time window already ended in the * past, or because the cron job would not be executed before the ending of the time * window. In this case, it is recommended to renew the certificate immediately. * * @param frequency * Frequency of the cron job executing the certificate renewals. May be * {@code null} if there is no cron job, and the renewal is going to be * executed exactly at the given {@link Instant}. * @return Random {@link Instant} when the certificate should be renewed. This instant * might be slightly in the past. In this case, start the renewal process at the next * possible regular moment. */ public Optional getRandomProposal(@Nullable TemporalAmount frequency) { assertValidTimeWindow(); Instant start = Instant.now(); Instant suggestedStart = getSuggestedWindowStart(); if (start.isBefore(suggestedStart)) { start = suggestedStart; } Instant end = getSuggestedWindowEnd(); if (frequency != null) { end = end.minus(frequency); } if (!end.isAfter(start)) { return Optional.empty(); } return Optional.of(Instant.ofEpochMilli(ThreadLocalRandom.current().nextLong( start.toEpochMilli(), end.toEpochMilli()))); } /** * Asserts that the end of the suggested time window is after the start. */ private void assertValidTimeWindow() { if (getSuggestedWindowStart().isAfter(getSuggestedWindowEnd())) { throw new AcmeProtocolException("Received an invalid suggested window"); } } @Override public Optional fetch() throws AcmeException { LOG.debug("update RenewalInfo"); try (Connection conn = getSession().connect()) { conn.sendRequest(getLocation(), getSession(), null); setJSON(conn.readJsonResponse()); var retryAfterOpt = conn.getRetryAfter(); retryAfterOpt.ifPresent(instant -> LOG.debug("Retry-After: {}", instant)); setRetryAfter(retryAfterOpt.orElse(null)); return retryAfterOpt; } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/RevocationReason.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.util.Arrays; /** * An enumeration of revocation reasons. * * @see RFC 5280 Section * 5.3.1 */ public enum RevocationReason { UNSPECIFIED(0), KEY_COMPROMISE(1), CA_COMPROMISE(2), AFFILIATION_CHANGED(3), SUPERSEDED(4), CESSATION_OF_OPERATION(5), CERTIFICATE_HOLD(6), REMOVE_FROM_CRL(8), PRIVILEGE_WITHDRAWN(9), AA_COMPROMISE(10); private final int reasonCode; RevocationReason(int reasonCode) { this.reasonCode = reasonCode; } /** * Returns the reason code as defined in RFC 5280. */ public int getReasonCode() { return reasonCode; } /** * Returns the {@link RevocationReason} that matches the reason code. * * @param reasonCode * Reason code as defined in RFC 5280 * @return Matching {@link RevocationReason} * @throws IllegalArgumentException if the reason code is unknown or invalid */ public static RevocationReason code(int reasonCode) { return Arrays.stream(values()) .filter(rr -> rr.reasonCode == reasonCode) .findFirst() .orElseThrow(() -> new IllegalArgumentException("Unknown revocation reason code: " + reasonCode)); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Session.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Objects.requireNonNull; import java.net.URI; import java.net.URL; import java.net.http.HttpClient; import java.security.KeyPair; import java.time.ZonedDateTime; import java.util.EnumMap; import java.util.Locale; import java.util.Map; import java.util.Optional; import java.util.ServiceLoader; import java.util.concurrent.atomic.AtomicReference; import java.util.concurrent.locks.ReentrantLock; import java.util.stream.StreamSupport; import edu.umd.cs.findbugs.annotations.Nullable; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.connector.NonceHolder; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.provider.AcmeProvider; import org.shredzone.acme4j.provider.GenericAcmeProvider; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSON.Value; /** * A {@link Session} tracks the entire communication with a CA. *

* To create a session instance, use its constructor. It requires the URI of the ACME * server to connect to. This can be the location of the CA's directory (via {@code http} * or {@code https} protocol), or a special URI (via {@code acme} protocol). See the * documentation about valid URIs. *

* Starting with version 4.0.0, a session instance can be shared between multiple threads. * A session won't perform parallel HTTP connections. For high-load scenarios, it is * recommended to use multiple sessions. */ public class Session { private static final GenericAcmeProvider GENERIC_PROVIDER = new GenericAcmeProvider(); private final AtomicReference> resourceMap = new AtomicReference<>(); private final AtomicReference metadata = new AtomicReference<>(); private final AtomicReference httpClient = new AtomicReference<>(); private final ReentrantLock nonceLock = new ReentrantLock(); private final NetworkSettings networkSettings = new NetworkSettings(); private final URI serverUri; private final AcmeProvider provider; private @Nullable String nonce; private @Nullable Locale locale = Locale.getDefault(); private String languageHeader = AcmeUtils.localeToLanguageHeader(Locale.getDefault()); protected @Nullable ZonedDateTime directoryLastModified; protected @Nullable ZonedDateTime directoryExpires; /** * Creates a new {@link Session}. * * @param serverUri * URI string of the ACME server to connect to. This is either the location of * the CA's ACME directory (using {@code http} or {@code https} protocol), or * a special URI (using the {@code acme} protocol). * @throws IllegalArgumentException * if no ACME provider was found for the server URI. */ public Session(String serverUri) { this(URI.create(serverUri)); } /** * Creates a new {@link Session}. * * @param serverUri * {@link URI} of the ACME server to connect to. This is either the location * of the CA's ACME directory (using {@code http} or {@code https} protocol), * or a special URI (using the {@code acme} protocol). * @throws IllegalArgumentException * if no ACME provider was found for the server URI. */ public Session(URI serverUri) { this.serverUri = requireNonNull(serverUri, "serverUri"); if (GENERIC_PROVIDER.accepts(serverUri)) { provider = GENERIC_PROVIDER; return; } var providers = ServiceLoader.load(AcmeProvider.class); provider = StreamSupport.stream(providers.spliterator(), false) .filter(p -> p.accepts(serverUri)) .reduce((a, b) -> { throw new IllegalArgumentException("Both ACME providers " + a.getClass().getSimpleName() + " and " + b.getClass().getSimpleName() + " accept " + serverUri + ". Please check your classpath."); }) .orElseThrow(() -> new IllegalArgumentException("No ACME provider found for " + serverUri)); } /** * Creates a new {@link Session} using the given {@link AcmeProvider}. *

* This constructor is only to be used for testing purposes. * * @param serverUri * {@link URI} of the ACME server * @param provider * {@link AcmeProvider} to be used * @since 2.8 */ public Session(URI serverUri, AcmeProvider provider) { this.serverUri = requireNonNull(serverUri, "serverUri"); this.provider = requireNonNull(provider, "provider"); if (!provider.accepts(serverUri)) { throw new IllegalArgumentException("Provider does not accept " + serverUri); } } /** * Logs into an existing account. * * @param accountLocation * Location {@link URL} of the account * @param accountKeyPair * Account {@link KeyPair} * @return {@link Login} to this account */ public Login login(URL accountLocation, KeyPair accountKeyPair) { return new Login(accountLocation, accountKeyPair, this); } /** * Gets the ACME server {@link URI} of this session. */ public URI getServerUri() { return serverUri; } /** * Locks the Session for the current thread, and returns a {@link NonceHolder}. *

* The current thread can lock the nonce multiple times. Other threads have to wait * until the current thread unlocks the nonce. * * @since 4.0.0 */ public NonceHolder lockNonce() { nonceLock.lock(); return new NonceHolder() { @Override public String getNonce() { return Session.this.nonce; } @Override public void setNonce(@Nullable String nonce) { Session.this.nonce = nonce; } @Override public void close() { nonceLock.unlock(); } }; } /** * Gets the current locale of this session, or {@code null} if no special language is * selected. */ @Nullable public Locale getLocale() { return locale; } /** * Sets the locale used in this session. The locale is passed to the server as * Accept-Language header. The server may respond with localized messages. * The default is the system's language. If set to {@code null}, any language will be * accepted. */ public void setLocale(@Nullable Locale locale) { this.locale = locale; this.languageHeader = AcmeUtils.localeToLanguageHeader(locale); } /** * Gets an Accept-Language header value that matches the current locale. This method * is mainly for internal use. * * @since 3.0.0 */ public String getLanguageHeader() { return languageHeader; } /** * Returns the current {@link NetworkSettings}. * * @return {@link NetworkSettings} * @since 2.8 */ @SuppressFBWarnings("EI_EXPOSE_REP") // behavior is intended public NetworkSettings networkSettings() { return networkSettings; } /** * Returns the {@link AcmeProvider} that is used for this session. * * @return {@link AcmeProvider} */ public AcmeProvider provider() { return provider; } /** * Returns a new {@link Connection} to the ACME server. * * @return {@link Connection} */ public Connection connect() { return provider.connect(getServerUri(), networkSettings, getHttpClient()); } /** * Returns the shared {@link HttpClient} instance for this session. The instance is * created lazily on first access and then cached for reuse. This allows multiple * connections to share the same HTTP client, improving resource utilization and * connection pooling. * * @return Shared {@link HttpClient} instance * @since 4.0.0 */ public HttpClient getHttpClient() { var result = httpClient.get(); if (result == null) { result = httpClient.updateAndGet( client -> client != null ? client : provider.createHttpClient(networkSettings) ); } return result; } /** * Gets the {@link URL} of the given {@link Resource}. This may involve connecting to * the server and fetching the directory. The result is cached. * * @param resource * {@link Resource} to get the {@link URL} of * @return {@link URL} of the resource * @throws AcmeException * if the server does not offer the {@link Resource} */ public URL resourceUrl(Resource resource) throws AcmeException { return resourceUrlOptional(resource) .orElseThrow(() -> new AcmeNotSupportedException(resource.path())); } /** * Gets the {@link URL} of the given {@link Resource}. This may involve connecting to * the server and fetching the directory. The result is cached. * * @param resource * {@link Resource} to get the {@link URL} of * @return {@link URL} of the resource, or empty if the resource is not available. * @since 3.0.0 */ public Optional resourceUrlOptional(Resource resource) throws AcmeException { readDirectory(); return Optional.ofNullable(resourceMap.get() .get(requireNonNull(resource, "resource"))); } /** * Gets the metadata of the provider's directory. This may involve connecting to the * server and fetching the directory. The result is cached. * * @return {@link Metadata}. May contain no data, but is never {@code null}. */ public Metadata getMetadata() throws AcmeException { readDirectory(); return metadata.get(); } /** * Returns the date when the directory has been modified the last time. * * @return The last modification date of the directory, or {@code null} if unknown * (directory has not been read yet or did not provide this information). * @since 2.10 */ @Nullable public ZonedDateTime getDirectoryLastModified() { return directoryLastModified; } /** * Sets the date when the directory has been modified the last time. Should only be * invoked by {@link AcmeProvider} implementations. * * @param directoryLastModified * The last modification date of the directory, or {@code null} if unknown * (directory has not been read yet or did not provide this information). * @since 2.10 */ public void setDirectoryLastModified(@Nullable ZonedDateTime directoryLastModified) { this.directoryLastModified = directoryLastModified; } /** * Returns the date when the current directory records will expire. A fresh copy of * the directory will be fetched automatically after that instant. * * @return The expiration date, or {@code null} if the server did not provide this * information. * @since 2.10 */ @Nullable public ZonedDateTime getDirectoryExpires() { return directoryExpires; } /** * Sets the date when the current directory will expire. Should only be invoked by * {@link AcmeProvider} implementations. * * @param directoryExpires * Expiration date, or {@code null} if the server did not provide this * information. * @since 2.10 */ public void setDirectoryExpires(@Nullable ZonedDateTime directoryExpires) { this.directoryExpires = directoryExpires; } /** * Returns {@code true} if a copy of the directory is present in a local cache. It is * not evaluated if the cached copy has expired though. * * @return {@code true} if a directory is available. * @since 2.10 */ public boolean hasDirectory() { return resourceMap.get() != null; } /** * Purges the directory cache. Makes sure that a fresh copy of the directory will be * read from the CA on the next time the directory is accessed. * * @since 3.0.0 */ public void purgeDirectoryCache() { setDirectoryLastModified(null); setDirectoryExpires(null); resourceMap.set(null); } /** * Reads the provider's directory, then rebuild the resource map. The resource map * is unchanged if the {@link AcmeProvider} returns that the directory has not been * changed on the remote side. */ private void readDirectory() throws AcmeException { var directoryJson = provider().directory(this, getServerUri()); if (directoryJson == null) { if (!hasDirectory()) { throw new AcmeException("AcmeProvider did not provide a directory"); } return; } var meta = directoryJson.get("meta"); if (meta.isPresent()) { metadata.set(new Metadata(meta.asObject())); } else { metadata.set(new Metadata(JSON.empty())); } var map = new EnumMap(Resource.class); for (var res : Resource.values()) { directoryJson.get(res.path()) .map(Value::asURL) .ifPresent(url -> map.put(res, url)); } resourceMap.set(map); } @Override protected final void finalize() { // CT_CONSTRUCTOR_THROW: Prevents finalizer attack } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/Status.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import java.util.Arrays; import java.util.Locale; /** * An enumeration of status codes of challenges and authorizations. */ public enum Status { /** * The server has created the resource, and is waiting for the client to process it. */ PENDING, /** * The {@link Order} is ready to be finalized. Invoke {@link Order#execute(byte[])}. */ READY, /** * The server is processing the resource. The client should invoke * {@link AcmeJsonResource#fetch()} and re-check the status. */ PROCESSING, /** * The resource is valid and can be used as intended. */ VALID, /** * An error or authorization/validation failure has occured. The client should check * for error messages. */ INVALID, /** * The {@link Authorization} has been revoked by the server. */ REVOKED, /** * The {@link Account} or {@link Authorization} has been deactivated by the client. */ DEACTIVATED, /** * The {@link Authorization} is expired. */ EXPIRED, /** * An auto-renewing {@link Order} is canceled. * * @since 2.3 */ CANCELED, /** * The server did not provide a status, or the provided status is not a specified ACME * status. */ UNKNOWN; /** * Parses the string and returns a corresponding Status object. * * @param str * String to parse * @return {@link Status} matching the string, or {@link Status#UNKNOWN} if there was * no match */ public static Status parse(String str) { var check = str.toUpperCase(Locale.ENGLISH); return Arrays.stream(values()) .filter(s -> s.name().equals(check)) .findFirst() .orElse(Status.UNKNOWN); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import java.io.Serial; import java.time.Duration; import java.time.Instant; import java.util.EnumSet; import java.util.Optional; import org.shredzone.acme4j.AcmeJsonResource; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.PollableResource; import org.shredzone.acme4j.Problem; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSON.Value; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * A generic challenge. It can be used as a base class for actual challenge * implementations, but it is also used if the ACME server offers a proprietary challenge * that is unknown to acme4j. *

* Subclasses must override {@link Challenge#acceptable(String)} so it only accepts its * own type. {@link Challenge#prepareResponse(JSONBuilder)} can be overridden to put all * required data to the challenge response. */ public class Challenge extends AcmeJsonResource implements PollableResource { @Serial private static final long serialVersionUID = 2338794776848388099L; private static final Logger LOG = LoggerFactory.getLogger(Challenge.class); protected static final String KEY_TYPE = "type"; protected static final String KEY_URL = "url"; protected static final String KEY_STATUS = "status"; protected static final String KEY_VALIDATED = "validated"; protected static final String KEY_ERROR = "error"; /** * Creates a new generic {@link Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public Challenge(Login login, JSON data) { super(login, data.get(KEY_URL).asURL()); setJSON(data); } /** * Returns the challenge type by name (e.g. "http-01"). */ public String getType() { return getJSON().get(KEY_TYPE).asString(); } /** * Returns the current status of the challenge. *

* Possible values are: {@link Status#PENDING}, {@link Status#PROCESSING}, * {@link Status#VALID}, {@link Status#INVALID}. *

* A challenge is only completed when it reaches either status {@link Status#VALID} or * {@link Status#INVALID}. */ @Override public Status getStatus() { return getJSON().get(KEY_STATUS).asStatus(); } /** * Returns the validation date, if returned by the server. */ public Optional getValidated() { return getJSON().get(KEY_VALIDATED).map(Value::asInstant); } /** * Returns a reason why the challenge has failed in the past, if returned by the * server. If there are multiple errors, they can be found in * {@link Problem#getSubProblems()}. */ public Optional getError() { return getJSON().get(KEY_ERROR).map(it -> it.asProblem(getLocation())); } /** * Prepares the response message for triggering the challenge. Subclasses can add * fields to the {@link JSONBuilder} as required by the challenge. Implementations of * subclasses should make sure that {@link #prepareResponse(JSONBuilder)} of the * superclass is invoked. * * @param response * {@link JSONBuilder} to write the response to */ protected void prepareResponse(JSONBuilder response) { // Do nothing here... } /** * Checks if the type is acceptable to this challenge. This generic class only checks * if the type is not blank. Subclasses should instead check if the given type matches * expected challenge type. * * @param type * Type to check * @return {@code true} if acceptable, {@code false} if not */ protected boolean acceptable(String type) { return type != null && !type.trim().isEmpty(); } @Override protected void setJSON(JSON json) { var type = json.get(KEY_TYPE).asString(); if (!acceptable(type)) { throw new AcmeProtocolException("incompatible type " + type + " for this challenge"); } var loc = json.get(KEY_URL).asString(); if (!loc.equals(getLocation().toString())) { throw new AcmeProtocolException("challenge has changed its location"); } super.setJSON(json); } /** * Triggers this {@link Challenge}. The ACME server is requested to validate the * response. Note that the validation is performed asynchronously by the ACME server. *

* After a challenge is triggered, it changes to {@link Status#PENDING}. As soon as * validation takes place, it changes to {@link Status#PROCESSING}. After validation * the status changes to {@link Status#VALID} or {@link Status#INVALID}, depending on * the outcome of the validation. *

* If the challenge requires a resource to be set on your side (e.g. a DNS record or * an HTTP file), it must be reachable from public before {@link #trigger()} * is invoked, and must not be taken down until the challenge has reached * {@link Status#VALID} or {@link Status#INVALID}. *

* If this method is invoked a second time, the ACME server is requested to retry the * validation. This can be useful if the client state has changed, for example after a * firewall rule has been updated. * * @see #waitForCompletion(Duration) */ public void trigger() throws AcmeException { LOG.debug("trigger"); try (var conn = getSession().connect()) { var claims = new JSONBuilder(); prepareResponse(claims); conn.sendSignedRequest(getLocation(), claims, getLogin()); setJSON(conn.readJsonResponse()); } } /** * Waits until the challenge is completed. *

* Is is completed if it reaches either {@link Status#VALID} or * {@link Status#INVALID}. *

* This method is synchronous and blocks the current thread. * * @param timeout * Timeout until a terminal status must have been reached * @return Status that was reached * @since 3.4.0 */ public Status waitForCompletion(Duration timeout) throws AcmeException, InterruptedException { return waitForStatus(EnumSet.of(Status.VALID, Status.INVALID), timeout); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/Dns01Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static org.shredzone.acme4j.toolbox.AcmeUtils.base64UrlEncode; import static org.shredzone.acme4j.toolbox.AcmeUtils.sha256hash; import java.io.Serial; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.toolbox.JSON; /** * Implements the {@value TYPE} challenge. It requires a specific DNS record for domain * validation. See the acme4j documentation for a detailed explanation. */ public class Dns01Challenge extends TokenChallenge { @Serial private static final long serialVersionUID = 6964687027713533075L; /** * Challenge type name: {@value} */ public static final String TYPE = "dns-01"; /** * The prefix of the domain name to be used for the DNS TXT record. */ public static final String RECORD_NAME_PREFIX = "_acme-challenge"; /** * Creates a new generic {@link Dns01Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public Dns01Challenge(Login login, JSON data) { super(login, data); } /** * Converts a domain identifier to the Resource Record name to be used for the DNS TXT * record. * * @param identifier * Domain {@link Identifier} of the domain to be validated * @return Resource Record name (e.g. {@code _acme-challenge.www.example.org.}, note * the trailing full stop character). * @since 4.0.0 */ public String getRRName(Identifier identifier) { return getRRName(identifier.getDomain()); } /** * Converts a domain identifier to the Resource Record name to be used for the DNS TXT * record. * * @param domain * Domain name to be validated * @return Resource Record name (e.g. {@code _acme-challenge.www.example.org.}, note * the trailing full stop character). * @since 4.0.0 */ public String getRRName(String domain) { return RECORD_NAME_PREFIX + '.' + domain + '.'; } /** * Returns the digest string to be set in the domain's {@code _acme-challenge} TXT * record. */ public String getDigest() { return base64UrlEncode(sha256hash(getAuthorization())); } @Override protected boolean acceptable(String type) { return TYPE.equals(type); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/DnsAccount01Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static org.shredzone.acme4j.toolbox.AcmeUtils.*; import java.io.Serial; import java.net.URL; import java.util.Arrays; import java.util.Locale; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.toolbox.JSON; /** * Implements the {@value TYPE} challenge. It requires a specific DNS record for domain * validation. See the acme4j documentation for a detailed explanation. * * @draft This class is currently based on an RFC draft. It may be changed or removed * without notice to reflect future changes to the draft. SemVer rules do not apply here. * @since 4.0.0 */ public class DnsAccount01Challenge extends TokenChallenge { @Serial private static final long serialVersionUID = -1098129409378900733L; /** * Challenge type name: {@value} */ public static final String TYPE = "dns-account-01"; /** * Creates a new generic {@link DnsAccount01Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public DnsAccount01Challenge(Login login, JSON data) { super(login, data); } /** * Converts a domain identifier to the Resource Record name to be used for the DNS TXT * record. * * @param identifier * {@link Identifier} to be validated * @return Resource Record name (e.g. * {@code _ujmmovf2vn55tgye._acme-challenge.example.org.}, note the trailing full stop * character). */ public String getRRName(Identifier identifier) { return getRRName(identifier.getDomain()); } /** * Converts a domain identifier to the Resource Record name to be used for the DNS TXT * record. * * @param domain * Domain name to be validated * @return Resource Record name (e.g. * {@code _ujmmovf2vn55tgye._acme-challenge.example.org.}, note the trailing full stop * character). */ public String getRRName(String domain) { return getPrefix(getLogin().getAccount().getLocation()) + '.' + domain + '.'; } /** * Returns the digest string to be set in the domain's TXT record. */ public String getDigest() { return base64UrlEncode(sha256hash(getAuthorization())); } /** * Returns the prefix of an account location. */ private String getPrefix(URL accountLocation) { var urlHash = sha256hash(accountLocation.toExternalForm()); var hash = base32Encode(Arrays.copyOfRange(urlHash, 0, 10)); return "_" + hash.toLowerCase(Locale.ENGLISH) + "._acme-challenge"; } @Override protected boolean acceptable(String type) { return TYPE.equals(type); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/DnsPersist01Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2026 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static java.util.Objects.requireNonNull; import java.io.Serial; import java.net.URISyntaxException; import java.net.URL; import java.time.Instant; import java.util.ArrayList; import java.util.Collections; import java.util.List; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON; /** * Implements the {@value TYPE} challenge. It requires a specific DNS record for domain * validation. See the acme4j documentation for a detailed explanation. * * @draft This class is currently based on an RFC draft. It may be changed or removed * without notice to reflect future changes to the draft. SemVer rules do not apply here. * @since 5.0.0 */ public class DnsPersist01Challenge extends Challenge { @Serial private static final long serialVersionUID = 7532514098897449519L; /** * Challenge type name: {@value} */ public static final String TYPE = "dns-persist-01"; protected static final String KEY_ISSUER_DOMAIN_NAMES = "issuer-domain-names"; protected static final String RECORD_NAME_PREFIX = "_validation-persist"; protected static final String KEY_ACCOUNT_URI = "accounturi"; private static final int ISSUER_SIZE_LIMIT = 10; // according to the specs private static final int DOMAIN_LENGTH_LIMIT = 253; // according to the specs private @Nullable List issuerDomainNames; /** * Creates a new generic {@link DnsPersist01Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public DnsPersist01Challenge(Login login, JSON data) { super(login, data); } /** * Returns the list of issuer-domain-names from the CA. The list is guaranteed to * have at least one element. */ public List getIssuerDomainNames() { if (issuerDomainNames == null) { var domainNames = getJSON().get(KEY_ISSUER_DOMAIN_NAMES).asArray().stream() .map(JSON.Value::asString) .map(AcmeUtils::toAce) .toList(); if (domainNames.isEmpty()) { // malform check is mandatory according to the specification throw new AcmeProtocolException("issuer-domain-names missing or empty"); } if (domainNames.size() > ISSUER_SIZE_LIMIT) { // malform check is mandatory according to the specification throw new AcmeProtocolException("issuer-domain-names size limit exceeded: " + domainNames.size() + " > " + ISSUER_SIZE_LIMIT); } if (domainNames.stream().anyMatch(it -> it.endsWith("."))) { throw new AcmeProtocolException("issuer-domain-names must not have trailing dots"); } if (!domainNames.stream().allMatch(it -> it.length() <= DOMAIN_LENGTH_LIMIT)) { throw new AcmeProtocolException("issuer-domain-names content too long"); } issuerDomainNames = domainNames; } return Collections.unmodifiableList(issuerDomainNames); } /** * Converts a domain identifier to the Resource Record name to be used for the DNS TXT * record. * * @param identifier * Domain {@link Identifier} of the domain to be validated * @return Resource Record name (e.g. {@code _validation-persist.www.example.org.}, * note the trailing full stop character). */ public String getRRName(Identifier identifier) { return getRRName(identifier.getDomain()); } /** * Converts a domain identifier to the Resource Record name to be used for the DNS TXT * record. * * @param domain * Domain name to be validated * @return Resource Record name (e.g. {@code _validation-persist.www.example.org.}, * note the trailing full stop character). */ public String getRRName(String domain) { return RECORD_NAME_PREFIX + '.' + AcmeUtils.toAce(domain) + '.'; } /** * Returns a builder for the RDATA value of the DNS TXT record. * * @return Builder for the RDATA */ public Builder buildRData() { return new Builder(getLogin(), getIssuerDomainNames()); } /** * Convenience call to get a standard RDATA without optional tags. * * @return RRDATA */ public String getRData() { return buildRData().build(); } /** * Returns the Account URI that is expected to request the validation. * * @since 5.1.0 */ public URL getAccountUrl() { return getJSON().get(KEY_ACCOUNT_URI).asURL(); } @Override protected void invalidate() { super.invalidate(); issuerDomainNames = null; } @Override protected boolean acceptable(String type) { return TYPE.equals(type); } @Override protected void setJSON(JSON json) { super.setJSON(json); // TODO: In a future release, KEY_ACCOUNT_URI is expected to be mandatory, // and this check will always apply! if (getJSON().contains(KEY_ACCOUNT_URI)) { try { var expectedAccount = getJSON().get(KEY_ACCOUNT_URI).asURI(); var actualAccount = getLogin().getAccount().getLocation().toURI(); if (!actualAccount.equals(expectedAccount)) { throw new AcmeProtocolException("challenge is intended for a different account: " + expectedAccount); } } catch (URISyntaxException ex) { throw new IllegalStateException("Account URL is not an URI?", ex); } } } /** * Builder for RDATA. *

* The following default values are assumed unless overridden by one of the builder * methods: *

*/ public static class Builder { private final Login login; private final List issuerDomainNames; private String issuer; private boolean wildcard = false; private boolean quotes = true; private @Nullable Instant persistUntil = null; private Builder(Login login, List issuerDomainNames) { this.login = login; this.issuerDomainNames = issuerDomainNames; this.issuer = issuerDomainNames.get(0); } /** * Change the issuer domain name. * * @param issuer * Issuer domain name, must be one of * {@link DnsPersist01Challenge#getIssuerDomainNames()}. */ public Builder issuerDomainName(String issuer) { requireNonNull(issuer, "issuer"); if (!issuerDomainNames.contains(issuer)) { throw new IllegalArgumentException("Domain " + issuer + " is not in the list of issuer-domain-names"); } this.issuer = issuer; return this; } /** * Request wildcard validation. */ public Builder wildcard() { wildcard = true; return this; } /** * Instant until this RDATA is valid. The CA must not use this record after that. * * @param instant * Persist until instant */ public Builder persistUntil(Instant instant) { persistUntil = requireNonNull(instant, "instant"); return this; } /** * Do not use quote-enclosed strings. Proper formatting of the resulting RDATA * must be done externally! */ public Builder noQuotes() { quotes = false; return this; } /** * Build the RDATA string for the DNS TXT record. */ public String build() { var parts = new ArrayList(); parts.add(issuer); parts.add("accounturi=" + login.getAccount().getLocation()); if (wildcard) { parts.add("policy=wildcard"); } if (persistUntil != null) { parts.add("persistUntil=" + persistUntil.getEpochSecond()); } if (quotes) { // Quotes inside the parts should be escaped. However, we don't expect // that any part contains qoutes. return '"' + String.join(";\" \" ", parts) + '"'; } else { return String.join("; ", parts); } } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/Http01Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import java.io.Serial; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.toolbox.JSON; /** * Implements the {@value TYPE} challenge. For domain validation, it requires a specific * file that can be retrieved from the domain via HTTP. See the acme4j documentation for a * detailed explanation. */ public class Http01Challenge extends TokenChallenge { @Serial private static final long serialVersionUID = 3322211185872544605L; /** * Challenge type name: {@value} */ public static final String TYPE = "http-01"; /** * Creates a new generic {@link Http01Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public Http01Challenge(Login login, JSON data) { super(login, data); } /** * Returns the token to be used for this challenge. */ @Override public String getToken() { return super.getToken(); } @Override protected boolean acceptable(String type) { return TYPE.equals(type); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/TlsAlpn01Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static org.shredzone.acme4j.toolbox.AcmeUtils.sha256hash; import java.io.IOException; import java.io.Serial; import java.security.KeyPair; import java.security.cert.X509Certificate; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.util.CertificateUtils; /** * Implements the {@value TYPE} challenge. It requires a specific certificate that can be * retrieved from the domain via HTTPS request. See the acme4j documentation for a * detailed explanation. * * @since 2.1 */ public class TlsAlpn01Challenge extends TokenChallenge { @Serial private static final long serialVersionUID = -5590351078176091228L; /** * Challenge type name: {@value} */ public static final String TYPE = "tls-alpn-01"; /** * OID of the {@code acmeValidation} extension. */ public static final String ACME_VALIDATION_OID = "1.3.6.1.5.5.7.1.31"; /** * {@code acme-tls/1} protocol. */ public static final String ACME_TLS_1_PROTOCOL = "acme-tls/1"; /** * Creates a new generic {@link TlsAlpn01Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public TlsAlpn01Challenge(Login login, JSON data) { super(login, data); } /** * Returns the value that is to be used as {@code acmeValidation} extension in * the test certificate. */ public byte[] getAcmeValidation() { return sha256hash(getAuthorization()); } /** * Creates a self-signed {@link X509Certificate} for this challenge. The certificate * is valid for 7 days. * * @param keypair * A domain {@link KeyPair} to be used for the challenge * @param id * The {@link Identifier} that is to be validated * @return Created certificate * @since 3.0.0 */ public X509Certificate createCertificate(KeyPair keypair, Identifier id) { try { return CertificateUtils.createTlsAlpn01Certificate(keypair, id, getAcmeValidation()); } catch (IOException ex) { throw new IllegalArgumentException("Bad certificate parameters", ex); } } @Override protected boolean acceptable(String type) { return TYPE.equals(type); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/TokenChallenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static org.shredzone.acme4j.toolbox.AcmeUtils.base64UrlEncode; import java.io.Serial; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JoseUtils; /** * A generic extension of {@link Challenge} that handles challenges with a {@code token} * and {@code keyAuthorization}. */ public class TokenChallenge extends Challenge { @Serial private static final long serialVersionUID = 1634133407432681800L; protected static final String KEY_TOKEN = "token"; /** * Creates a new generic {@link TokenChallenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public TokenChallenge(Login login, JSON data) { super(login, data); } /** * Gets the token. */ protected String getToken() { var token = getJSON().get(KEY_TOKEN).asString(); if (!AcmeUtils.isValidBase64Url(token)) { throw new AcmeProtocolException("Invalid token: " + token); } return token; } /** * Computes the key authorization for the given token. *

* The default is {@code token + '.' + base64url(jwkThumbprint)}. Subclasses may * override this method if a different algorithm is used. * * @param token * Token to be used * @return Key Authorization string for that token * @since 2.12 */ protected String keyAuthorizationFor(String token) { var pk = getLogin().getPublicKey(); return token + '.' + base64UrlEncode(JoseUtils.thumbprint(pk)); } /** * Returns the authorization string. *

* The default uses {@link #keyAuthorizationFor(String)} to compute the key * authorization of {@link #getToken()}. Subclasses may override this method if a * different algorithm is used. */ public String getAuthorization() { return keyAuthorizationFor(getToken()); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/challenge/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains all standard challenges, as well as base classes for challenges * that are proprietary to a CA. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.challenge; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/Connection.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import java.net.URL; import java.security.KeyPair; import java.security.cert.X509Certificate; import java.time.Instant; import java.time.ZonedDateTime; import java.util.Collection; import java.util.List; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Connects to the ACME server and offers different methods for invoking the API. *

* The actual way of communicating with the ACME server is intentionally left open. * Implementations could use other means than HTTP, or could mock the communication for * unit testing. */ public interface Connection extends AutoCloseable { /** * Resets the session nonce, by fetching a new one. * * @param session * {@link Session} instance to fetch a nonce for */ void resetNonce(Session session) throws AcmeException; /** * Sends a simple GET request. *

* If the response code was not HTTP status 200, an {@link AcmeException} matching * the error is raised. * * @param url * {@link URL} to send the request to. * @param session * {@link Session} instance to be used for tracking * @param ifModifiedSince * {@link ZonedDateTime} to be sent as "If-Modified-Since" header, or * {@code null} if this header is not to be used * @return HTTP status that was returned */ int sendRequest(URL url, Session session, @Nullable ZonedDateTime ifModifiedSince) throws AcmeException; /** * Sends a signed POST-as-GET request for a certificate resource. Requires a * {@link Login} for the session and {@link KeyPair}. The {@link Login} account * location is sent in a "kid" protected header. *

* If the server does not return a 200 class status code, an {@link AcmeException} is * raised matching the error. * * @param url * {@link URL} to send the request to. * @param login * {@link Login} instance to be used for signing and tracking. * @return HTTP 200 class status that was returned */ int sendCertificateRequest(URL url, Login login) throws AcmeException; /** * Sends a signed POST-as-GET request. Requires a {@link Login} for the session and * {@link KeyPair}. The {@link Login} account location is sent in a "kid" protected * header. *

* If the server does not return a 200 class status code, an {@link AcmeException} is * raised matching the error. * * @param url * {@link URL} to send the request to. * @param login * {@link Login} instance to be used for signing and tracking. * @return HTTP 200 class status that was returned */ int sendSignedPostAsGetRequest(URL url, Login login) throws AcmeException; /** * Sends a signed POST request. Requires a {@link Login} for the session and * {@link KeyPair}. The {@link Login} account location is sent in a "kid" protected * header. *

* If the server does not return a 200 class status code, an {@link AcmeException} is * raised matching the error. * * @param url * {@link URL} to send the request to. * @param claims * {@link JSONBuilder} containing claims. * @param login * {@link Login} instance to be used for signing and tracking. * @return HTTP 200 class status that was returned */ int sendSignedRequest(URL url, JSONBuilder claims, Login login) throws AcmeException; /** * Sends a signed POST request. Only requires a {@link Session}. *

* If the server does not return a 200 class status code, an {@link AcmeException} is * raised matching the error. * * @param url * {@link URL} to send the request to. * @param claims * {@link JSONBuilder} containing claims. * @param session * {@link Session} instance to be used for tracking. * @param signer * {@link RequestSigner} to sign the request with * @return HTTP 200 class status that was returned * @since 5.0.0 */ int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) throws AcmeException; /** * Reads a server response as JSON object. * * @return The JSON response. */ JSON readJsonResponse() throws AcmeException; /** * Reads a certificate and its chain of issuers. * * @return List of X.509 certificate and chain that was read. */ List readCertificates() throws AcmeException; /** * Returns the Retry-After header if present. * * @since 3.0.0 */ Optional getRetryAfter(); /** * Gets the nonce from the nonce header. * * @return Base64 encoded nonce, or empty if no nonce header was set */ Optional getNonce(); /** * Gets a location from the {@code Location} header. *

* Relative links are resolved against the last request's URL. * * @return Location {@link URL} * @throws org.shredzone.acme4j.exception.AcmeProtocolException if the location * header is missing */ URL getLocation(); /** * Returns the content of the last-modified header, if present. * * @return Date in the Last-Modified header, or empty if the server did not provide * this information. * @since 2.10 */ Optional getLastModified(); /** * Returns the expiration date of the resource, if present. * * @return Expiration date, either from the Cache-Control or Expires header. If empty, * the server did not provide an expiration date, or forbid caching. * @since 2.10 */ Optional getExpiration(); /** * Gets one or more relation links from the header. The result is expected to be a * URL. *

* Relative links are resolved against the last request's URL. * * @param relation * Link relation * @return Collection of links. Empty if there was no such relation. */ Collection getLinks(String relation); /** * Closes the {@link Connection}, releasing all resources. */ @Override void close(); } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/DefaultConnection.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static java.time.format.DateTimeFormatter.RFC_1123_DATE_TIME; import static java.util.function.Predicate.not; import java.io.IOException; import java.io.InputStream; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.time.Instant; import java.time.ZoneId; import java.time.ZonedDateTime; import java.time.format.DateTimeParseException; import java.util.Collection; import java.util.List; import java.util.Objects; import java.util.Optional; import java.util.Set; import java.util.function.Consumer; import java.util.regex.Matcher; import java.util.regex.Pattern; import java.util.zip.GZIPInputStream; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Problem; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNetworkException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.exception.AcmeRateLimitedException; import org.shredzone.acme4j.exception.AcmeServerException; import org.shredzone.acme4j.exception.AcmeUnauthorizedException; import org.shredzone.acme4j.exception.AcmeUserActionRequiredException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * Default implementation of {@link Connection}. It communicates with the ACME server via * HTTP, with a client that is provided by the given {@link HttpConnector}. */ public class DefaultConnection implements Connection { private static final Logger LOG = LoggerFactory.getLogger(DefaultConnection.class); private static final int HTTP_OK = 200; private static final int HTTP_CREATED = 201; private static final int HTTP_NO_CONTENT = 204; private static final int HTTP_NOT_MODIFIED = 304; private static final String ACCEPT_HEADER = "Accept"; private static final String ACCEPT_CHARSET_HEADER = "Accept-Charset"; private static final String ACCEPT_LANGUAGE_HEADER = "Accept-Language"; private static final String ACCEPT_ENCODING_HEADER = "Accept-Encoding"; private static final String CACHE_CONTROL_HEADER = "Cache-Control"; private static final String CONTENT_TYPE_HEADER = "Content-Type"; private static final String DATE_HEADER = "Date"; private static final String EXPIRES_HEADER = "Expires"; private static final String IF_MODIFIED_SINCE_HEADER = "If-Modified-Since"; private static final String LAST_MODIFIED_HEADER = "Last-Modified"; private static final String LINK_HEADER = "Link"; private static final String LOCATION_HEADER = "Location"; private static final String REPLAY_NONCE_HEADER = "Replay-Nonce"; private static final String RETRY_AFTER_HEADER = "Retry-After"; private static final String DEFAULT_CHARSET = "utf-8"; private static final String MIME_JSON = "application/json"; private static final String MIME_JSON_PROBLEM = "application/problem+json"; private static final String MIME_CERTIFICATE_CHAIN = "application/pem-certificate-chain"; private static final URI BAD_NONCE_ERROR = URI.create("urn:ietf:params:acme:error:badNonce"); private static final int MAX_ATTEMPTS = 10; private static final Pattern NO_CACHE_PATTERN = Pattern.compile("(?:^|.*?,)\\s*no-(?:cache|store)\\s*(?:,.*|$)", Pattern.CASE_INSENSITIVE); private static final Pattern MAX_AGE_PATTERN = Pattern.compile("(?:^|.*?,)\\s*max-age=(\\d+)\\s*(?:,.*|$)", Pattern.CASE_INSENSITIVE); private static final Pattern DIGITS_ONLY_PATTERN = Pattern.compile("^\\d+$"); protected final HttpConnector httpConnector; protected final HttpClient httpClient; protected @Nullable HttpResponse lastResponse; /** * Creates a new {@link DefaultConnection}. * * @param httpConnector * {@link HttpConnector} to be used for HTTP connections */ public DefaultConnection(HttpConnector httpConnector) { this.httpConnector = Objects.requireNonNull(httpConnector, "httpConnector"); this.httpClient = httpConnector.getHttpClient(); } @Override public void resetNonce(Session session) throws AcmeException { assertConnectionIsClosed(); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(null); var newNonceUrl = session.resourceUrl(Resource.NEW_NONCE); LOG.debug("HEAD {}", newNonceUrl); sendRequest(session, newNonceUrl, b -> b.method("HEAD", HttpRequest.BodyPublishers.noBody())); logHeaders(); var rc = getResponse().statusCode(); if (rc != HTTP_OK && rc != HTTP_NO_CONTENT) { throw new AcmeException("Server responded with HTTP " + rc + " while trying to retrieve a nonce"); } nonceHolder.setNonce(getNonce() .orElseThrow(() -> new AcmeProtocolException("Server did not provide a nonce")) ); } catch (IOException ex) { throw new AcmeNetworkException(ex); } finally { close(); } } @Override public int sendRequest(URL url, Session session, @Nullable ZonedDateTime ifModifiedSince) throws AcmeException { Objects.requireNonNull(url, "url"); Objects.requireNonNull(session, "session"); assertConnectionIsClosed(); LOG.debug("GET {}", url); try (var nonceHolder = session.lockNonce()) { sendRequest(session, url, builder -> { builder.GET(); builder.header(ACCEPT_HEADER, MIME_JSON); if (ifModifiedSince != null) { builder.header(IF_MODIFIED_SINCE_HEADER, ifModifiedSince.format(RFC_1123_DATE_TIME)); } }); logHeaders(); getNonce().ifPresent(nonceHolder::setNonce); var rc = getResponse().statusCode(); if (rc != HTTP_OK && rc != HTTP_CREATED && (rc != HTTP_NOT_MODIFIED || ifModifiedSince == null)) { throwAcmeException(); } return rc; } catch (IOException ex) { throw new AcmeNetworkException(ex); } } @Override public int sendCertificateRequest(URL url, Login login) throws AcmeException { return sendSignedRequest(url, null, login.getSession(), MIME_CERTIFICATE_CHAIN, login::createJoseRequest); } @Override public int sendSignedPostAsGetRequest(URL url, Login login) throws AcmeException { return sendSignedRequest(url, null, login.getSession(), MIME_JSON, login::createJoseRequest); } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) throws AcmeException { return sendSignedRequest(url, claims, login.getSession(), MIME_JSON, login::createJoseRequest); } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) throws AcmeException { return sendSignedRequest(url, claims, session, MIME_JSON, signer); } @Override public JSON readJsonResponse() throws AcmeException { expectContentType(Set.of(MIME_JSON, MIME_JSON_PROBLEM)); try (var in = getResponseBody()) { var result = JSON.parse(in); LOG.debug("Result JSON: {}", result); return result; } catch (IOException ex) { throw new AcmeNetworkException(ex); } } @Override public List readCertificates() throws AcmeException { expectContentType(Set.of(MIME_CERTIFICATE_CHAIN)); try (var in = new TrimmingInputStream(getResponseBody())) { var cf = CertificateFactory.getInstance("X.509"); return cf.generateCertificates(in).stream() .map(X509Certificate.class::cast) .toList(); } catch (IOException ex) { throw new AcmeNetworkException(ex); } catch (CertificateException ex) { throw new AcmeProtocolException("Failed to read certificate", ex); } } @Override public Optional getNonce() { var nonceHeaderOpt = getResponse().headers() .firstValue(REPLAY_NONCE_HEADER) .map(String::trim) .filter(not(String::isEmpty)); if (nonceHeaderOpt.isPresent()) { var nonceHeader = nonceHeaderOpt.get(); if (!AcmeUtils.isValidBase64Url(nonceHeader)) { throw new AcmeProtocolException("Invalid replay nonce: " + nonceHeader); } LOG.debug("Replay Nonce: {}", nonceHeader); } return nonceHeaderOpt; } @Override public URL getLocation() { return getResponse().headers() .firstValue(LOCATION_HEADER) .map(l -> { LOG.debug("Location: {}", l); return l; }) .map(this::resolveRelative) .orElseThrow(() -> new AcmeProtocolException("location header is missing")); } @Override public Optional getLastModified() { return getResponse().headers() .firstValue(LAST_MODIFIED_HEADER) .map(lm -> { try { return ZonedDateTime.parse(lm, RFC_1123_DATE_TIME); } catch (DateTimeParseException ex) { LOG.debug("Ignored invalid Last-Modified date: {}", lm, ex); return null; } }); } @Override public Optional getExpiration() { var cacheControlHeader = getResponse().headers() .firstValue(CACHE_CONTROL_HEADER) .filter(not(h -> NO_CACHE_PATTERN.matcher(h).matches())) .map(MAX_AGE_PATTERN::matcher) .filter(Matcher::matches) .map(m -> Integer.parseInt(m.group(1))) .filter(maxAge -> maxAge != 0) .map(maxAge -> ZonedDateTime.now(ZoneId.of("UTC")).plusSeconds(maxAge)); if (cacheControlHeader.isPresent()) { return cacheControlHeader; } return getResponse().headers() .firstValue(EXPIRES_HEADER) .flatMap(header -> { try { return Optional.of(ZonedDateTime.parse(header, RFC_1123_DATE_TIME)); } catch (DateTimeParseException ex) { LOG.debug("Ignored invalid Expires date: {}", header, ex); return Optional.empty(); } }); } @Override public Collection getLinks(String relation) { return collectLinks(relation).stream() .map(this::resolveRelative) .toList(); } @Override public void close() { lastResponse = null; } /** * Sends a HTTP request via http client. This is the central method to be used for * sending. It will create a {@link HttpRequest} by using the request builder, * configure commnon headers, and then send the request via {@link HttpClient}. * * @param session * {@link Session} to be used for sending * @param url * Target {@link URL} * @param body * Callback that completes the {@link HttpRequest.Builder} with the request * body (e.g. HTTP method, request body, more headers). */ protected void sendRequest(Session session, URL url, Consumer body) throws IOException { try { var builder = httpConnector.createRequestBuilder(url) .header(ACCEPT_CHARSET_HEADER, DEFAULT_CHARSET) .header(ACCEPT_LANGUAGE_HEADER, session.getLanguageHeader()); if (session.networkSettings().isCompressionEnabled()) { builder.header(ACCEPT_ENCODING_HEADER, "gzip"); } body.accept(builder); lastResponse = httpClient.send(builder.build(), HttpResponse.BodyHandlers.ofInputStream()); } catch (InterruptedException ex) { throw new IOException("Request was interrupted", ex); } } /** * Sends a signed POST request. * * @param url * {@link URL} to send the request to. * @param claims * {@link JSONBuilder} containing claims. {@code null} for POST-as-GET * request. * @param accept * Accept header * @return HTTP 200 class status that was returned */ protected int sendSignedRequest(URL url, @Nullable JSONBuilder claims, Session session, String accept, RequestSigner signer) throws AcmeException { Objects.requireNonNull(url, "url"); Objects.requireNonNull(session, "session"); Objects.requireNonNull(accept, "accept"); Objects.requireNonNull(signer, "signer"); assertConnectionIsClosed(); var attempt = 1; while (true) { try { return performRequest(url, claims, session, accept, signer); } catch (AcmeServerException ex) { if (!BAD_NONCE_ERROR.equals(ex.getType())) { throw ex; } if (attempt == MAX_ATTEMPTS) { throw ex; } LOG.info("Bad Replay Nonce, trying again (attempt {}/{})", attempt, MAX_ATTEMPTS); attempt++; } } } /** * Performs the POST request. * * @param url * {@link URL} to send the request to. * @param claims * {@link JSONBuilder} containing claims. {@code null} for POST-as-GET * request. * @param accept * Accept header * @return HTTP 200 class status that was returned */ private int performRequest(URL url, @Nullable JSONBuilder claims, Session session, String accept, RequestSigner signer) throws AcmeException { try (var nonceHolder = session.lockNonce()) { if (nonceHolder.getNonce() == null) { resetNonce(session); } var jose = signer.createRequest(url, claims, nonceHolder.getNonce()); var outputData = jose.toString(); sendRequest(session, url, builder -> { builder.POST(HttpRequest.BodyPublishers.ofString(outputData)); builder.header(ACCEPT_HEADER, accept); builder.header(CONTENT_TYPE_HEADER, "application/jose+json"); }); logHeaders(); nonceHolder.setNonce(getNonce().orElse(null)); var rc = getResponse().statusCode(); if (rc != HTTP_OK && rc != HTTP_CREATED) { throwAcmeException(); } return rc; } catch (IOException ex) { throw new AcmeNetworkException(ex); } } @Override public Optional getRetryAfter() { return getResponse().headers() .firstValue(RETRY_AFTER_HEADER) .map(this::parseRetryAfterHeader); } /** * Parses the content of a Retry-After header. The header can either contain a * relative or an absolute time. * * @param header * Retry-After header * @return Instant given in the header * @throws AcmeProtocolException * if the header content is invalid */ private Instant parseRetryAfterHeader(String header) { // See RFC 2616 section 14.37 try { // delta-seconds if (DIGITS_ONLY_PATTERN.matcher(header).matches()) { var delta = Integer.parseInt(header); var date = getResponse().headers().firstValue(DATE_HEADER) .map(d -> ZonedDateTime.parse(d, RFC_1123_DATE_TIME).toInstant()) .orElseGet(Instant::now); return date.plusSeconds(delta); } // HTTP-date return ZonedDateTime.parse(header, RFC_1123_DATE_TIME).toInstant(); } catch (RuntimeException ex) { throw new AcmeProtocolException("Bad retry-after header value: " + header, ex); } } /** * Provides an {@link InputStream} of the response body. If the stream is compressed, * it will also take care for decompression. */ private InputStream getResponseBody() throws IOException { var stream = getResponse().body(); if (stream == null) { throw new AcmeProtocolException("Unexpected empty response"); } if (getResponse().headers().firstValue("Content-Encoding") .filter("gzip"::equalsIgnoreCase) .isPresent()) { stream = new GZIPInputStream(stream); } return stream; } /** * Throws an {@link AcmeException}. This method throws an exception that tries to * explain the error as precisely as possible. */ private void throwAcmeException() throws AcmeException { try { if (getResponse().headers().firstValue(CONTENT_TYPE_HEADER) .map(AcmeUtils::getContentType) .filter(MIME_JSON_PROBLEM::equals) .isEmpty()) { // Generic HTTP error throw new AcmeException("HTTP " + getResponse().statusCode()); } var problem = new Problem(readJsonResponse(), getResponse().request().uri().toURL()); var error = AcmeUtils.stripErrorPrefix(problem.getType().toString()); if ("unauthorized".equals(error)) { throw new AcmeUnauthorizedException(problem); } if ("userActionRequired".equals(error)) { var tos = collectLinks("terms-of-service").stream() .findFirst() .map(this::resolveUri) .orElse(null); throw new AcmeUserActionRequiredException(problem, tos); } if ("rateLimited".equals(error)) { var retryAfter = getRetryAfter(); var rateLimits = getLinks("help"); throw new AcmeRateLimitedException(problem, retryAfter.orElse(null), rateLimits); } throw new AcmeServerException(problem); } catch (IOException ex) { throw new AcmeNetworkException(ex); } } /** * Checks if the returned content type is in the list of expected types. * * @param expectedTypes * content types that are accepted * @throws AcmeProtocolException * if the returned content type is different */ private void expectContentType(Set expectedTypes) { var contentType = getResponse().headers() .firstValue(CONTENT_TYPE_HEADER) .map(AcmeUtils::getContentType) .orElseThrow(() -> new AcmeProtocolException("No content type header found")); if (!expectedTypes.contains(contentType)) { throw new AcmeProtocolException("Unexpected content type: " + contentType); } } /** * Returns the response of the last request. If there is no connection currently * open, an exception is thrown instead. *

* Note that the response provides an {@link InputStream} that can be read only * once. */ private HttpResponse getResponse() { if (lastResponse == null) { throw new IllegalStateException("Not connected."); } return lastResponse; } /** * Asserts that the connection is currently closed. Throws an exception if not. */ private void assertConnectionIsClosed() { if (lastResponse != null) { throw new IllegalStateException("Previous connection is not closed."); } } /** * Log all HTTP headers in debug mode. */ private void logHeaders() { if (!LOG.isDebugEnabled()) { return; } getResponse().headers().map().forEach((key, headers) -> headers.forEach(value -> LOG.debug("HEADER {}: {}", key, value) ) ); } /** * Collects links of the given relation. * * @param relation * Link relation * @return Collection of links, unconverted */ private Collection collectLinks(String relation) { var p = Pattern.compile("<([^>]+)>\\s*;[^<]*?\\brel=\"?" + Pattern.quote(relation) + "\"?(?:[\\s,;]|$)"); return getResponse().headers().allValues(LINK_HEADER) .stream() .map(p::matcher) .flatMap(Matcher::results) .map(m -> m.group(1)) .peek(location -> LOG.debug("Link: {} -> {}", relation, location)) .toList(); } /** * Resolves a relative link against the connection's last URL. * * @param link * Link to resolve. Absolute links are just converted to an URL. * @return Absolute URL of the given link */ private URL resolveRelative(String link) { try { return resolveUri(link).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException("Cannot resolve relative link: " + link, ex); } } /** * Resolves a relative URI against the connection's last URL. * * @param uri * URI to resolve * @return Absolute URI of the given link */ private URI resolveUri(String uri) { return getResponse().request().uri().resolve(uri); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/HttpConnector.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import java.net.URISyntaxException; import java.net.URL; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.util.Properties; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.slf4j.LoggerFactory; /** * A generic HTTP connector. It creates {@link HttpRequest.Builder} that can be * individually customized according to the user's needs. * * @since 3.0.0 */ public class HttpConnector { private static final String USER_AGENT; private final NetworkSettings networkSettings; private final HttpClient httpClient; static { var agent = new StringBuilder("acme4j"); try (var in = HttpConnector.class.getResourceAsStream("/org/shredzone/acme4j/version.properties")) { var prop = new Properties(); prop.load(in); agent.append('/').append(prop.getProperty("version")); } catch (Exception ex) { // Ignore, just don't use a version LoggerFactory.getLogger(HttpConnector.class).warn("Could not read library version", ex); } agent.append(" Java/").append(System.getProperty("java.version")); USER_AGENT = agent.toString(); } /** * Returns the default User-Agent to be used. * * @return User-Agent */ public static String defaultUserAgent() { return USER_AGENT; } /** * Creates a new {@link HttpConnector} that is using the given * {@link NetworkSettings} and {@link HttpClient}. * * @param networkSettings Network settings to use * @param httpClient HTTP client to use for requests * @since 4.0.0 */ @SuppressFBWarnings("EI_EXPOSE_REP2") // behavior is intended public HttpConnector(NetworkSettings networkSettings, HttpClient httpClient) { this.networkSettings = networkSettings; this.httpClient = httpClient; } /** * Creates a new {@link HttpRequest.Builder} that is preconfigured and bound to the * given URL. Subclasses can override this method to extend the configuration, or * create a different builder. * * @param url * {@link URL} to connect to * @return {@link HttpRequest.Builder} connected to the {@link URL} */ public HttpRequest.Builder createRequestBuilder(URL url) { try { return HttpRequest.newBuilder(url.toURI()) .header("User-Agent", USER_AGENT) .timeout(networkSettings.getTimeout()); } catch (URISyntaxException ex) { throw new IllegalArgumentException("Invalid URL", ex); } } /** * Returns the {@link HttpClient} instance used by this connector. * * @return {@link HttpClient} instance * @since 4.0.0 */ public HttpClient getHttpClient() { return httpClient; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/NetworkSettings.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2019 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import java.net.Authenticator; import java.net.ProxySelector; import java.net.http.HttpClient; import java.time.Duration; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.slf4j.LoggerFactory; /** * Contains network settings to be used for network connections. * * @since 2.8 */ public class NetworkSettings { /** * Name of the system property to control GZIP compression. Expects a boolean value. */ public static final String GZIP_PROPERTY_NAME = "org.shredzone.acme4j.gzip_compression"; private ProxySelector proxySelector = HttpClient.Builder.NO_PROXY; private Duration timeout = Duration.ofSeconds(30); private @Nullable Authenticator authenticator = null; private boolean compression = true; public NetworkSettings() { try { Optional.ofNullable(System.getProperty(GZIP_PROPERTY_NAME)) .map(Boolean::parseBoolean) .ifPresent(val -> compression = val); } catch (Exception ex) { // Ignore a broken property name or a SecurityException LoggerFactory.getLogger(NetworkSettings.class) .warn("Could not read system property: {}", GZIP_PROPERTY_NAME, ex); } } /** * Gets the {@link ProxySelector} to be used for connections. * * @since 3.0.0 */ public ProxySelector getProxySelector() { return proxySelector; } /** * Sets a {@link ProxySelector} that is to be used for all connections. If * {@code null}, {@link HttpClient.Builder#NO_PROXY} is used, which is also the * default. * * @since 3.0.0 */ public void setProxySelector(@Nullable ProxySelector proxySelector) { this.proxySelector = proxySelector != null ? proxySelector : HttpClient.Builder.NO_PROXY; } /** * Gets the {@link Authenticator} to be used, or {@code null} if none is to be set. * * @since 3.0.0 */ public @Nullable Authenticator getAuthenticator() { return authenticator; } /** * Sets an {@link Authenticator} to be used if HTTP authentication is needed (e.g. * by a proxy). {@code null} means that no authenticator shall be set. * * @since 3.0.0 */ public void setAuthenticator(@Nullable Authenticator authenticator) { this.authenticator = authenticator; } /** * Gets the current network timeout. */ public Duration getTimeout() { return timeout; } /** * Sets the network timeout to be used for connections. Defaults to 10 seconds. * * @param timeout * Network timeout {@link Duration} */ public void setTimeout(Duration timeout) { if (timeout == null || timeout.isNegative() || timeout.isZero()) { throw new IllegalArgumentException("Timeout must be positive"); } this.timeout = timeout; } /** * Checks if HTTP compression is enabled. * * @since 3.0.0 */ public boolean isCompressionEnabled() { return compression; } /** * Sets if HTTP compression is enabled. It is enabled by default, but can be * disabled e.g. for debugging purposes. *

* acme4j gzip compression can also be controlled via the {@value #GZIP_PROPERTY_NAME} * system property. * * @since 3.0.0 */ public void setCompressionEnabled(boolean compression) { this.compression = compression; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/NonceHolder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2026 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import edu.umd.cs.findbugs.annotations.Nullable; /** * Keeps the current nonce for a request. Make sure that the {@link #close()} method is * always invoked, otherwise the related {@link org.shredzone.acme4j.Session} will be * blocked. *

* This object is for internal use only. * * @since 4.0.0 */ public interface NonceHolder extends AutoCloseable { /** * Gets the last base64 encoded nonce, or {@code null} if the session is new. */ @Nullable String getNonce(); /** * Sets the base64 encoded nonce received by the server. */ void setNonce(@Nullable String nonce); /** * Closes the NonceHolder. Must be invoked! */ void close(); } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/RequestSigner.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2026 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import java.net.URL; import java.security.KeyPair; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Function for assembling and signing an ACME JOSE request. * * @since 5.0.0 */ @FunctionalInterface public interface RequestSigner { /** * Creates an ACME JOSE request. *

* Implementors can use * {@link org.shredzone.acme4j.toolbox.JoseUtils#createJoseRequest(URL, KeyPair, * JSONBuilder, String, String)} without giving the signing {@link KeyPair} out of * their control. * * @param url * {@link URL} of the ACME call * @param payload * ACME JSON payload. If {@code null}, a POST-as-GET request is generated * instead. * @param nonce * Nonce to be used. {@code null} if no nonce is to be used in the JOSE * header. * @return JSON structure of the JOSE request, ready to be sent. * @see org.shredzone.acme4j.toolbox.JoseUtils#createJoseRequest(URL, KeyPair, * JSONBuilder, String, String) */ JSONBuilder createRequest(URL url, @Nullable JSONBuilder payload, @Nullable String nonce); } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/Resource.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; /** * Enumeration of standard resources, and their key name in the CA's directory. */ public enum Resource { NEW_NONCE("newNonce"), NEW_ACCOUNT("newAccount"), NEW_ORDER("newOrder"), NEW_AUTHZ("newAuthz"), REVOKE_CERT("revokeCert"), KEY_CHANGE("keyChange"), RENEWAL_INFO("renewalInfo"); private final String path; Resource(String path) { this.path = path; } /** * Returns the key name in the directory. * * @return key name */ public String path() { return path; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/ResourceIterator.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static java.util.Objects.requireNonNull; import java.net.URL; import java.util.ArrayDeque; import java.util.Deque; import java.util.Iterator; import java.util.NoSuchElementException; import java.util.function.BiFunction; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.AcmeResource; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; /** * An {@link Iterator} that fetches a batch of URLs from the ACME server, and generates * {@link AcmeResource} instances. * * @param * {@link AcmeResource} type to iterate over */ public class ResourceIterator implements Iterator { private final Login login; private final String field; private final Deque urlList = new ArrayDeque<>(); private final BiFunction creator; private boolean eol = false; private @Nullable URL nextUrl; /** * Creates a new {@link ResourceIterator}. * * @param login * {@link Login} to bind this iterator to * @param field * Field name to be used in the JSON response * @param start * URL of the first JSON array, may be {@code null} for an empty iterator * @param creator * Creator for an {@link AcmeResource} that is bound to the given * {@link Login} and {@link URL}. */ public ResourceIterator(Login login, String field, @Nullable URL start, BiFunction creator) { this.login = requireNonNull(login, "login"); this.field = requireNonNull(field, "field"); this.nextUrl = start; this.creator = requireNonNull(creator, "creator"); } /** * Checks if there is another object in the result. * * @throws AcmeProtocolException * if the next batch of URLs could not be fetched from the server */ @Override public boolean hasNext() { if (eol) { return false; } if (urlList.isEmpty()) { fetch(); } if (urlList.isEmpty()) { eol = true; } return !urlList.isEmpty(); } /** * Returns the next object of the result. * * @throws AcmeProtocolException * if the next batch of URLs could not be fetched from the server * @throws NoSuchElementException * if there are no more entries */ @Override public T next() { if (!eol && urlList.isEmpty()) { fetch(); } var next = urlList.poll(); if (next == null) { eol = true; throw new NoSuchElementException("no more " + field); } return creator.apply(login, next); } /** * Unsupported operation, only here to satisfy the {@link Iterator} interface. */ @Override public void remove() { throw new UnsupportedOperationException("cannot remove " + field); } /** * Fetches the next batch of URLs. Handles exceptions. Does nothing if there is no * URL of the next batch. */ private void fetch() { if (nextUrl == null) { return; } try { readAndQueue(); } catch (AcmeException ex) { throw new AcmeProtocolException("failed to read next set of " + field, ex); } } /** * Reads the next batch of URLs from the server, and fills the queue with the URLs. If * there is a "next" header, it is used for the next batch of URLs. */ private void readAndQueue() throws AcmeException { var session = login.getSession(); try (var conn = session.connect()) { conn.sendSignedPostAsGetRequest(requireNonNull(nextUrl), login); fillUrlList(conn.readJsonResponse()); nextUrl = conn.getLinks("next").stream().findFirst().orElse(null); } } /** * Fills the url list with the URLs found in the desired field. * * @param json * JSON map to read from */ private void fillUrlList(JSON json) { json.get(field).asArray().stream() .map(JSON.Value::asURL) .forEach(urlList::add); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/TrimmingInputStream.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import java.io.BufferedInputStream; import java.io.IOException; import java.io.InputStream; /** * Normalizes line separators in an InputStream. Converts all line separators to '\n'. * Multiple line separators are compressed to a single line separator. Leading line * separators are removed. Trailing line separators are compressed to a single separator. */ public class TrimmingInputStream extends InputStream { private final BufferedInputStream in; private boolean startOfFile = true; /** * Creates a new {@link TrimmingInputStream}. * * @param in * {@link InputStream} to read from. Will be closed when this stream is * closed. */ public TrimmingInputStream(InputStream in) { this.in = new BufferedInputStream(in, 1024); } @Override public int read() throws IOException { var ch = in.read(); if (!isLineSeparator(ch)) { startOfFile = false; return ch; } in.mark(1); ch = in.read(); while (isLineSeparator(ch)) { in.mark(1); ch = in.read(); } if (startOfFile) { startOfFile = false; return ch; } else { in.reset(); return '\n'; } } @Override public int available() throws IOException { // Workaround for https://github.com/google/conscrypt/issues/1068. Conscrypt // requires the stream to have at least one non-blocking byte available for // reading, otherwise generateCertificates() will not read the stream, but // immediately returns an empty list. This workaround pre-fills the buffer // of the BufferedInputStream by reading 1 byte ahead. if (in.available() == 0) { in.mark(1); var read = in.read(); in.reset(); if (read < 0) { return 0; } } return in.available(); } @Override public void close() throws IOException { in.close(); super.close(); } /** * Checks if the character is a line separator. */ private static boolean isLineSeparator(int ch) { return ch == '\n' || ch == '\r'; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/connector/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains internal classes for connection to the CA, and for handling the * requests and responses. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.connector; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; /** * The root class of all checked acme4j exceptions. */ public class AcmeException extends Exception { @Serial private static final long serialVersionUID = -2935088954705632025L; /** * Creates a generic {@link AcmeException}. */ public AcmeException() { super(); } /** * Creates a generic {@link AcmeException}. * * @param msg * Description */ public AcmeException(String msg) { super(msg); } /** * Creates a generic {@link AcmeException}. * * @param msg * Description * @param cause * {@link Throwable} that caused this exception */ public AcmeException(String msg, Throwable cause) { super(msg, cause); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeLazyLoadingException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static java.util.Objects.requireNonNull; import java.io.Serial; import java.net.URL; import org.shredzone.acme4j.AcmeResource; /** * A runtime exception that is thrown when an {@link AcmeException} occured while trying * to lazy-load a resource from the ACME server. It contains the original cause of the * exception and a reference to the resource that could not be lazy-loaded. It is usually * thrown by getter methods, so the API is not polluted with checked exceptions. */ public class AcmeLazyLoadingException extends RuntimeException { @Serial private static final long serialVersionUID = 1000353433913721901L; private final Class type; private final URL location; /** * Creates a new {@link AcmeLazyLoadingException}. * * @param resource * {@link AcmeResource} to be loaded * @param cause * {@link AcmeException} that was raised */ public AcmeLazyLoadingException(AcmeResource resource, AcmeException cause) { this(requireNonNull(resource).getClass(), requireNonNull(resource).getLocation(), cause); } /** * Creates a new {@link AcmeLazyLoadingException}. *

* This constructor is used if there is no actual instance of the resource. * * @param type * {@link AcmeResource} type to be loaded * @param location * Resource location * @param cause * {@link AcmeException} that was raised * @since 2.8 */ public AcmeLazyLoadingException(Class type, URL location, AcmeException cause) { super(requireNonNull(type).getSimpleName() + " " + requireNonNull(location), requireNonNull(cause)); this.type = type; this.location = location; } /** * Returns the {@link AcmeResource} type of the resource that could not be loaded. */ public Class getType() { return type; } /** * Returns the location of the resource that could not be loaded. */ public URL getLocation() { return location; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeNetworkException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.IOException; import java.io.Serial; /** * A general network error has occured while communicating with the server (e.g. network * timeout). */ public class AcmeNetworkException extends AcmeException { @Serial private static final long serialVersionUID = 2054398693543329179L; /** * Create a new {@link AcmeNetworkException}. * * @param cause * {@link IOException} that caused the network error */ public AcmeNetworkException(IOException cause) { super("Network error", cause); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeNotSupportedException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; /** * A runtime exception that is thrown if the ACME server does not support a certain * feature. It might be either because that feature is optional, or because the server * is not fully RFC compliant. */ public class AcmeNotSupportedException extends AcmeProtocolException { @Serial private static final long serialVersionUID = 3434074002226584731L; /** * Creates a new {@link AcmeNotSupportedException}. * * @param feature * Feature that is not supported */ public AcmeNotSupportedException(String feature) { super("Server does not support " + feature); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeProtocolException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; /** * A runtime exception that is thrown when the response of the server is violating the * RFC, and could not be handled or parsed for that reason. It is an indicator that the CA * does not fully comply with the RFC, and is usually not expected to be thrown. */ public class AcmeProtocolException extends RuntimeException { @Serial private static final long serialVersionUID = 2031203835755725193L; /** * Creates a new {@link AcmeProtocolException}. * * @param msg * Reason of the exception */ public AcmeProtocolException(String msg) { super(msg); } /** * Creates a new {@link AcmeProtocolException}. * * @param msg * Reason of the exception * @param cause * Cause */ public AcmeProtocolException(String msg, Throwable cause) { super(msg, cause); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeRateLimitedException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; import java.net.URL; import java.time.Instant; import java.util.Collection; import java.util.Collections; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.Problem; /** * A rate limit was exceeded. If provided by the server, it also includes the earliest * time at which a new attempt will be accepted, and a reference to a document that * further explains the rate limit that was exceeded. */ public class AcmeRateLimitedException extends AcmeServerException { @Serial private static final long serialVersionUID = 4150484059796413069L; private final @Nullable Instant retryAfter; private final Collection documents; /** * Creates a new {@link AcmeRateLimitedException}. * * @param problem * {@link Problem} that caused the exception * @param retryAfter * The instant of time that the request is expected to succeed again, may be * {@code null} if not known * @param documents * URLs pointing to documents about the rate limit that was hit, may be * {@code null} if not known */ public AcmeRateLimitedException(Problem problem, @Nullable Instant retryAfter, @Nullable Collection documents) { super(problem); this.retryAfter = retryAfter; this.documents = documents != null ? documents : Collections.emptyList(); } /** * Returns the instant of time the request is expected to succeed again. Empty * if this moment is not known. */ public Optional getRetryAfter() { return Optional.ofNullable(retryAfter); } /** * Collection of URLs pointing to documents about the rate limit that was hit. * Empty if the server did not provide such URLs. */ public Collection getDocuments() { return Collections.unmodifiableCollection(documents); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeServerException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; import java.net.URI; import java.util.Objects; import org.shredzone.acme4j.Problem; /** * The ACME server returned an error. The exception contains a {@link Problem} document * containing the exact cause of the error. *

* For some special cases, subclasses of this exception are thrown, so they can be handled * individually. */ public class AcmeServerException extends AcmeException { @Serial private static final long serialVersionUID = 5971622508467042792L; private final Problem problem; /** * Creates a new {@link AcmeServerException}. * * @param problem * {@link Problem} that caused the exception */ public AcmeServerException(Problem problem) { super(Objects.requireNonNull(problem).toString()); this.problem = problem; } /** * Returns the error type. */ public URI getType() { return problem.getType(); } /** * Returns the {@link Problem} that caused the exception */ public Problem getProblem() { return problem; } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeUnauthorizedException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; import org.shredzone.acme4j.Problem; /** * The client is not authorized to perform the operation. The {@link Problem} document * will give further details (e.g. "client IP is blocked"). */ public class AcmeUnauthorizedException extends AcmeServerException { @Serial private static final long serialVersionUID = 9064697508262919366L; /** * Creates a new {@link AcmeUnauthorizedException}. * * @param problem * {@link Problem} that caused the exception */ public AcmeUnauthorizedException(Problem problem) { super(problem); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/AcmeUserActionRequiredException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import java.io.Serial; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.Problem; /** * The user is required to take manual action as indicated. *

* Usually this exception is thrown when the terms of service have changed, and the CA * requires an agreement to the new terms before proceeding. */ public class AcmeUserActionRequiredException extends AcmeServerException { @Serial private static final long serialVersionUID = 7719055447283858352L; private final @Nullable URI tosUri; /** * Creates a new {@link AcmeUserActionRequiredException}. * * @param problem * {@link Problem} that caused the exception * @param tosUri * {@link URI} of the terms-of-service document to accept, may be * {@code null} */ public AcmeUserActionRequiredException(Problem problem, @Nullable URI tosUri) { super(problem); this.tosUri = tosUri; } /** * Returns the {@link URI} of the terms-of-service document to accept. Empty * if the server did not provide a link to such a document. */ public Optional getTermsOfServiceUri() { return Optional.ofNullable(tosUri); } /** * Returns the {@link URL} of a document that gives instructions on the actions to be * taken by a human. */ public URL getInstance() { var instance = getProblem().getInstance() .orElseThrow(() -> new AcmeProtocolException("Instance URL required, but missing.")); try { return instance.toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException("Bad instance URL: " + instance, ex); } } @Override public String toString() { return getProblem().getInstance() .map(uri -> "Please visit " + uri + " - details: " + getProblem()) .orElseGet(super::toString); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/exception/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains all exceptions that can be thrown by acme4j. *

* {@link org.shredzone.acme4j.exception.AcmeException} is the root exception, and other * exceptions are derived from it. *

* Some methods that do lazy-loading of remote resources may throw a runtime * {@link org.shredzone.acme4j.exception.AcmeLazyLoadingException} instead, so the API is * not polluted with checked exceptions on every getter. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.exception; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * acme4j is a Java client for the ACME protocol. *

* See the documentation and the example for how to use this client in your own projects. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/AbstractAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import java.net.URI; import java.net.http.HttpClient; import java.time.ZonedDateTime; import java.util.Collections; import java.util.HashMap; import java.util.Map; import java.util.Objects; import java.util.ServiceLoader; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.DnsAccount01Challenge; import org.shredzone.acme4j.challenge.DnsPersist01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.challenge.TlsAlpn01Challenge; import org.shredzone.acme4j.challenge.TokenChallenge; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.connector.DefaultConnection; import org.shredzone.acme4j.connector.HttpConnector; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.JSON; /** * Abstract implementation of {@link AcmeProvider}. It consists of a challenge * registry and a standard {@link HttpConnector}. *

* Implementing classes must implement at least {@link AcmeProvider#accepts(URI)} * and {@link AbstractAcmeProvider#resolve(URI)}. */ public abstract class AbstractAcmeProvider implements AcmeProvider { private static final int HTTP_NOT_MODIFIED = 304; private static final Map CHALLENGES = challengeMap(); @Override public Connection connect(URI serverUri, NetworkSettings networkSettings, HttpClient httpClient) { return new DefaultConnection(createHttpConnector(networkSettings, httpClient)); } @Override public JSON directory(Session session, URI serverUri) throws AcmeException { var expires = session.getDirectoryExpires(); if (expires != null && expires.isAfter(ZonedDateTime.now())) { // The cached directory is still valid return null; } try (var nonceHolder = session.lockNonce(); var conn = connect(serverUri, session.networkSettings(), session.getHttpClient())) { var lastModified = session.getDirectoryLastModified(); var rc = conn.sendRequest(resolve(serverUri), session, lastModified); if (lastModified != null && rc == HTTP_NOT_MODIFIED) { // The server has not been modified since return null; } // evaluate caching headers session.setDirectoryLastModified(conn.getLastModified().orElse(null)); session.setDirectoryExpires(conn.getExpiration().orElse(null)); // use nonce header if there is one, saves a HEAD request... conn.getNonce().ifPresent(nonceHolder::setNonce); return conn.readJsonResponse(); } } private static Map challengeMap() { var map = new HashMap(); map.put(Dns01Challenge.TYPE, Dns01Challenge::new); map.put(DnsAccount01Challenge.TYPE, DnsAccount01Challenge::new); map.put(DnsPersist01Challenge.TYPE, DnsPersist01Challenge::new); map.put(Http01Challenge.TYPE, Http01Challenge::new); map.put(TlsAlpn01Challenge.TYPE, TlsAlpn01Challenge::new); for (var provider : ServiceLoader.load(ChallengeProvider.class)) { var typeAnno = provider.getClass().getAnnotation(ChallengeType.class); if (typeAnno == null) { throw new IllegalStateException("ChallengeProvider " + provider.getClass().getName() + " has no @ChallengeType annotation"); } var type = typeAnno.value(); if (type == null || type.trim().isEmpty()) { throw new IllegalStateException("ChallengeProvider " + provider.getClass().getName() + ": type must not be null or empty"); } if (map.containsKey(type)) { throw new IllegalStateException("ChallengeProvider " + provider.getClass().getName() + ": there is already a provider for challenge type " + type); } map.put(type, provider); } return Collections.unmodifiableMap(map); } /** * {@inheritDoc} *

* This implementation handles the standard challenge types. For unknown types, * generic {@link Challenge} or {@link TokenChallenge} instances are created. *

* Custom provider implementations may override this method to provide challenges that * are proprietary to the provider. */ @Override public Challenge createChallenge(Login login, JSON data) { Objects.requireNonNull(login, "login"); Objects.requireNonNull(data, "data"); var type = data.get("type").asString(); var constructor = CHALLENGES.get(type); if (constructor != null) { return constructor.create(login, data); } if (data.contains("token")) { return new TokenChallenge(login, data); } else { return new Challenge(login, data); } } /** * Creates a {@link HttpConnector} with the given {@link NetworkSettings} and * {@link HttpClient}. *

* Subclasses may override this method to configure the {@link HttpConnector}. * * @param settings The network settings to use * @param httpClient The HTTP client to use * @return A new {@link HttpConnector} instance * @since 4.0.0 */ protected HttpConnector createHttpConnector(NetworkSettings settings, HttpClient httpClient) { return new HttpConnector(settings, httpClient); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/AcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import java.net.URI; import java.net.URL; import java.net.http.HttpClient; import java.util.Optional; import java.util.ServiceLoader; import edu.umd.cs.findbugs.annotations.Nullable; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.JSON; /** * An {@link AcmeProvider} provides methods to be used for communicating with the ACME * server. Implementations handle individual features of each ACME server. *

* Provider implementations must be registered with Java's {@link ServiceLoader}. */ public interface AcmeProvider { /** * Checks if this provider accepts the given server URI. * * @param serverUri * Server URI to test * @return {@code true} if this provider accepts the server URI, {@code false} * otherwise */ boolean accepts(URI serverUri); /** * Resolves the server URI and returns the matching directory URL. * * @param serverUri * Server {@link URI} * @return Resolved directory {@link URL} * @throws IllegalArgumentException * if the server {@link URI} is not accepted */ URL resolve(URI serverUri); /** * Creates an {@link HttpClient} instance configured with the given network settings. *

* The default implementation creates a standard HttpClient with the network settings. * Subclasses can override this method to create a customized HttpClient, for example * to configure SSL context or other provider-specific requirements. * * @param networkSettings The network settings to use * @return {@link HttpClient} instance * @since 4.0.0 */ default HttpClient createHttpClient(NetworkSettings networkSettings) { var builder = HttpClient.newBuilder() .followRedirects(HttpClient.Redirect.NORMAL) .connectTimeout(networkSettings.getTimeout()) .proxy(networkSettings.getProxySelector()); if (networkSettings.getAuthenticator() != null) { builder.authenticator(networkSettings.getAuthenticator()); } return builder.build(); } /** * Creates a {@link Connection} for communication with the ACME server. * * @param serverUri * Server {@link URI} * @param networkSettings * {@link NetworkSettings} to be used for the connection * @param httpClient * {@link HttpClient} to be used for HTTP requests * @return {@link Connection} that was generated * @since 4.0.0 */ Connection connect(URI serverUri, NetworkSettings networkSettings, HttpClient httpClient); /** * Returns the provider's directory. The structure must contain resource URLs, and may * optionally contain metadata. *

* The default implementation resolves the server URI and fetches the directory via * HTTP request. Subclasses may override this method, e.g. if the directory is static. * * @param session * {@link Session} to be used * @param serverUri * Server {@link URI} * @return Directory data, as JSON object, or {@code null} if the directory has not * been changed since the last request. */ @Nullable JSON directory(Session session, URI serverUri) throws AcmeException; /** * Creates a {@link Challenge} instance for the given challenge data. * * @param login * {@link Login} to bind the challenge to * @param data * Challenge {@link JSON} data * @return {@link Challenge} instance, or {@code null} if this provider is unable to * generate a matching {@link Challenge} instance. */ @Nullable Challenge createChallenge(Login login, JSON data); /** * Returns a proposal for the EAB MAC algorithm to be used. Only set if the CA * requires External Account Binding and the MAC algorithm cannot be correctly derived * from the MAC key. Empty otherwise. * * @return Proposed MAC algorithm to be used for EAB, or empty for the default * behavior. * @since 3.5.0 */ default Optional getProposedEabMacAlgorithm() { return Optional.empty(); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/ChallengeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.toolbox.JSON; /** * A provider that creates a Challenge from a matching JSON. * * @since 2.12 */ @FunctionalInterface public interface ChallengeProvider { /** * Creates a Challenge. * * @param login * {@link Login} of the user's account * @param data * {@link JSON} of the challenge as sent by the CA * @return Created and initialized {@link Challenge}. It must match the JSON type. */ Challenge create(Login login, JSON data); } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/ChallengeType.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import java.lang.annotation.Documented; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; import java.lang.annotation.RetentionPolicy; import java.lang.annotation.Target; /** * Annotates the challenge type that is generated by the {@link ChallengeProvider}. * * @since 2.12 */ @Documented @Retention(RetentionPolicy.RUNTIME) @Target(ElementType.TYPE) public @interface ChallengeType { /** * Challenge type. */ String value(); } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/GenericAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; /** * A generic {@link AcmeProvider}. It should be working for all ACME servers complying to * the ACME specifications. *

* The {@code serverUri} is either a http or https URI to the server's directory service. */ public class GenericAcmeProvider extends AbstractAcmeProvider { @Override public boolean accepts(URI serverUri) { return "http".equals(serverUri.getScheme()) || "https".equals(serverUri.getScheme()); } @Override public URL resolve(URI serverUri) { try { return serverUri.toURL(); } catch (MalformedURLException ex) { throw new IllegalArgumentException("Bad generic server URI", ex); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/actalis/ActalisAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.actalis; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.util.Map; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.shredzone.acme4j.provider.AcmeProvider; import org.shredzone.acme4j.toolbox.JSON; /** * An {@link AcmeProvider} for Actalis. *

* The {@code serverUri} is {@code "acme://actalis.com"} for the production server. *

* If you want to use Actalis, always prefer to use this provider. * * @see Actalis S.p.A. * @since 4.0.0 */ public class ActalisAcmeProvider extends AbstractAcmeProvider { private static final String PRODUCTION_DIRECTORY_URL = "https://acme-api.actalis.com/acme/directory"; @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "actalis.com".equals(serverUri.getHost()); } @Override public URL resolve(URI serverUri) { var path = serverUri.getPath(); String directoryUrl; if (path == null || path.isEmpty() || "/".equals(path)) { directoryUrl = PRODUCTION_DIRECTORY_URL; } else { throw new IllegalArgumentException("Unknown URI " + serverUri); } try { return URI.create(directoryUrl).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException(directoryUrl, ex); } } @Override @SuppressWarnings("unchecked") public JSON directory(Session session, URI serverUri) throws AcmeException { // This is a workaround as actalis.com uses "home" instead of "website" to // refer to its homepage in the metadata. var superdirectory = super.directory(session, serverUri); if (superdirectory == null) { return null; } var directory = superdirectory.toMap(); var meta = directory.get("meta"); if (meta instanceof Map) { var metaMap = ((Map) meta); if (metaMap.containsKey("home") && !metaMap.containsKey("website")) { metaMap.put("website", metaMap.remove("home")); } } return JSON.fromMap(directory); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/actalis/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains an {@link org.shredzone.acme4j.provider.AcmeProvider} for the * Actalis server. * * @see Actalis S.p.A. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider.actalis; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/google/GoogleAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.google; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.util.Optional; import org.jose4j.jws.AlgorithmIdentifiers; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.shredzone.acme4j.provider.AcmeProvider; /** * An {@link AcmeProvider} for the Google Trust Services. *

* The {@code serverUri} is {@code "acme://pki.goog"} for the production server, * and {@code "acme://pki.goog/staging"} for the staging server. * * @see https://pki.goog/ * @since 3.5.0 */ public class GoogleAcmeProvider extends AbstractAcmeProvider { private static final String PRODUCTION_DIRECTORY_URL = "https://dv.acme-v02.api.pki.goog/directory"; private static final String STAGING_DIRECTORY_URL = "https://dv.acme-v02.test-api.pki.goog/directory"; @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "pki.goog".equals(serverUri.getHost()); } @Override public URL resolve(URI serverUri) { var path = serverUri.getPath(); String directoryUrl; if (path == null || path.isEmpty() || "/".equals(path)) { directoryUrl = PRODUCTION_DIRECTORY_URL; } else if ("/staging".equals(path)) { directoryUrl = STAGING_DIRECTORY_URL; } else { throw new IllegalArgumentException("Unknown URI " + serverUri); } try { return URI.create(directoryUrl).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException(directoryUrl, ex); } } @Override public Optional getProposedEabMacAlgorithm() { return Optional.of(AlgorithmIdentifiers.HMAC_SHA256); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/google/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains the {@link org.shredzone.acme4j.provider.AcmeProvider} for the * Google Trust Services. * * @see https://pki.goog/ */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider.google; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/letsencrypt/LetsEncryptAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.letsencrypt; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.shredzone.acme4j.provider.AcmeProvider; /** * An {@link AcmeProvider} for Let's Encrypt. *

* The {@code serverUri} is {@code "acme://letsencrypt.org"} for the production server, * and {@code "acme://letsencrypt.org/staging"} for a testing server. *

* If you want to use Let's Encrypt, always prefer to use this provider. * * @see Let's Encrypt */ public class LetsEncryptAcmeProvider extends AbstractAcmeProvider { private static final String V02_DIRECTORY_URL = "https://acme-v02.api.letsencrypt.org/directory"; private static final String STAGING_DIRECTORY_URL = "https://acme-staging-v02.api.letsencrypt.org/directory"; @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "letsencrypt.org".equals(serverUri.getHost()); } @Override public URL resolve(URI serverUri) { var path = serverUri.getPath(); String directoryUrl; if (path == null || path.isEmpty() || "/".equals(path) || "/v02".equals(path)) { directoryUrl = V02_DIRECTORY_URL; } else if ("/staging".equals(path)) { directoryUrl = STAGING_DIRECTORY_URL; } else { throw new IllegalArgumentException("Unknown URI " + serverUri); } try { return URI.create(directoryUrl).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException(directoryUrl, ex); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/letsencrypt/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains the Let's Encrypt * {@link org.shredzone.acme4j.provider.AcmeProvider}. * * @see Let's Encrypt */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider.letsencrypt; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * Acme Providers are the link between acme4j and the ACME server. They know how to * connect to their server, and how to set up HTTP connections. *

* {@link org.shredzone.acme4j.provider.AcmeProvider} is the root interface. * {@link org.shredzone.acme4j.provider.AbstractAcmeProvider} is an abstract * implementation of the most elementary methods. Most HTTP based providers will extend * from {@link org.shredzone.acme4j.provider.GenericAcmeProvider} though. *

* Provider implementations must be registered with Java's * {@link java.util.ServiceLoader}. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/pebble/PebbleAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.pebble; import java.io.IOException; import java.net.MalformedURLException; import java.net.URI; import java.net.URISyntaxException; import java.net.URL; import java.net.http.HttpClient; import java.security.KeyManagementException; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.util.Optional; import java.util.regex.Pattern; import javax.net.ssl.SSLContext; import javax.net.ssl.TrustManagerFactory; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * An {@link AcmeProvider} for Pebble. *

* Pebble is a small ACME test server. * This provider can be used to connect to an instance of a Pebble server. *

* {@code "acme://pebble"} connects to a Pebble server running on localhost and listening * on the standard port 14000. Using {@code "acme://pebble/other-host:12345"}, it is * possible to connect to an external Pebble server on the given {@code other-host} and * port. The port is optional, and if omitted, the standard port is used. */ public class PebbleAcmeProvider extends AbstractAcmeProvider { private static final Logger LOG = LoggerFactory.getLogger(PebbleAcmeProvider.class); private static final Pattern HOST_PATTERN = Pattern.compile("^/([^:/]+)(?:\\:(\\d+))?/?$"); private static final int PEBBLE_DEFAULT_PORT = 14000; @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "pebble".equals(serverUri.getHost()); } @Override public URL resolve(URI serverUri) { try { var path = serverUri.getPath(); int port = serverUri.getPort() != -1 ? serverUri.getPort() : PEBBLE_DEFAULT_PORT; var baseUrl = URI.create("https://localhost:" + port + "/dir").toURL(); if (path != null && !path.isEmpty() && !"/".equals(path)) { baseUrl = parsePath(path); } return baseUrl; } catch (MalformedURLException ex) { throw new IllegalArgumentException("Bad server URI " + serverUri, ex); } } /** * Parses the server URI path and returns the server's base URL. * * @param path * server URI path * @return URL of the server's base */ private URL parsePath(String path) throws MalformedURLException { var m = HOST_PATTERN.matcher(path); if (m.matches()) { var host = m.group(1); var port = PEBBLE_DEFAULT_PORT; if (m.group(2) != null) { port = Integer.parseInt(m.group(2)); } try { return new URI("https", null, host, port, "/dir", null, null).toURL(); } catch (URISyntaxException ex) { throw new IllegalArgumentException("Malformed Pebble host/port: " + path); } } else { throw new IllegalArgumentException("Invalid Pebble host/port: " + path); } } @Override public HttpClient createHttpClient(NetworkSettings networkSettings) { var builder = HttpClient.newBuilder() .followRedirects(HttpClient.Redirect.NORMAL) .connectTimeout(networkSettings.getTimeout()) .proxy(networkSettings.getProxySelector()) .sslContext(createPebbleSSLContext()); if (networkSettings.getAuthenticator() != null) { builder.authenticator(networkSettings.getAuthenticator()); } return builder.build(); } /** * Creates a TrustManagerFactory configured with the Pebble root certificate. *

* This method loads the Pebble root certificate from the PEM file and creates * a TrustManagerFactory that trusts certificates signed by Pebble's CA. * * @return TrustManagerFactory configured for Pebble * @throws RuntimeException if the Pebble certificate cannot be found or loaded * @since 4.0.0 */ protected TrustManagerFactory createPebbleTrustManagerFactory() { try { var keystore = readPemFile("/pebble.minica.pem") .or(() -> readPemFile("/META-INF/pebble.minica.pem")) .or(() -> readPemFile("/org/shredzone/acme4j/provider/pebble/pebble.minica.pem")) .orElseThrow(() -> new RuntimeException("Could not find a Pebble root certificate")); var tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); tmf.init(keystore); return tmf; } catch (KeyStoreException | NoSuchAlgorithmException ex) { throw new RuntimeException("Could not create truststore", ex); } } /** * Creates the Pebble SSL context. *

* Since the HTTP client is cached at the session level, this method is only called * once per session, so no additional caching is needed. * * @return SSLContext configured for Pebble */ private SSLContext createPebbleSSLContext() { try { var tmf = createPebbleTrustManagerFactory(); var sslContext = SSLContext.getInstance("TLS"); sslContext.init(null, tmf.getTrustManagers(), null); return sslContext; } catch (NoSuchAlgorithmException | KeyManagementException ex) { throw new RuntimeException("Could not create SSL context", ex); } } /** * Reads a PEM file from a resource for Pebble SSL context creation. */ private Optional readPemFile(String resource) { try (var in = PebbleAcmeProvider.class.getResourceAsStream(resource)) { if (in == null) { return Optional.empty(); } var cf = CertificateFactory.getInstance("X.509"); var cert = cf.generateCertificate(in); var keystore = KeyStore.getInstance(KeyStore.getDefaultType()); keystore.load(null, "acme4j".toCharArray()); keystore.setCertificateEntry("pebble", cert); return Optional.of(keystore); } catch (IOException | KeyStoreException | CertificateException | NoSuchAlgorithmException ex) { LOG.error("Failed to read PEM from resource '{}'", resource, ex); return Optional.empty(); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/pebble/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains an {@link org.shredzone.acme4j.provider.AcmeProvider} for the * Pebble test server. * * @see Pebble project page */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider.pebble; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/sslcom/SslComAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.sslcom; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.util.Map; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.shredzone.acme4j.provider.AcmeProvider; import org.shredzone.acme4j.toolbox.JSON; /** * An {@link AcmeProvider} for SSL.com. *

* The {@code serverUri} is {@code "acme://ssl.com"} for the production server, * and {@code "acme://acme-try.ssl.com"} for a testing server. *

* If you want to use SSL.com, always prefer to use this provider. * * @see SSL.com * @since 3.2.0 */ public class SslComAcmeProvider extends AbstractAcmeProvider { private static final String PRODUCTION_ECC_DIRECTORY_URL = "https://acme.ssl.com/sslcom-dv-ecc"; private static final String PRODUCTION_RSA_DIRECTORY_URL = "https://acme.ssl.com/sslcom-dv-rsa"; private static final String STAGING_ECC_DIRECTORY_URL = "https://acme-try.ssl.com/sslcom-dv-ecc"; private static final String STAGING_RSA_DIRECTORY_URL = "https://acme-try.ssl.com/sslcom-dv-rsa"; @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "ssl.com".equals(serverUri.getHost()); } @Override public URL resolve(URI serverUri) { var path = serverUri.getPath(); String directoryUrl; if (path == null || path.isEmpty() || "/".equals(path) || "/ecc".equals(path)) { directoryUrl = PRODUCTION_ECC_DIRECTORY_URL; } else if ("/rsa".equals(path)) { directoryUrl = PRODUCTION_RSA_DIRECTORY_URL; } else if ("/staging".equals(path) || "/staging/ecc".equals(path)) { directoryUrl = STAGING_ECC_DIRECTORY_URL; } else if ("/staging/rsa".equals(path)) { directoryUrl = STAGING_RSA_DIRECTORY_URL; } else { throw new IllegalArgumentException("Unknown URI " + serverUri); } try { return URI.create(directoryUrl).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException(directoryUrl, ex); } } @Override @SuppressWarnings("unchecked") public JSON directory(Session session, URI serverUri) throws AcmeException { // This is a workaround for a bug at SSL.com. It requires account registration // by EAB, but the "externalAccountRequired" flag in the directory is set to // false. This patch reads the directory and forcefully sets the flag to true. // The entire method can be removed once it is fixed on SSL.com side. var superdirectory = super.directory(session, serverUri); if (superdirectory == null) { return null; } var directory = superdirectory.toMap(); var meta = directory.get("meta"); if (meta instanceof Map) { var metaMap = ((Map) meta); metaMap.remove("externalAccountRequired"); metaMap.put("externalAccountRequired", true); } return JSON.fromMap(directory); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/sslcom/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains the SSL.com * {@link org.shredzone.acme4j.provider.AcmeProvider}. * * @see SSL.com */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider.sslcom; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/zerossl/ZeroSSLAcmeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.zerossl; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.shredzone.acme4j.provider.AcmeProvider; /** * An {@link AcmeProvider} for ZeroSSL. *

* The {@code serverUri} is {@code "acme://zerossl.com"} for the production server. * * @see ZeroSSL * @since 3.2.0 */ public class ZeroSSLAcmeProvider extends AbstractAcmeProvider { private static final String V02_DIRECTORY_URL = "https://acme.zerossl.com/v2/DV90"; @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "zerossl.com".equals(serverUri.getHost()); } @Override public URL resolve(URI serverUri) { var path = serverUri.getPath(); String directoryUrl; if (path == null || path.isEmpty() || "/".equals(path)) { directoryUrl = V02_DIRECTORY_URL; } else { throw new IllegalArgumentException("Unknown URI " + serverUri); } try { return URI.create(directoryUrl).toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException(directoryUrl, ex); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/provider/zerossl/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains the ZeroSSL {@link org.shredzone.acme4j.provider.AcmeProvider}. * * @see ZeroSSL */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.provider.zerossl; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/toolbox/AcmeUtils.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static java.nio.charset.StandardCharsets.UTF_8; import java.io.IOException; import java.io.UncheckedIOException; import java.io.Writer; import java.net.IDN; import java.net.URI; import java.nio.charset.StandardCharsets; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.security.cert.X509Certificate; import java.time.Instant; import java.time.ZoneId; import java.time.ZonedDateTime; import java.util.Arrays; import java.util.Base64; import java.util.Locale; import java.util.Objects; import java.util.Optional; import java.util.regex.Pattern; import edu.umd.cs.findbugs.annotations.Nullable; import org.bouncycastle.asn1.ASN1Integer; import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier; import org.bouncycastle.asn1.x509.Certificate; import org.bouncycastle.cert.X509CertificateHolder; import org.shredzone.acme4j.exception.AcmeProtocolException; /** * Contains utility methods that are frequently used for the ACME protocol. *

* This class is internal. You may use it in your own code, but be warned that methods may * change their signature or disappear without prior announcement. */ public final class AcmeUtils { private static final char[] HEX = "0123456789abcdef".toCharArray(); private static final String ACME_ERROR_PREFIX = "urn:ietf:params:acme:error:"; private static final Pattern DATE_PATTERN = Pattern.compile( "^(\\d{4})-(\\d{2})-(\\d{2})T" + "(\\d{2}):(\\d{2}):(\\d{2})" + "(?:\\.(\\d{1,3})\\d*)?" + "(Z|[+-]\\d{2}:?\\d{2})$", Pattern.CASE_INSENSITIVE); private static final Pattern TZ_PATTERN = Pattern.compile( "([+-])(\\d{2}):?(\\d{2})$"); private static final Pattern CONTENT_TYPE_PATTERN = Pattern.compile( "([^;]+)(?:;.*?charset=(\"?)([a-z0-9_-]+)(\\2))?.*", Pattern.CASE_INSENSITIVE); private static final Pattern MAIL_PATTERN = Pattern.compile("\\?|@.*,"); private static final Pattern BASE64URL_PATTERN = Pattern.compile("[0-9A-Za-z_-]*"); private static final Base64.Encoder PEM_ENCODER = Base64.getMimeEncoder(64, "\n".getBytes(StandardCharsets.US_ASCII)); private static final Base64.Encoder URL_ENCODER = Base64.getUrlEncoder().withoutPadding(); private static final Base64.Decoder URL_DECODER = Base64.getUrlDecoder(); private static final char[] BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567".toCharArray(); /** * Enumeration of PEM labels. */ public enum PemLabel { CERTIFICATE("CERTIFICATE"), CERTIFICATE_REQUEST("CERTIFICATE REQUEST"), PRIVATE_KEY("PRIVATE KEY"), PUBLIC_KEY("PUBLIC KEY"); private final String label; PemLabel(String label) { this.label = label; } @Override public String toString() { return label; } } private AcmeUtils() { // Utility class without constructor } /** * Computes a SHA-256 hash of the given string. * * @param z * String to hash * @return Hash */ public static byte[] sha256hash(String z) { try { var md = MessageDigest.getInstance("SHA-256"); md.update(z.getBytes(UTF_8)); return md.digest(); } catch (NoSuchAlgorithmException ex) { throw new AcmeProtocolException("Could not compute hash", ex); } } /** * Hex encodes the given byte array. * * @param data * byte array to hex encode * @return Hex encoded string of the data (with lower case characters) */ public static String hexEncode(byte[] data) { var result = new char[data.length * 2]; for (var ix = 0; ix < data.length; ix++) { var val = data[ix] & 0xFF; result[ix * 2] = HEX[val >>> 4]; result[ix * 2 + 1] = HEX[val & 0x0F]; } return new String(result); } /** * Base64 encodes the given byte array, using URL style encoding. * * @param data * byte array to base64 encode * @return base64 encoded string */ public static String base64UrlEncode(byte[] data) { return URL_ENCODER.encodeToString(data); } /** * Base64 decodes to a byte array, using URL style encoding. * * @param base64 * base64 encoded string * @return decoded data */ public static byte[] base64UrlDecode(String base64) { return URL_DECODER.decode(base64); } /** * Base32 encodes a byte array. * * @param data Byte array to encode * @return Base32 encoded data (includes padding) * @since 4.0.0 */ public static String base32Encode(byte[] data) { var result = new StringBuilder(); var unconverted = new int[5]; var converted = new int[8]; for (var ix = 0; ix < (data.length + 4) / 5; ix++) { var blocklen = unconverted.length; for (var pos = 0; pos < unconverted.length; pos++) { if ((ix * 5 + pos) < data.length) { unconverted[pos] = data[ix * 5 + pos] & 0xFF; } else { unconverted[pos] = 0; blocklen--; } } converted[0] = (unconverted[0] >> 3) & 0x1F; converted[1] = ((unconverted[0] & 0x07) << 2) | ((unconverted[1] >> 6) & 0x03); converted[2] = (unconverted[1] >> 1) & 0x1F; converted[3] = ((unconverted[1] & 0x01) << 4) | ((unconverted[2] >> 4) & 0x0F); converted[4] = ((unconverted[2] & 0x0F) << 1) | ((unconverted[3] >> 7) & 0x01); converted[5] = (unconverted[3] >> 2) & 0x1F; converted[6] = ((unconverted[3] & 0x03) << 3) | ((unconverted[4] >> 5) & 0x07); converted[7] = unconverted[4] & 0x1F; var padding = switch (blocklen) { case 1 -> 6; case 2 -> 4; case 3 -> 3; case 4 -> 1; case 5 -> 0; default -> throw new IllegalArgumentException("blocklen " + blocklen + " out of range"); }; Arrays.stream(converted) .limit(converted.length - padding) .map(v -> BASE32_ALPHABET[v]) .forEach(v -> result.append((char) v)); if (padding > 0) { result.append("=".repeat(padding)); } } return result.toString(); } /** * Validates that the given {@link String} is a valid base64url encoded value. * * @param base64 * {@link String} to validate * @return {@code true}: String contains a valid base64url encoded value. * {@code false} if the {@link String} was {@code null} or contained illegal * characters. * @since 2.6 */ public static boolean isValidBase64Url(@Nullable String base64) { return base64 != null && BASE64URL_PATTERN.matcher(base64).matches(); } /** * ASCII encodes a domain name. *

* The conversion is done as described in * RFC 3490. Additionally, all * leading and trailing white spaces are trimmed, and the result is lowercased. *

* It is safe to pass in ACE encoded domains, they will be returned unchanged. * * @param domain * Domain name to encode * @return Encoded domain name, white space trimmed and lower cased. */ public static String toAce(String domain) { Objects.requireNonNull(domain, "domain"); return IDN.toASCII(domain.trim()).toLowerCase(Locale.ENGLISH); } /** * Parses a RFC 3339 formatted date. * * @param str * Date string * @return {@link Instant} that was parsed * @throws IllegalArgumentException * if the date string was not RFC 3339 formatted * @see RFC 3339 */ public static Instant parseTimestamp(String str) { var m = DATE_PATTERN.matcher(str); if (!m.matches()) { throw new IllegalArgumentException("Illegal date: " + str); } var year = Integer.parseInt(m.group(1)); var month = Integer.parseInt(m.group(2)); var dom = Integer.parseInt(m.group(3)); var hour = Integer.parseInt(m.group(4)); var minute = Integer.parseInt(m.group(5)); var second = Integer.parseInt(m.group(6)); var msStr = new StringBuilder(); if (m.group(7) != null) { msStr.append(m.group(7)); } while (msStr.length() < 3) { msStr.append('0'); } var ms = Integer.parseInt(msStr.toString()); var tz = m.group(8); if ("Z".equalsIgnoreCase(tz)) { tz = "GMT"; } else { tz = TZ_PATTERN.matcher(tz).replaceAll("GMT$1$2:$3"); } return ZonedDateTime.of( year, month, dom, hour, minute, second, ms * 1_000_000, ZoneId.of(tz)).toInstant(); } /** * Converts the given locale to an Accept-Language header value. * * @param locale * {@link Locale} to be used in the header * @return Value that can be used in an Accept-Language header */ public static String localeToLanguageHeader(@Nullable Locale locale) { if (locale == null || "und".equals(locale.toLanguageTag())) { return "*"; } var langTag = locale.toLanguageTag(); var header = new StringBuilder(langTag); if (langTag.indexOf('-') >= 0) { header.append(',').append(locale.getLanguage()).append(";q=0.8"); } header.append(",*;q=0.1"); return header.toString(); } /** * Strips the acme error prefix from the error string. *

* For example, for "urn:ietf:params:acme:error:unauthorized", "unauthorized" is * returned. * * @param type * Error type to strip the prefix from. {@code null} is safe. * @return Stripped error type, or {@code null} if the prefix was not found. */ @Nullable public static String stripErrorPrefix(@Nullable String type) { if (type != null && type.startsWith(ACME_ERROR_PREFIX)) { return type.substring(ACME_ERROR_PREFIX.length()); } else { return null; } } /** * Writes an encoded key or certificate to a file in PEM format. * * @param encoded * Encoded data to write * @param label * {@link PemLabel} to be used * @param out * {@link Writer} to write to. It will not be closed after use! */ public static void writeToPem(byte[] encoded, PemLabel label, Writer out) throws IOException { out.append("-----BEGIN ").append(label.toString()).append("-----\n"); out.append(new String(PEM_ENCODER.encode(encoded), StandardCharsets.US_ASCII)); out.append("\n-----END ").append(label.toString()).append("-----\n"); } /** * Extracts the content type of a Content-Type header. * * @param header * Content-Type header * @return Content-Type, or {@code null} if the header was invalid or empty * @throws AcmeProtocolException * if the Content-Type header contains a different charset than "utf-8". */ @Nullable public static String getContentType(@Nullable String header) { if (header != null) { var m = CONTENT_TYPE_PATTERN.matcher(header); if (m.matches()) { var charset = m.group(3); if (charset != null && !"utf-8".equalsIgnoreCase(charset)) { throw new AcmeProtocolException("Unsupported charset " + charset); } return m.group(1).trim().toLowerCase(Locale.ENGLISH); } } return null; } /** * Validates a contact {@link URI}. * * @param contact * Contact {@link URI} to validate * @throws IllegalArgumentException * if the contact {@link URI} is not suitable for account contacts. */ public static void validateContact(URI contact) { if ("mailto".equalsIgnoreCase(contact.getScheme())) { var address = contact.toString().substring(7); if (MAIL_PATTERN.matcher(address).find()) { throw new IllegalArgumentException( "multiple recipients or hfields are not allowed: " + contact); } } } /** * Returns the certificate's unique identifier for renewal. * * @param certificate * Certificate to get the unique identifier for. * @return Unique identifier * @throws AcmeProtocolException * if the certificate is invalid or does not provide the necessary * information. */ public static String getRenewalUniqueIdentifier(X509Certificate certificate) { try { var cert = new X509CertificateHolder(certificate.getEncoded()); var aki = Optional.of(cert) .map(X509CertificateHolder::getExtensions) .map(AuthorityKeyIdentifier::fromExtensions) .map(AuthorityKeyIdentifier::getKeyIdentifier) .map(AcmeUtils::base64UrlEncode) .orElseThrow(() -> new AcmeProtocolException("Missing or invalid Authority Key Identifier")); var sn = Optional.of(cert) .map(X509CertificateHolder::toASN1Structure) .map(Certificate::getSerialNumber) .map(AcmeUtils::getRawInteger) .map(AcmeUtils::base64UrlEncode) .orElseThrow(() -> new AcmeProtocolException("Missing or invalid serial number")); return aki + '.' + sn; } catch (Exception ex) { throw new AcmeProtocolException("Invalid certificate", ex); } } /** * Gets the raw integer array from ASN1Integer. This is done by encoding it to a byte * array, and then skipping the INTEGER identifier. Other methods of ASN1Integer only * deliver a parsed integer value that might have been mangled. * * @param integer * ASN1Integer to convert to raw * @return Byte array of the raw integer */ private static byte[] getRawInteger(ASN1Integer integer) { try { var encoded = integer.getEncoded(); return Arrays.copyOfRange(encoded, 2, encoded.length); } catch (IOException ex) { throw new UncheckedIOException(ex); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/toolbox/JSON.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static java.nio.charset.StandardCharsets.UTF_8; import static java.util.stream.Collectors.joining; import static org.shredzone.acme4j.toolbox.AcmeUtils.parseTimestamp; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.io.Serial; import java.io.Serializable; import java.net.MalformedURLException; import java.net.URI; import java.net.URISyntaxException; import java.net.URL; import java.time.Duration; import java.time.Instant; import java.util.Collections; import java.util.HashMap; import java.util.Iterator; import java.util.List; import java.util.Map; import java.util.NoSuchElementException; import java.util.Objects; import java.util.Optional; import java.util.Set; import java.util.function.Function; import java.util.stream.Stream; import java.util.stream.StreamSupport; import edu.umd.cs.findbugs.annotations.Nullable; import org.jose4j.json.JsonUtil; import org.jose4j.lang.JoseException; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Problem; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.exception.AcmeProtocolException; /** * A model containing a JSON result. The content is immutable. */ public final class JSON implements Serializable { @Serial private static final long serialVersionUID = 418332625174149030L; private static final JSON EMPTY_JSON = new JSON(new HashMap<>()); private final String path; private final Map data; /** * Creates a new {@link JSON} root object. * * @param data * {@link Map} containing the parsed JSON data */ private JSON(Map data) { this("", data); } /** * Creates a new {@link JSON} branch object. * * @param path * Path leading to this branch. * @param data * {@link Map} containing the parsed JSON data */ private JSON(String path, Map data) { this.path = path; this.data = data; } /** * Parses JSON from an {@link InputStream}. * * @param in * {@link InputStream} to read from. Will be closed after use. * @return {@link JSON} of the read content. */ public static JSON parse(InputStream in) throws IOException { try (var reader = new BufferedReader(new InputStreamReader(in, UTF_8))) { var json = reader.lines().map(String::trim).collect(joining()); return parse(json); } } /** * Parses JSON from a String. * * @param json * JSON string * @return {@link JSON} of the read content. */ public static JSON parse(String json) { try { return new JSON(JsonUtil.parseJson(json)); } catch (JoseException ex) { throw new AcmeProtocolException("Bad JSON: " + json, ex); } } /** * Creates a JSON object from a map. *

* The map's content is deeply copied. Changes to the map won't reflect in the created * JSON structure. * * @param data * Map structure * @return {@link JSON} of the map's content. * @since 3.2.0 */ public static JSON fromMap(Map data) { return JSON.parse(JsonUtil.toJson(data)); } /** * Returns a {@link JSON} of an empty document. * * @return Empty {@link JSON} */ public static JSON empty() { return EMPTY_JSON; } /** * Returns a set of all keys of this object. * * @return {@link Set} of keys */ public Set keySet() { return Collections.unmodifiableSet(data.keySet()); } /** * Checks if this object contains the given key. * * @param key * Name of the key to check * @return {@code true} if the key is present */ public boolean contains(String key) { return data.containsKey(key); } /** * Returns the {@link Value} of the given key. * * @param key * Key to read * @return {@link Value} of the key */ public Value get(String key) { return new Value( path.isEmpty() ? key : path + '.' + key, data.get(key)); } /** * Returns the {@link Value} of the given key. * * @param key * Key to read * @return {@link Value} of the key * @throws AcmeNotSupportedException * if the key is not present. The key is used as feature name. */ public Value getFeature(String key) { return new Value( path.isEmpty() ? key : path + '.' + key, data.get(key)).onFeature(key); } /** * Returns the content as JSON string. */ @Override public String toString() { return JsonUtil.toJson(data); } /** * Returns the content as unmodifiable Map. * * @since 2.8 */ public Map toMap() { return Collections.unmodifiableMap(data); } /** * Represents a JSON array. */ public static final class Array implements Iterable { private final String path; private final List data; /** * Creates a new {@link Array} object. * * @param path * JSON path to this array. * @param data * Array data */ private Array(String path, List data) { this.path = path; this.data = data; } /** * Returns the array size. * * @return Size of the array */ public int size() { return data.size(); } /** * Returns {@code true} if the array is empty. */ public boolean isEmpty() { return data.isEmpty(); } /** * Gets the {@link Value} at the given index. * * @param index * Array index to read from * @return {@link Value} at this index */ public Value get(int index) { return new Value(path + '[' + index + ']', data.get(index)); } /** * Returns a stream of values. * * @return {@link Stream} of all {@link Value} of this array */ public Stream stream() { return StreamSupport.stream(spliterator(), false); } /** * Creates a new {@link Iterator} that iterates over the array {@link Value}. */ @Override public Iterator iterator() { return new ValueIterator(this); } } /** * A single JSON value. This instance also covers {@code null} values. *

* All return values are never {@code null} unless specified otherwise. For optional * parameters, use {@link Value#optional()}. */ public static final class Value { private final String path; private final @Nullable Object val; /** * Creates a new {@link Value}. * * @param path * JSON path to this value * @param val * Value, may be {@code null} */ private Value(String path, @Nullable Object val) { this.path = path; this.val = val; } /** * Checks if this value is {@code null}. * * @return {@code true} if this value is present, {@code false} if {@code null}. */ public boolean isPresent() { return val != null; } /** * Returns this value as {@link Optional}, for further mapping and filtering. * * @return {@link Optional} of this value, or {@link Optional#empty()} if this * value is {@code null}. * @see #map(Function) */ public Optional optional() { return val != null ? Optional.of(this) : Optional.empty(); } /** * Returns this value. If the value was {@code null}, an * {@link AcmeNotSupportedException} is thrown. This method is used for mandatory * fields that are only present if a certain feature is supported by the server. * * @param feature * Feature name * @return itself */ public Value onFeature(String feature) { if (val == null) { throw new AcmeNotSupportedException(feature); } return this; } /** * Returns this value as an {@link Optional} of the desired type, for further * mapping and filtering. * * @param mapper * A {@link Function} that converts a {@link Value} to the desired type * @return {@link Optional} of this value, or {@link Optional#empty()} if this * value is {@code null}. * @see #optional() */ public Optional map(Function mapper) { return optional().map(mapper); } /** * Returns the value as {@link String}. */ public String asString() { return required().toString(); } /** * Returns the value as JSON object. */ @SuppressWarnings("unchecked") public JSON asObject() { return new JSON(path, (Map) required(Map.class)); } /** * Returns the value as JSON object that was Base64 URL encoded. * * @since 2.8 */ public JSON asEncodedObject() { try { var raw = AcmeUtils.base64UrlDecode(asString()); return new JSON(path, JsonUtil.parseJson(new String(raw, UTF_8))); } catch (IllegalArgumentException | JoseException ex) { throw new AcmeProtocolException(path + ": expected an encoded object", ex); } } /** * Returns the value as {@link Problem}. * * @param baseUrl * Base {@link URL} to resolve relative links against */ public Problem asProblem(URL baseUrl) { return new Problem(asObject(), baseUrl); } /** * Returns the value as {@link Identifier}. * * @since 2.3 */ public Identifier asIdentifier() { return new Identifier(asObject()); } /** * Returns the value as {@link JSON.Array}. *

* Unlike the other getters, this method returns an empty array if the value is * not set. Use {@link #isPresent()} to find out if the value was actually set. */ @SuppressWarnings("unchecked") public Array asArray() { if (val == null) { return new Array(path, Collections.emptyList()); } try { return new Array(path, (List) val); } catch (ClassCastException ex) { throw new AcmeProtocolException(path + ": expected an array", ex); } } /** * Returns the value as int. */ public int asInt() { return (required(Number.class)).intValue(); } /** * Returns the value as boolean. */ public boolean asBoolean() { return required(Boolean.class); } /** * Returns the value as {@link URI}. */ public URI asURI() { try { return new URI(asString()); } catch (URISyntaxException ex) { throw new AcmeProtocolException(path + ": bad URI " + val, ex); } } /** * Returns the value as {@link URL}. */ public URL asURL() { try { return asURI().toURL(); } catch (MalformedURLException ex) { throw new AcmeProtocolException(path + ": bad URL " + val, ex); } } /** * Returns the value as {@link Instant}. */ public Instant asInstant() { try { return parseTimestamp(asString()); } catch (IllegalArgumentException ex) { throw new AcmeProtocolException(path + ": bad date " + val, ex); } } /** * Returns the value as {@link Duration}. * * @since 2.3 */ public Duration asDuration() { return Duration.ofSeconds(required(Number.class).longValue()); } /** * Returns the value as base64 decoded byte array. */ public byte[] asBinary() { return AcmeUtils.base64UrlDecode(asString()); } /** * Returns the parsed {@link Status}. */ public Status asStatus() { return Status.parse(asString()); } /** * Checks if the value is present. An {@link AcmeProtocolException} is thrown if * the value is {@code null}. * * @return val that is guaranteed to be non-{@code null} */ private Object required() { if (val == null) { throw new AcmeProtocolException(path + ": required, but not set"); } return val; } /** * Checks if the value is present. An {@link AcmeProtocolException} is thrown if * the value is {@code null} or is not of the expected type. * * @param type * expected type * @return val that is guaranteed to be non-{@code null} */ private T required(Class type) { if (val == null) { throw new AcmeProtocolException(path + ": required, but not set"); } if (!type.isInstance(val)) { throw new AcmeProtocolException(path + ": cannot convert to " + type.getSimpleName()); } return type.cast(val); } @Override public boolean equals(Object obj) { if (!(obj instanceof Value)) { return false; } return Objects.equals(val, ((Value) obj).val); } @Override public int hashCode() { return val != null ? val.hashCode() : 0; } } /** * An {@link Iterator} over array {@link Value}. */ private static class ValueIterator implements Iterator { private final Array array; private int index = 0; public ValueIterator(Array array) { this.array = array; } @Override public boolean hasNext() { return index < array.size(); } @Override public Value next() { if (!hasNext()) { throw new NoSuchElementException(); } return array.get(index++); } @Override public void remove() { throw new UnsupportedOperationException(); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/toolbox/JSONBuilder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static org.shredzone.acme4j.toolbox.AcmeUtils.base64UrlEncode; import java.security.Key; import java.security.PublicKey; import java.time.Duration; import java.time.Instant; import java.time.format.DateTimeFormatter; import java.util.Collection; import java.util.Collections; import java.util.LinkedHashMap; import java.util.Map; import java.util.Objects; import edu.umd.cs.findbugs.annotations.Nullable; import org.jose4j.json.JsonUtil; /** * Builder for JSON structures. *

* Example: * 

 * JSONBuilder cb = new JSONBuilder();
 * cb.put("foo", 123).put("bar", "hello world");
 * cb.object("sub").put("data", "subdata");
 * cb.array("array", 123, 456, 789);
 *
*/ public class JSONBuilder { private final Map data = new LinkedHashMap<>(); /** * Puts a property. If a property with the key exists, it will be replaced. * * @param key * Property key * @param value * Property value * @return {@code this} */ public JSONBuilder put(String key, @Nullable Object value) { data.put(Objects.requireNonNull(key, "key"), value); return this; } /** * Puts an {@link Instant} to the JSON. If a property with the key exists, it will be * replaced. * * @param key * Property key * @param value * Property {@link Instant} value * @return {@code this} */ public JSONBuilder put(String key, @Nullable Instant value) { if (value == null) { put(key, (Object) null); return this; } put(key, DateTimeFormatter.ISO_INSTANT.format(value)); return this; } /** * Puts a {@link Duration} to the JSON. If a property with the key exists, it will be * replaced. * * @param key * Property key * @param value * Property {@link Duration} value * @return {@code this} * @since 2.3 */ public JSONBuilder put(String key, @Nullable Duration value) { if (value == null) { put(key, (Object) null); return this; } put(key, value.getSeconds()); return this; } /** * Puts binary data to the JSON. The data is base64 url encoded. * * @param key * Property key * @param data * Property data * @return {@code this} */ public JSONBuilder putBase64(String key, byte[] data) { return put(key, base64UrlEncode(data)); } /** * Puts a {@link Key} into the claim. The key is serializied as JWK. * * @param key * Property key * @param publickey * {@link PublicKey} to serialize * @return {@code this} */ public JSONBuilder putKey(String key, PublicKey publickey) { Objects.requireNonNull(publickey, "publickey"); data.put(key, JoseUtils.publicKeyToJWK(publickey)); return this; } /** * Creates an object for the given key. * * @param key * Key of the object * @return Newly created {@link JSONBuilder} for the object. */ public JSONBuilder object(String key) { var subBuilder = new JSONBuilder(); data.put(key, subBuilder.data); return subBuilder; } /** * Puts an array. * * @param key * Property key * @param values * Collection of property values * @return {@code this} */ public JSONBuilder array(String key, Collection values) { data.put(key, values); return this; } /** * Returns a {@link Map} representation of the current state. * * @return {@link Map} of the current state */ public Map toMap() { return Collections.unmodifiableMap(data); } /** * Returns a {@link JSON} representation of the current state. * * @return {@link JSON} of the current state */ public JSON toJSON() { return JSON.parse(toString()); } /** * Returns a JSON string representation of the current state. */ @Override public String toString() { return JsonUtil.toJson(data); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/toolbox/JoseUtils.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2019 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import java.net.URL; import java.security.KeyPair; import java.security.PublicKey; import java.util.Map; import javax.crypto.SecretKey; import edu.umd.cs.findbugs.annotations.Nullable; import org.jose4j.jwk.EllipticCurveJsonWebKey; import org.jose4j.jwk.JsonWebKey; import org.jose4j.jwk.PublicJsonWebKey; import org.jose4j.jwk.RsaJsonWebKey; import org.jose4j.jws.AlgorithmIdentifiers; import org.jose4j.jws.JsonWebSignature; import org.jose4j.lang.JoseException; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * Utility class that takes care of all the JOSE stuff. *

* Internal class, do not use in your project! The API may change anytime, in a breaking * manner, and without prior notice. * * @since 2.7 */ public final class JoseUtils { private static final Logger LOG = LoggerFactory.getLogger(JoseUtils.class); private JoseUtils() { // Utility class without constructor } /** * Creates an ACME JOSE request. * * @param url * {@link URL} of the ACME call * @param keypair * {@link KeyPair} to sign the request with * @param payload * ACME JSON payload. If {@code null}, a POST-as-GET request is generated * instead. * @param nonce * Nonce to be used. {@code null} if no nonce is to be used in the JOSE * header. * @param kid * kid to be used in the JOSE header. If {@code null}, a jwk header of the * given key is used instead. * @return JSON structure of the JOSE request, ready to be sent. */ public static JSONBuilder createJoseRequest(URL url, KeyPair keypair, @Nullable JSONBuilder payload, @Nullable String nonce, @Nullable String kid) { try { var jwk = PublicJsonWebKey.Factory.newPublicJwk(keypair.getPublic()); var jws = new JsonWebSignature(); jws.getHeaders().setObjectHeaderValue("url", url); if (kid != null) { jws.getHeaders().setObjectHeaderValue("kid", kid); } else { jws.getHeaders().setJwkHeaderValue("jwk", jwk); } if (nonce != null) { jws.getHeaders().setObjectHeaderValue("nonce", nonce); } jws.setPayload(payload != null ? payload.toString() : ""); jws.setAlgorithmHeaderValue(keyAlgorithm(jwk)); jws.setKey(keypair.getPrivate()); jws.sign(); if (LOG.isDebugEnabled()) { LOG.debug("{} {}", payload != null ? "POST" : "POST-as-GET", url); if (payload != null) { LOG.debug(" Payload: {}", payload); } LOG.debug(" JWS Header: {}", jws.getHeaders().getFullHeaderAsJsonString()); } var jb = new JSONBuilder(); jb.put("protected", jws.getHeaders().getEncodedHeader()); jb.put("payload", jws.getEncodedPayload()); jb.put("signature", jws.getEncodedSignature()); return jb; } catch (JoseException ex) { throw new IllegalArgumentException("Could not create a JOSE request", ex); } } /** * Creates a JSON structure for external account binding. * * @param kid * Key Identifier provided by the CA * @param accountKey * {@link PublicKey} of the account to register * @param macKey * {@link SecretKey} to sign the key identifier with * @param macAlgorithm * Algorithm of the MAC key * @param resource * "newAccount" resource URL * @return Created JSON structure */ public static Map createExternalAccountBinding(String kid, PublicKey accountKey, SecretKey macKey, String macAlgorithm, URL resource) { try { var keyJwk = PublicJsonWebKey.Factory.newPublicJwk(accountKey); var innerJws = new JsonWebSignature(); innerJws.setPayload(keyJwk.toJson()); innerJws.getHeaders().setObjectHeaderValue("url", resource); innerJws.getHeaders().setObjectHeaderValue("kid", kid); innerJws.setAlgorithmHeaderValue(macAlgorithm); innerJws.setKey(macKey); innerJws.setDoKeyValidation(false); innerJws.sign(); var outerClaim = new JSONBuilder(); outerClaim.put("protected", innerJws.getHeaders().getEncodedHeader()); outerClaim.put("signature", innerJws.getEncodedSignature()); outerClaim.put("payload", innerJws.getEncodedPayload()); return outerClaim.toMap(); } catch (JoseException ex) { throw new IllegalArgumentException("Could not create external account binding", ex); } } /** * Converts a {@link PublicKey} to a JOSE JWK structure. * * @param key * {@link PublicKey} to convert * @return JSON map containing the JWK structure */ public static Map publicKeyToJWK(PublicKey key) { try { return PublicJsonWebKey.Factory.newPublicJwk(key) .toParams(JsonWebKey.OutputControlLevel.PUBLIC_ONLY); } catch (JoseException ex) { throw new IllegalArgumentException("Bad public key", ex); } } /** * Converts a JOSE JWK structure to a {@link PublicKey}. * * @param jwk * Map containing a JWK structure * @return the extracted {@link PublicKey} */ public static PublicKey jwkToPublicKey(Map jwk) { try { return PublicJsonWebKey.Factory.newPublicJwk(jwk).getPublicKey(); } catch (JoseException ex) { throw new IllegalArgumentException("Bad JWK", ex); } } /** * Computes a thumbprint of the given public key. * * @param key * {@link PublicKey} to get the thumbprint of * @return Thumbprint of the key */ public static byte[] thumbprint(PublicKey key) { try { var jwk = PublicJsonWebKey.Factory.newPublicJwk(key); return jwk.calculateThumbprint("SHA-256"); } catch (JoseException ex) { throw new IllegalArgumentException("Bad public key", ex); } } /** * Analyzes the key used in the {@link JsonWebKey}, and returns the key algorithm * identifier for {@link JsonWebSignature}. * * @param jwk * {@link JsonWebKey} to analyze * @return algorithm identifier * @throws IllegalArgumentException * there is no corresponding algorithm identifier for the key */ public static String keyAlgorithm(JsonWebKey jwk) { if (jwk instanceof EllipticCurveJsonWebKey ecjwk) { return switch (ecjwk.getCurveName()) { case "P-256" -> AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256; case "P-384" -> AlgorithmIdentifiers.ECDSA_USING_P384_CURVE_AND_SHA384; case "P-521" -> AlgorithmIdentifiers.ECDSA_USING_P521_CURVE_AND_SHA512; default -> throw new IllegalArgumentException("Unknown EC name " + ecjwk.getCurveName()); }; } else if (jwk instanceof RsaJsonWebKey) { return AlgorithmIdentifiers.RSA_USING_SHA256; } else { throw new IllegalArgumentException("Unknown algorithm " + jwk.getAlgorithm()); } } /** * Analyzes the {@link SecretKey}, and returns the key algorithm identifier for {@link * JsonWebSignature}. * * @param macKey * {@link SecretKey} to analyze * @return algorithm identifier * @throws IllegalArgumentException * there is no corresponding algorithm identifier for the key */ public static String macKeyAlgorithm(SecretKey macKey) { if (!"HMAC".equals(macKey.getAlgorithm())) { throw new IllegalArgumentException("Bad algorithm: " + macKey.getAlgorithm()); } var size = macKey.getEncoded().length * 8; if(size < 256) { throw new IllegalArgumentException("Bad key size: " + size); } if (size >= 512) { return AlgorithmIdentifiers.HMAC_SHA512; } else if (size >= 384) { return AlgorithmIdentifiers.HMAC_SHA384; } else { return AlgorithmIdentifiers.HMAC_SHA256; } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/toolbox/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * Internal toolbox. The API of these classes may change anytime, in a breaking manner, * and without prior notice. It is better not to use them in your project. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.toolbox; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/util/CSRBuilder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.util; import static java.nio.charset.StandardCharsets.UTF_8; import static java.util.Objects.requireNonNull; import static java.util.stream.Collectors.joining; import static org.shredzone.acme4j.toolbox.AcmeUtils.toAce; import java.io.IOException; import java.io.OutputStream; import java.io.OutputStreamWriter; import java.io.Writer; import java.net.InetAddress; import java.security.KeyPair; import java.security.interfaces.ECKey; import java.util.ArrayList; import java.util.Arrays; import java.util.Collection; import java.util.List; import java.util.Objects; import edu.umd.cs.findbugs.annotations.Nullable; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x500.X500NameBuilder; import org.bouncycastle.asn1.x500.style.BCStyle; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.ExtensionsGenerator; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder; import org.bouncycastle.util.io.pem.PemObject; import org.bouncycastle.util.io.pem.PemWriter; import org.shredzone.acme4j.Identifier; /** * Generator for a CSR (Certificate Signing Request) suitable for ACME servers. *

* Requires {@code Bouncy Castle}. The * {@link org.bouncycastle.jce.provider.BouncyCastleProvider} must be added as security * provider. */ public class CSRBuilder { private static final String SIGNATURE_ALG = "SHA256withRSA"; private static final String EC_SIGNATURE_ALG = "SHA256withECDSA"; private final X500NameBuilder namebuilder = new X500NameBuilder(X500Name.getDefaultStyle()); private final List namelist = new ArrayList<>(); private final List iplist = new ArrayList<>(); private @Nullable PKCS10CertificationRequest csr = null; private boolean hasCnSet = false; /** * Adds a domain name to the CSR. All domain names will be added as Subject * Alternative Name. *

* IDN domain names are ACE encoded automatically. *

* For wildcard certificates, the domain name must be prefixed with {@code "*."}. * * @param domain * Domain name to add */ public void addDomain(String domain) { namelist.add(toAce(requireNonNull(domain))); } /** * Adds a {@link Collection} of domains. *

* IDN domain names are ACE encoded automatically. * * @param domains * Collection of domain names to add */ public void addDomains(Collection domains) { domains.forEach(this::addDomain); } /** * Adds multiple domain names. *

* IDN domain names are ACE encoded automatically. * * @param domains * Domain names to add */ public void addDomains(String... domains) { Arrays.stream(domains).forEach(this::addDomain); } /** * Adds an {@link InetAddress}. All IP addresses will be set as iPAddress Subject * Alternative Name. * * @param address * {@link InetAddress} to add * @since 2.4 */ public void addIP(InetAddress address) { iplist.add(requireNonNull(address)); } /** * Adds a {@link Collection} of IP addresses. * * @param ips * Collection of IP addresses to add * @since 2.4 */ public void addIPs(Collection ips) { ips.forEach(this::addIP); } /** * Adds multiple IP addresses. * * @param ips * IP addresses to add * @since 2.4 */ public void addIPs(InetAddress... ips) { Arrays.stream(ips).forEach(this::addIP); } /** * Adds an {@link Identifier}. Only DNS and IP types are supported. * * @param id * {@link Identifier} to add * @since 2.7 */ public void addIdentifier(Identifier id) { requireNonNull(id); if (Identifier.TYPE_DNS.equals(id.getType())) { addDomain(id.getDomain()); } else if (Identifier.TYPE_IP.equals(id.getType())) { addIP(id.getIP()); } else { throw new IllegalArgumentException("Unknown identifier type: " + id.getType()); } } /** * Adds a {@link Collection} of {@link Identifier}. * * @param ids * Collection of Identifiers to add * @since 2.7 */ public void addIdentifiers(Collection ids) { ids.forEach(this::addIdentifier); } /** * Adds multiple {@link Identifier}. * * @param ids * Identifiers to add * @since 2.7 */ public void addIdentifiers(Identifier... ids) { Arrays.stream(ids).forEach(this::addIdentifier); } /** * Sets an entry of the subject used for the CSR. *

* This method is meant as "expert mode" for setting attributes that are not covered * by the other methods. It is at the discretion of the ACME server to accept this * parameter. * * @param attName * The BCStyle attribute name * @param value * The value * @since 2.14 */ public void addValue(String attName, String value) { var oid = X500Name.getDefaultStyle().attrNameToOID(requireNonNull(attName, "attribute name must not be null")); addValue(oid, value); } /** * Sets an entry of the subject used for the CSR. *

* This method is meant as "expert mode" for setting attributes that are not covered * by the other methods. It is at the discretion of the ACME server to accept this * parameter. * * @param oid * The OID of the attribute to be added * @param value * The value * @since 2.14 */ public void addValue(ASN1ObjectIdentifier oid, String value) { if (requireNonNull(oid, "OID must not be null").equals(BCStyle.CN)) { addDomain(value); if (hasCnSet) { return; } hasCnSet = true; } namebuilder.addRDN(oid, requireNonNull(value, "attribute value must not be null")); } /** * Sets the common name. *

* Note that it is at the discretion of the ACME server to accept this parameter. * * @since 3.2.0 */ public void setCommonName(String cn) { namebuilder.addRDN(BCStyle.CN, requireNonNull(cn)); } /** * Sets the organization. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setOrganization(String o) { namebuilder.addRDN(BCStyle.O, requireNonNull(o)); } /** * Sets the organizational unit. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setOrganizationalUnit(String ou) { namebuilder.addRDN(BCStyle.OU, requireNonNull(ou)); } /** * Sets the city or locality. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setLocality(String l) { namebuilder.addRDN(BCStyle.L, requireNonNull(l)); } /** * Sets the state or province. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setState(String st) { namebuilder.addRDN(BCStyle.ST, requireNonNull(st)); } /** * Sets the country. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setCountry(String c) { namebuilder.addRDN(BCStyle.C, requireNonNull(c)); } /** * Signs the completed CSR. * * @param keypair * {@link KeyPair} to sign the CSR with */ public void sign(KeyPair keypair) throws IOException { Objects.requireNonNull(keypair, "keypair"); if (namelist.isEmpty() && iplist.isEmpty()) { throw new IllegalStateException("No domain or IP address was set"); } try { var ix = 0; var gns = new GeneralName[namelist.size() + iplist.size()]; for (var name : namelist) { gns[ix++] = new GeneralName(GeneralName.dNSName, name); } for (var ip : iplist) { gns[ix++] = new GeneralName(GeneralName.iPAddress, ip.getHostAddress()); } var subjectAltName = new GeneralNames(gns); var p10Builder = new JcaPKCS10CertificationRequestBuilder(namebuilder.build(), keypair.getPublic()); var extensionsGenerator = new ExtensionsGenerator(); extensionsGenerator.addExtension(Extension.subjectAlternativeName, false, subjectAltName); p10Builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensionsGenerator.generate()); var pk = keypair.getPrivate(); var csBuilder = new JcaContentSignerBuilder(pk instanceof ECKey ? EC_SIGNATURE_ALG : SIGNATURE_ALG); var signer = csBuilder.build(pk); csr = p10Builder.build(signer); } catch (OperatorCreationException ex) { throw new IOException("Could not generate CSR", ex); } } /** * Gets the PKCS#10 certification request. */ public PKCS10CertificationRequest getCSR() { if (csr == null) { throw new IllegalStateException("sign CSR first"); } return csr; } /** * Gets an encoded PKCS#10 certification request. */ public byte[] getEncoded() throws IOException { return getCSR().getEncoded(); } /** * Writes the signed certificate request to a {@link Writer}. * * @param w * {@link Writer} to write the PEM file to. The {@link Writer} is closed * after use. */ public void write(Writer w) throws IOException { if (csr == null) { throw new IllegalStateException("sign CSR first"); } try (var pw = new PemWriter(w)) { pw.writeObject(new PemObject("CERTIFICATE REQUEST", getEncoded())); } } /** * Writes the signed certificate request to an {@link OutputStream}. * * @param out * {@link OutputStream} to write the PEM file to. The {@link OutputStream} * is closed after use. */ public void write(OutputStream out) throws IOException { write(new OutputStreamWriter(out, UTF_8)); } @Override public String toString() { var sb = new StringBuilder(); sb.append(namebuilder.build()); if (!namelist.isEmpty()) { sb.append(namelist.stream().collect(joining(",DNS=", ",DNS=", ""))); } if (!iplist.isEmpty()) { sb.append(iplist.stream() .map(InetAddress::getHostAddress) .collect(joining(",IP=", ",IP=", ""))); } return sb.toString(); } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/util/CertificateUtils.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.util; import java.io.ByteArrayInputStream; import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.math.BigInteger; import java.nio.charset.StandardCharsets; import java.security.InvalidKeyException; import java.security.KeyPair; import java.security.NoSuchAlgorithmException; import java.security.PrivateKey; import java.security.PublicKey; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.time.Duration; import java.time.Instant; import java.util.Date; import java.util.Objects; import java.util.function.Function; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.Extensions; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.cert.CertIOException; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder; import org.bouncycastle.openssl.PEMParser; import org.bouncycastle.operator.ContentSigner; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequest; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.challenge.TlsAlpn01Challenge; /** * Utility class offering convenience methods for certificates. *

* Requires {@code Bouncy Castle}. */ public final class CertificateUtils { /** * The {@code acmeValidation} object identifier. * * @since 2.1 */ public static final ASN1ObjectIdentifier ACME_VALIDATION = new ASN1ObjectIdentifier(TlsAlpn01Challenge.ACME_VALIDATION_OID).intern(); private CertificateUtils() { // utility class without constructor } /** * Reads a CSR PEM file. * * @param in * {@link InputStream} to read the CSR from. The {@link InputStream} is * closed after use. * @return CSR that was read */ public static PKCS10CertificationRequest readCSR(InputStream in) throws IOException { try (var pemParser = new PEMParser(new InputStreamReader(in, StandardCharsets.US_ASCII))) { var parsedObj = pemParser.readObject(); if (!(parsedObj instanceof PKCS10CertificationRequest)) { throw new IOException("Not a PKCS10 CSR"); } return (PKCS10CertificationRequest) parsedObj; } } /** * Creates a self-signed {@link X509Certificate} that can be used for the * {@link TlsAlpn01Challenge}. The certificate is valid for 7 days. * * @param keypair * A domain {@link KeyPair} to be used for the challenge * @param id * The {@link Identifier} that is to be validated * @param acmeValidation * The value that is returned by * {@link TlsAlpn01Challenge#getAcmeValidation()} * @return Created certificate * @since 2.6 */ public static X509Certificate createTlsAlpn01Certificate(KeyPair keypair, Identifier id, byte[] acmeValidation) throws IOException { Objects.requireNonNull(keypair, "keypair"); Objects.requireNonNull(id, "id"); if (acmeValidation == null || acmeValidation.length != 32) { throw new IllegalArgumentException("Bad acmeValidation parameter"); } var now = System.currentTimeMillis(); var issuer = new X500Name("CN=acme.invalid"); var serial = BigInteger.valueOf(now); var notBefore = Instant.ofEpochMilli(now); var notAfter = notBefore.plus(Duration.ofDays(7)); var certBuilder = new JcaX509v3CertificateBuilder( issuer, serial, Date.from(notBefore), Date.from(notAfter), issuer, keypair.getPublic()); var gns = new GeneralName[1]; gns[0] = switch (id.getType()) { case Identifier.TYPE_DNS -> new GeneralName(GeneralName.dNSName, id.getDomain()); case Identifier.TYPE_IP -> new GeneralName(GeneralName.iPAddress, id.getIP().getHostAddress()); default -> throw new IllegalArgumentException("Unsupported Identifier type " + id.getType()); }; certBuilder.addExtension(Extension.subjectAlternativeName, false, new GeneralNames(gns)); certBuilder.addExtension(ACME_VALIDATION, true, new DEROctetString(acmeValidation)); return buildCertificate(certBuilder::build, keypair.getPrivate()); } /** * Creates a self-signed root certificate. *

* The generated certificate is only meant for testing purposes! * * @param subject * This certificate's subject X.500 name. * @param notBefore * {@link Instant} before which the certificate is not valid. * @param notAfter * {@link Instant} after which the certificate is not valid. * @param keypair * {@link KeyPair} that is to be used for this certificate. * @return Generated {@link X509Certificate} * @since 2.8 */ public static X509Certificate createTestRootCertificate(String subject, Instant notBefore, Instant notAfter, KeyPair keypair) { Objects.requireNonNull(subject, "subject"); Objects.requireNonNull(notBefore, "notBefore"); Objects.requireNonNull(notAfter, "notAfter"); Objects.requireNonNull(keypair, "keypair"); var certBuilder = new JcaX509v1CertificateBuilder( new X500Name(subject), BigInteger.valueOf(System.currentTimeMillis()), Date.from(notBefore), Date.from(notAfter), new X500Name(subject), keypair.getPublic() ); return buildCertificate(certBuilder::build, keypair.getPrivate()); } /** * Creates an intermediate certificate that is signed by an issuer. *

* The generated certificate is only meant for testing purposes! * * @param subject * This certificate's subject X.500 name. * @param notBefore * {@link Instant} before which the certificate is not valid. * @param notAfter * {@link Instant} after which the certificate is not valid. * @param intermediatePublicKey * {@link PublicKey} of this certificate * @param issuer * The issuer's {@link X509Certificate}. * @param issuerPrivateKey * {@link PrivateKey} of the issuer. This is not the private key of this * intermediate certificate. * @return Generated {@link X509Certificate} * @since 2.8 */ public static X509Certificate createTestIntermediateCertificate(String subject, Instant notBefore, Instant notAfter, PublicKey intermediatePublicKey, X509Certificate issuer, PrivateKey issuerPrivateKey) { Objects.requireNonNull(subject, "subject"); Objects.requireNonNull(notBefore, "notBefore"); Objects.requireNonNull(notAfter, "notAfter"); Objects.requireNonNull(intermediatePublicKey, "intermediatePublicKey"); Objects.requireNonNull(issuer, "issuer"); Objects.requireNonNull(issuerPrivateKey, "issuerPrivateKey"); var certBuilder = new JcaX509v1CertificateBuilder( new X500Name(issuer.getIssuerX500Principal().getName()), BigInteger.valueOf(System.currentTimeMillis()), Date.from(notBefore), Date.from(notAfter), new X500Name(subject), intermediatePublicKey ); return buildCertificate(certBuilder::build, issuerPrivateKey); } /** * Creates a signed end entity certificate from the given CSR. *

* This method is only meant for testing purposes! Do not use it in a real-world CA * implementation. *

* Do not assume that real-world certificates have a similar structure. It's up to the * discretion of the CA which distinguished names, validity dates, extensions and * other parameters are transferred from the CSR to the generated certificate. * * @param csr * CSR to create the certificate from * @param notBefore * {@link Instant} before which the certificate is not valid. * @param notAfter * {@link Instant} after which the certificate is not valid. * @param issuer * The issuer's {@link X509Certificate}. * @param issuerPrivateKey * {@link PrivateKey} of the issuer. This is not the private key the CSR was * signed with. * @return Generated {@link X509Certificate} * @since 2.8 */ public static X509Certificate createTestCertificate(PKCS10CertificationRequest csr, Instant notBefore, Instant notAfter, X509Certificate issuer, PrivateKey issuerPrivateKey) { Objects.requireNonNull(csr, "csr"); Objects.requireNonNull(notBefore, "notBefore"); Objects.requireNonNull(notAfter, "notAfter"); Objects.requireNonNull(issuer, "issuer"); Objects.requireNonNull(issuerPrivateKey, "issuerPrivateKey"); try { var jcaCsr = new JcaPKCS10CertificationRequest(csr); var certBuilder = new JcaX509v3CertificateBuilder( new X500Name(issuer.getIssuerX500Principal().getName()), BigInteger.valueOf(System.currentTimeMillis()), Date.from(notBefore), Date.from(notAfter), csr.getSubject(), jcaCsr.getPublicKey()); var attr = csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest); if (attr.length > 0) { var extensions = attr[0].getAttrValues().toArray(); if (extensions.length > 0 && extensions[0] instanceof Extensions extension0) { var san = GeneralNames.fromExtensions(extension0, Extension.subjectAlternativeName); var critical = csr.getSubject().getRDNs().length == 0; certBuilder.addExtension(Extension.subjectAlternativeName, critical, san); } } return buildCertificate(certBuilder::build, issuerPrivateKey); } catch (NoSuchAlgorithmException | InvalidKeyException | CertIOException ex) { throw new IllegalArgumentException("Invalid CSR", ex); } } /** * Build a {@link X509Certificate} from a builder. * * @param builder * Builder method that receives a {@link ContentSigner} and returns a {@link * X509CertificateHolder}. * @param privateKey * {@link PrivateKey} to sign the certificate with * @return The generated {@link X509Certificate} */ private static X509Certificate buildCertificate(Function builder, PrivateKey privateKey) { try { var signerBuilder = new JcaContentSignerBuilder("SHA256withRSA"); var cert = builder.apply(signerBuilder.build(privateKey)).getEncoded(); var certificateFactory = CertificateFactory.getInstance("X.509"); return (X509Certificate) certificateFactory.generateCertificate(new ByteArrayInputStream(cert)); } catch (CertificateException | OperatorCreationException | IOException ex) { throw new IllegalArgumentException("Could not build certificate", ex); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/util/KeyPairUtils.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.util; import java.io.IOException; import java.io.Reader; import java.io.Writer; import java.security.InvalidAlgorithmParameterException; import java.security.KeyPair; import java.security.KeyPairGenerator; import java.security.NoSuchAlgorithmException; import java.security.NoSuchProviderException; import java.security.PublicKey; import java.security.SecureRandom; import org.bouncycastle.jce.ECNamedCurveTable; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.openssl.PEMException; import org.bouncycastle.openssl.PEMKeyPair; import org.bouncycastle.openssl.PEMParser; import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter; import org.bouncycastle.openssl.jcajce.JcaPEMWriter; /** * Utility class offering convenience methods for {@link KeyPair}. *

* Requires {@code Bouncy Castle}. */ public class KeyPairUtils { private KeyPairUtils() { // utility class without constructor } /** * Creates a new standard {@link KeyPair}. *

* This method can be used if no specific key type is required. It returns a * "secp384r1" ECDSA key pair. * * @return Generated {@link KeyPair} * @since 2.8 */ public static KeyPair createKeyPair() { return createECKeyPair("secp384r1"); } /** * Creates a new RSA {@link KeyPair}. * * @param keysize * Key size * @return Generated {@link KeyPair} */ public static KeyPair createKeyPair(int keysize) { try { var keyGen = KeyPairGenerator.getInstance("RSA"); keyGen.initialize(keysize); return keyGen.generateKeyPair(); } catch (NoSuchAlgorithmException ex) { throw new IllegalStateException(ex); } } /** * Creates a new elliptic curve {@link KeyPair}. * * @param name * ECDSA curve name (e.g. "secp256r1") * @return Generated {@link KeyPair} */ public static KeyPair createECKeyPair(String name) { try { var ecSpec = ECNamedCurveTable.getParameterSpec(name); var g = KeyPairGenerator.getInstance("ECDSA", BouncyCastleProvider.PROVIDER_NAME); g.initialize(ecSpec, new SecureRandom()); return g.generateKeyPair(); } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException ex) { throw new IllegalArgumentException("Invalid curve name " + name, ex); } catch (NoSuchProviderException ex) { throw new IllegalStateException(ex); } } /** * Reads a {@link KeyPair} from a PEM file. * * @param r * {@link Reader} to read the PEM file from. The {@link Reader} is closed * after use. * @return {@link KeyPair} read */ public static KeyPair readKeyPair(Reader r) throws IOException { try (var parser = new PEMParser(r)) { var keyPair = (PEMKeyPair) parser.readObject(); return new JcaPEMKeyConverter().getKeyPair(keyPair); } catch (PEMException ex) { throw new IOException("Invalid PEM file", ex); } } /** * Writes a {@link KeyPair} PEM file. * * @param keypair * {@link KeyPair} to write * @param w * {@link Writer} to write the PEM file to. The {@link Writer} is closed * after use. */ public static void writeKeyPair(KeyPair keypair, Writer w) throws IOException { try (var jw = new JcaPEMWriter(w)) { jw.writeObject(keypair); } } /** * Writes a {@link PublicKey} as PEM file. * * @param key * {@link PublicKey} * @param w * {@link Writer} to write the PEM file to. The {@link Writer} is closed * after use. * @since 3.0.0 */ public static void writePublicKey(PublicKey key, Writer w) throws IOException { try (var jw = new JcaPEMWriter(w)) { jw.writeObject(key); } } } ================================================ FILE: acme4j-client/src/main/java/org/shredzone/acme4j/util/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * A collection of utility classes. All of them require Bouncy Castle to be added as * * security provider. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.util; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-client/src/main/resources/.gitignore ================================================ ================================================ FILE: acme4j-client/src/main/resources/META-INF/services/org.shredzone.acme4j.provider.AcmeProvider ================================================ # Actalis: https://www.actalis.com/ org.shredzone.acme4j.provider.actalis.ActalisAcmeProvider # Google Trust Services: https://pki.goog/ org.shredzone.acme4j.provider.google.GoogleAcmeProvider # Let's Encrypt: https://letsencrypt.org org.shredzone.acme4j.provider.letsencrypt.LetsEncryptAcmeProvider # Pebble (ACME Test Server): https://github.com/letsencrypt/pebble org.shredzone.acme4j.provider.pebble.PebbleAcmeProvider # SSL.com: https://ssl.com org.shredzone.acme4j.provider.sslcom.SslComAcmeProvider # ZeroSSL: https://zerossl.com org.shredzone.acme4j.provider.zerossl.ZeroSSLAcmeProvider ================================================ FILE: acme4j-client/src/main/resources/org/shredzone/acme4j/provider/pebble/pebble.minica.pem ================================================ -----BEGIN CERTIFICATE----- MIIDPzCCAiegAwIBAgIIU0Xm9UFdQxUwDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE AxMVbWluaWNhIHJvb3QgY2EgNTM0NWU2MCAXDTI1MDkwMzIzNDAwNVoYDzIxMjUw OTAzMjM0MDA1WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSA1MzQ1ZTYwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5WgZNoVJandj43kkLyU50vzCZ alozvdRo3OFiKoDtmqKPNWRNO2hC9AUNxTDJco51Yc42u/WV3fPbbhSznTiOOVtn Ajm6iq4I5nZYltGGZetGDOQWr78y2gWY+SG078MuOO2hyDIiKtVc3xiXYA+8Hluu 9F8KbqSS1h55yxZ9b87eKR+B0zu2ahzBCIHKmKWgc6N13l7aDxxY3D6uq8gtJRU0 toumyLbdzGcupVvjbjDP11nl07RESDWBLG1/g3ktJvqIa4BWgU2HMh4rND6y8OD3 Hy3H8MY6CElL+MOCbFJjWqhtOxeFyZZV9q3kYnk9CAuQJKMEGuN4GU6tzhW1AgMB AAGjezB5MA4GA1UdDwEB/wQEAwIChDATBgNVHSUEDDAKBggrBgEFBQcDATASBgNV HRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSu8RGpErgYUoYnQuwCq+/ggTiEjDAf BgNVHSMEGDAWgBSu8RGpErgYUoYnQuwCq+/ggTiEjDANBgkqhkiG9w0BAQsFAAOC AQEAXDVYov1+f6EL7S41LhYQkEX/GyNNzsEvqxE9U0+3Iri5JfkcNOiA9O9L6Z+Y bqcsXV93s3vi4r4WSWuc//wHyJYrVe5+tK4nlFpbJOvfBUtnoBDyKNxXzZCxFJVh f9uc8UejRfQMFbDbhWY/x83y9BDufJHHq32OjCIN7gp2UR8rnfYvlz7Zg4qkJBsn DG4dwd+pRTCFWJOVIG0JoNhK3ZmE7oJ1N4H38XkZ31NPcMksKxpsLLIS9+mosZtg 4olL7tMPJklx5ZaeMFaKRDq4Gdxkbw4+O4vRgNm3Z8AXWKknOdfgdpqLUPPhRcP4 v1lhy71EhBuXXwRQJry0lTdF+w== -----END CERTIFICATE----- ================================================ FILE: acme4j-client/src/main/resources-filtered/org/shredzone/acme4j/version.properties ================================================ version=${project.version} ================================================ FILE: acme4j-client/src/test/java/.gitignore ================================================ ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/AccountBuilderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatException; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.HttpURLConnection; import java.net.URL; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.jose4j.jwx.CompactSerializer; import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.CsvSource; import org.junit.jupiter.params.provider.NullAndEmptySource; import org.junit.jupiter.params.provider.ValueSource; import org.mockito.Mockito; import org.shredzone.acme4j.connector.RequestSigner; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.JoseUtilsTest; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link AccountBuilder}. */ public class AccountBuilderTest { private final URL resourceUrl = url("http://example.com/acme/resource"); private final URL locationUrl = url("http://example.com/acme/account"); /** * Test if a new account can be created. */ @Test public void testRegistration() throws Exception { var accountKey = TestUtils.createKeyPair(); var provider = new TestableConnectionProvider() { private boolean isUpdate; @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(login).isNotNull(); assertThat(url).isEqualTo(locationUrl); assertThat(isUpdate).isFalse(); isUpdate = true; return HttpURLConnection.HTTP_OK; } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) { assertThat(session).isNotNull(); assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("newAccount").toString()); isUpdate = false; return HttpURLConnection.HTTP_CREATED; } @Override public URL getLocation() { return locationUrl; } @Override public JSON readJsonResponse() { return getJSON("newAccountResponse"); } }; provider.putTestResource(Resource.NEW_ACCOUNT, resourceUrl); var builder = new AccountBuilder(); builder.addContact("mailto:foo@example.com"); builder.agreeToTermsOfService(); builder.useKeyPair(accountKey); var session = provider.createSession(); var login = builder.createLogin(session); var account = login.getAccount(); assertThat(account.getTermsOfServiceAgreed().orElseThrow()).isTrue(); assertThat(account.getLocation()).isEqualTo(locationUrl); assertThat(account.hasExternalAccountBinding()).isFalse(); assertThat(account.getKeyIdentifier()).isEmpty(); provider.close(); } /** * Test if a new account with Key Identifier can be created. */ @ParameterizedTest @CsvSource({ // Derived from key size "SHA-256,HS256,,", "SHA-384,HS384,,", "SHA-512,HS512,,", // Enforced, but same as key size "SHA-256,HS256,HS256,", "SHA-384,HS384,HS384,", "SHA-512,HS512,HS512,", // Enforced, different from key size "SHA-512,HS256,HS256,", // Proposed by provider "SHA-256,HS256,,HS256", "SHA-512,HS256,,HS256", "SHA-512,HS512,HS512,HS256", }) public void testRegistrationWithKid(String keyAlg, String expectedMacAlg, @Nullable String macAlg, @Nullable String providerAlg ) throws Exception { var accountKey = TestUtils.createKeyPair(); var keyIdentifier = "NCC-1701"; var macKey = TestUtils.createSecretKey(keyAlg); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) { assertThat(session).isNotNull(); assertThat(url).isEqualTo(resourceUrl); var binding = claims.toJSON() .get("externalAccountBinding") .asObject(); var encodedHeader = binding.get("protected").asString(); var encodedSignature = binding.get("signature").asString(); var encodedPayload = binding.get("payload").asString(); var serialized = CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature); JoseUtilsTest.assertExternalAccountBinding(serialized, resourceUrl, keyIdentifier, macKey, expectedMacAlg); return HttpURLConnection.HTTP_CREATED; } @Override public URL getLocation() { return locationUrl; } @Override public JSON readJsonResponse() { return JSON.empty(); } @Override public Optional getProposedEabMacAlgorithm() { return Optional.ofNullable(providerAlg); } }; provider.putTestResource(Resource.NEW_ACCOUNT, resourceUrl); provider.putMetadata("externalAccountRequired", true); var builder = new AccountBuilder(); builder.useKeyPair(accountKey); builder.withKeyIdentifier(keyIdentifier, AcmeUtils.base64UrlEncode(macKey.getEncoded())); if (macAlg != null) { builder.withMacAlgorithm(macAlg); } var session = provider.createSession(); var login = builder.createLogin(session); assertThat(login.getAccount().getLocation()).isEqualTo(locationUrl); provider.close(); } /** * Test if invalid mac algorithms are rejected. */ @ParameterizedTest @NullAndEmptySource @ValueSource(strings = {"foo", "null", "false", "none", "HS-256", "hs256", "HS128", "RS256"}) public void testRejectInvalidMacAlg(@Nullable String macAlg) { assertThatException().isThrownBy(() -> { new AccountBuilder().withMacAlgorithm(macAlg); }).isInstanceOfAny(IllegalArgumentException.class, NullPointerException.class); } /** * Test if an existing account is properly returned. */ @Test public void testOnlyExistingRegistration() throws Exception { var accountKey = TestUtils.createKeyPair(); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) { assertThat(session).isNotNull(); assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("newAccountOnlyExisting").toString()); return HttpURLConnection.HTTP_OK; } @Override public URL getLocation() { return locationUrl; } @Override public JSON readJsonResponse() { return getJSON("newAccountResponse"); } }; provider.putTestResource(Resource.NEW_ACCOUNT, resourceUrl); var builder = new AccountBuilder(); builder.useKeyPair(accountKey); builder.onlyExisting(); var session = provider.createSession(); var login = builder.createLogin(session); assertThat(login.getAccount().getLocation()).isEqualTo(locationUrl); provider.close(); } @Test public void testEmailAddresses() { var builder = Mockito.spy(AccountBuilder.class); builder.addEmail("foo@example.com"); Mockito.verify(builder).addContact(Mockito.eq("mailto:foo@example.com")); // mailto is still accepted if present builder.addEmail("mailto:bar@example.com"); Mockito.verify(builder).addContact(Mockito.eq("mailto:bar@example.com")); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/AccountTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static java.util.Collections.emptyList; import static java.util.Collections.singletonList; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.*; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.junit.jupiter.api.Assertions.fail; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.IOException; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.util.Collection; import java.util.concurrent.atomic.AtomicBoolean; import org.jose4j.jws.JsonWebSignature; import org.jose4j.jwx.CompactSerializer; import org.jose4j.lang.JoseException; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.exception.AcmeServerException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Account}. */ public class AccountTest { private final URL resourceUrl = url("http://example.com/acme/resource"); private final URL locationUrl = url(TestUtils.ACCOUNT_URL); private final URL agreementUrl = url("http://example.com/agreement.pdf"); /** * Test that a account can be updated. */ @Test public void testUpdateAccount() throws AcmeException, IOException { var provider = new TestableConnectionProvider() { private JSON jsonResponse; @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(locationUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("updateAccount").toString()); assertThat(login).isNotNull(); jsonResponse = getJSON("updateAccountResponse"); return HttpURLConnection.HTTP_OK; } @Override public int sendSignedPostAsGetRequest(URL url, Login login) { if ("https://example.com/acme/acct/1/orders".equals(url.toExternalForm())) { jsonResponse = new JSONBuilder() .array("orders", singletonList("https://example.com/acme/order/1")) .toJSON(); } else { jsonResponse = getJSON("updateAccountResponse"); } return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return jsonResponse; } @Override public URL getLocation() { return locationUrl; } @Override public Collection getLinks(String relation) { return emptyList(); } }; var login = provider.createLogin(); var account = new Account(login, locationUrl); account.fetch(); assertThat(login.getAccount().getLocation()).isEqualTo(locationUrl); assertThat(account.getLocation()).isEqualTo(locationUrl); assertThat(account.getTermsOfServiceAgreed().orElseThrow()).isTrue(); assertThat(account.getContacts()).hasSize(1); assertThat(account.getContacts().get(0)).isEqualTo(URI.create("mailto:foo2@example.com")); assertThat(account.getStatus()).isEqualTo(Status.VALID); assertThat(account.hasExternalAccountBinding()).isTrue(); assertThat(account.getKeyIdentifier().orElseThrow()).isEqualTo("NCC-1701"); var orderIt = account.getOrders(); assertThat(orderIt).isNotNull(); assertThat(orderIt.next().getLocation()).isEqualTo(url("https://example.com/acme/order/1")); assertThat(orderIt.hasNext()).isFalse(); provider.close(); } /** * Test lazy loading. */ @Test public void testLazyLoading() throws IOException { var requestWasSent = new AtomicBoolean(false); var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { requestWasSent.set(true); assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAccountResponse"); } @Override public URL getLocation() { return locationUrl; } @Override public Collection getLinks(String relation) { return switch (relation) { case "termsOfService" -> singletonList(agreementUrl); default -> emptyList(); }; } }; var account = new Account(provider.createLogin(), locationUrl); // Lazy loading assertThat(requestWasSent.get()).isFalse(); assertThat(account.getTermsOfServiceAgreed().orElseThrow()).isTrue(); assertThat(requestWasSent.get()).isTrue(); // Subsequent queries do not trigger another load requestWasSent.set(false); assertThat(account.getTermsOfServiceAgreed().orElseThrow()).isTrue(); assertThat(account.getStatus()).isEqualTo(Status.VALID); assertThat(requestWasSent.get()).isFalse(); provider.close(); } /** * Test that a domain can be pre-authorized. */ @Test public void testPreAuthorizeDomain() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("newAuthorizationRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("newAuthorizationResponse"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putTestResource(Resource.NEW_AUTHZ, resourceUrl); provider.putTestChallenge(Http01Challenge.TYPE, Http01Challenge::new); provider.putTestChallenge(Dns01Challenge.TYPE, Dns01Challenge::new); var domainName = "example.org"; var account = new Account(login, locationUrl); var auth = account.preAuthorize(Identifier.dns(domainName)); assertThat(auth.getIdentifier().getDomain()).isEqualTo(domainName); assertThat(auth.getStatus()).isEqualTo(Status.PENDING); assertThat(auth.getExpires()).isEmpty(); assertThat(auth.getLocation()).isEqualTo(locationUrl); assertThat(auth.getChallenges()).containsExactlyInAnyOrder( provider.getChallenge(Http01Challenge.TYPE), provider.getChallenge(Dns01Challenge.TYPE)); provider.close(); } /** * Test that pre-authorization with subdomains fails if not supported. */ @Test public void testPreAuthorizeDomainSubdomainsFails() throws Exception { var provider = new TestableConnectionProvider(); var login = provider.createLogin(); provider.putTestResource(Resource.NEW_AUTHZ, resourceUrl); assertThat(login.getSession().getMetadata().isSubdomainAuthAllowed()).isFalse(); var account = new Account(login, locationUrl); assertThatExceptionOfType(AcmeNotSupportedException.class).isThrownBy(() -> account.preAuthorize(Identifier.dns("example.org").allowSubdomainAuth()) ); provider.close(); } /** * Test that a domain can be pre-authorized, with allowed subdomains. */ @Test public void testPreAuthorizeDomainSubdomains() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("newAuthorizationRequestSub").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("newAuthorizationResponseSub"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putMetadata("subdomainAuthAllowed", true); provider.putTestResource(Resource.NEW_AUTHZ, resourceUrl); provider.putTestChallenge(Dns01Challenge.TYPE, Dns01Challenge::new); var domainName = "example.org"; var account = new Account(login, locationUrl); var auth = account.preAuthorize(Identifier.dns(domainName).allowSubdomainAuth()); assertThat(login.getSession().getMetadata().isSubdomainAuthAllowed()).isTrue(); assertThat(auth.getIdentifier().getDomain()).isEqualTo(domainName); assertThat(auth.getStatus()).isEqualTo(Status.PENDING); assertThat(auth.getExpires()).isEmpty(); assertThat(auth.getLocation()).isEqualTo(locationUrl); assertThat(auth.isSubdomainAuthAllowed()).isTrue(); assertThat(auth.getChallenges()).containsExactlyInAnyOrder( provider.getChallenge(Dns01Challenge.TYPE)); provider.close(); } /** * Test that a domain pre-authorization can fail. */ @Test public void testNoPreAuthorizeDomain() throws Exception { var problemType = URI.create("urn:ietf:params:acme:error:rejectedIdentifier"); var problemDetail = "example.org is blacklisted"; var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) throws AcmeException { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("newAuthorizationRequest").toString()); assertThat(login).isNotNull(); var problem = TestUtils.createProblem(problemType, problemDetail, resourceUrl); throw new AcmeServerException(problem); } }; var login = provider.createLogin(); provider.putTestResource(Resource.NEW_AUTHZ, resourceUrl); var account = new Account(login, locationUrl); var ex = assertThrows(AcmeServerException.class, () -> account.preAuthorizeDomain("example.org") ); assertThat(ex.getType()).isEqualTo(problemType); assertThat(ex.getMessage()).isEqualTo(problemDetail); provider.close(); } /** * Test that a bad domain parameter is not accepted. */ @Test public void testAuthorizeBadDomain() throws Exception { var provider = new TestableConnectionProvider(); // just provide a resource record so the provider returns a directory provider.putTestResource(Resource.NEW_NONCE, resourceUrl); var login = provider.createLogin(); var account = login.getAccount(); assertThatNullPointerException() .isThrownBy(() -> account.preAuthorizeDomain(null)); assertThatIllegalArgumentException() .isThrownBy(() -> account.preAuthorizeDomain("")); assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(() -> account.preAuthorizeDomain("example.com")) .withMessage("Server does not support newAuthz"); provider.close(); } /** * Test that the account key can be changed. */ @Test public void testChangeKey() throws Exception { var oldKeyPair = TestUtils.createKeyPair(); var newKeyPair = TestUtils.createDomainKeyPair(); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder payload, Login login) { try { assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); assertThat(login.getPublicKey()).isSameAs(oldKeyPair.getPublic()); var json = payload.toJSON(); var encodedHeader = json.get("protected").asString(); var encodedSignature = json.get("signature").asString(); var encodedPayload = json.get("payload").asString(); var serialized = CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature); var jws = new JsonWebSignature(); jws.setCompactSerialization(serialized); jws.setKey(newKeyPair.getPublic()); assertThat(jws.verifySignature()).isTrue(); var decodedPayload = jws.getPayload(); var expectedPayload = new StringBuilder(); expectedPayload.append('{'); expectedPayload.append("\"account\":\"").append(locationUrl).append("\","); expectedPayload.append("\"oldKey\":{"); expectedPayload.append("\"kty\":\"").append(TestUtils.KTY).append("\","); expectedPayload.append("\"e\":\"").append(TestUtils.E).append("\","); expectedPayload.append("\"n\":\"").append(TestUtils.N).append("\""); expectedPayload.append("}}"); assertThatJson(decodedPayload).isEqualTo(expectedPayload.toString()); } catch (JoseException ex) { fail(ex); } return HttpURLConnection.HTTP_OK; } @Override public URL getLocation() { return locationUrl; } }; provider.putTestResource(Resource.KEY_CHANGE, locationUrl); var session = TestUtils.session(provider); var login = new Login(locationUrl, oldKeyPair, session); assertThat(login.getPublicKey()).isSameAs(oldKeyPair.getPublic()); var account = new Account(login, locationUrl); account.changeKey(newKeyPair); assertThat(login.getPublicKey()).isSameAs(newKeyPair.getPublic()); } /** * Test that the same account key is not accepted for change. */ @Test public void testChangeSameKey() { assertThrows(IllegalArgumentException.class, () -> { var provider = new TestableConnectionProvider(); var login = provider.createLogin(); var account = new Account(login, locationUrl); account.changeKey(provider.getAccountKeyPair()); provider.close(); }); } /** * Test that an account can be deactivated. */ @Test public void testDeactivate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { var json = claims.toJSON(); assertThat(json.get("status").asString()).isEqualTo("deactivated"); assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("deactivateAccountResponse"); } }; var account = new Account(provider.createLogin(), locationUrl); account.deactivate(); assertThat(account.getStatus()).isEqualTo(Status.DEACTIVATED); provider.close(); } /** * Test that a new order can be created. */ @Test public void testNewOrder() throws AcmeException, IOException { var provider = new TestableConnectionProvider(); var login = provider.createLogin(); var account = new Account(login, locationUrl); assertThat(account.newOrder()).isNotNull(); provider.close(); } /** * Test that an account can be modified. */ @Test public void testModify() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(locationUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("modifyAccount").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("modifyAccountResponse"); } @Override public URL getLocation() { return locationUrl; } }; var account = new Account(provider.createLogin(), locationUrl); account.setJSON(getJSON("newAccount")); var editable = account.modify(); assertThat(editable).isNotNull(); editable.addContact("mailto:foo2@example.com"); editable.getContacts().add(URI.create("mailto:foo3@example.com")); editable.commit(); assertThat(account.getLocation()).isEqualTo(locationUrl); assertThat(account.getContacts()).hasSize(3); assertThat(account.getContacts()).element(0).isEqualTo(URI.create("mailto:foo@example.com")); assertThat(account.getContacts()).element(1).isEqualTo(URI.create("mailto:foo2@example.com")); assertThat(account.getContacts()).element(2).isEqualTo(URI.create("mailto:foo3@example.com")); provider.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/AcmeJsonResourceTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.Serial; import java.net.URL; import java.time.Instant; import java.util.Optional; import edu.umd.cs.findbugs.annotations.Nullable; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link AcmeJsonResource}. */ public class AcmeJsonResourceTest { private static final JSON JSON_DATA = getJSON("newAccountResponse"); private static final URL LOCATION_URL = url("https://example.com/acme/resource/123"); /** * Test {@link AcmeJsonResource#AcmeJsonResource(Login, URL)}. */ @Test public void testLoginConstructor() { var login = TestUtils.login(); var resource = new DummyJsonResource(login, LOCATION_URL); assertThat(resource.getLogin()).isEqualTo(login); assertThat(resource.getSession()).isEqualTo(login.getSession()); assertThat(resource.getLocation()).isEqualTo(LOCATION_URL); assertThat(resource.isValid()).isFalse(); assertThat(resource.getRetryAfter()).isEmpty(); assertUpdateInvoked(resource, 0); assertThat(resource.getJSON()).isEqualTo(JSON_DATA); assertThat(resource.isValid()).isTrue(); assertUpdateInvoked(resource, 1); } /** * Test {@link AcmeJsonResource#setJSON(JSON)}. */ @Test public void testSetJson() { var login = TestUtils.login(); var jsonData2 = getJSON("requestOrderResponse"); var resource = new DummyJsonResource(login, LOCATION_URL); assertThat(resource.isValid()).isFalse(); assertUpdateInvoked(resource, 0); resource.setJSON(JSON_DATA); assertThat(resource.getJSON()).isEqualTo(JSON_DATA); assertThat(resource.isValid()).isTrue(); assertUpdateInvoked(resource, 0); resource.setJSON(jsonData2); assertThat(resource.getJSON()).isEqualTo(jsonData2); assertThat(resource.isValid()).isTrue(); assertUpdateInvoked(resource, 0); } /** * Test Retry-After */ @Test public void testRetryAfter() { var login = TestUtils.login(); var retryAfter = Instant.now().plusSeconds(30L); var jsonData = getJSON("requestOrderResponse"); var resource = new DummyJsonResource(login, LOCATION_URL, jsonData, retryAfter); assertThat(resource.isValid()).isTrue(); assertThat(resource.getJSON()).isEqualTo(jsonData); assertThat(resource.getRetryAfter()).hasValue(retryAfter); assertUpdateInvoked(resource, 0); resource.setRetryAfter(null); assertThat(resource.getRetryAfter()).isEmpty(); } /** * Test {@link AcmeJsonResource#invalidate()}. */ @Test public void testInvalidate() { var login = TestUtils.login(); var resource = new DummyJsonResource(login, LOCATION_URL); assertThat(resource.isValid()).isFalse(); assertUpdateInvoked(resource, 0); resource.setJSON(JSON_DATA); assertThat(resource.isValid()).isTrue(); assertUpdateInvoked(resource, 0); resource.invalidate(); assertThat(resource.isValid()).isFalse(); assertUpdateInvoked(resource, 0); assertThat(resource.getJSON()).isEqualTo(JSON_DATA); assertThat(resource.isValid()).isTrue(); assertUpdateInvoked(resource, 1); } /** * Assert that {@link AcmeJsonResource#update()} has been invoked a given number of * times. * * @param resource * {@link AcmeJsonResource} to test * @param count * Expected number of times */ private static void assertUpdateInvoked(AcmeJsonResource resource, int count) { var dummy = (DummyJsonResource) resource; assertThat(dummy.updateCount).as("update counter").isEqualTo(count); } /** * Minimum implementation of {@link AcmeJsonResource}. */ private static class DummyJsonResource extends AcmeJsonResource { @Serial private static final long serialVersionUID = -6459238185161771948L; private int updateCount = 0; public DummyJsonResource(Login login, URL location) { super(login, location); } public DummyJsonResource(Login login, URL location, JSON json, @Nullable Instant retryAfter) { super(login, location); setJSON(json); setRetryAfter(retryAfter); } @Override public Optional fetch() throws AcmeException { // fetch() is tested individually in all AcmeJsonResource subclasses. // Here we just simulate the update, by setting a JSON. updateCount++; setJSON(JSON_DATA); return Optional.empty(); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/AcmeResourceTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.io.Serial; import java.net.URI; import java.net.URL; import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link AcmeResource}. */ public class AcmeResourceTest { /** * Test constructors and setters */ @Test public void testConstructor() throws Exception { var login = TestUtils.login(); var location = URI.create("http://example.com/acme/resource").toURL(); assertThrows(NullPointerException.class, () -> new DummyResource(null, null)); var resource = new DummyResource(login, location); assertThat(resource.getLogin()).isEqualTo(login); assertThat(resource.getLocation()).isEqualTo(location); } /** * Test if {@link AcmeResource} is properly serialized. */ @Test public void testSerialization() throws Exception { var login = TestUtils.login(); var location = URI.create("http://example.com/acme/resource").toURL(); // Create a Challenge for testing var challenge = new DummyResource(login, location); assertThat(challenge.getLogin()).isEqualTo(login); // Serialize it byte[] serialized; try (var baos = new ByteArrayOutputStream()) { try (var out = new ObjectOutputStream(baos)) { out.writeObject(challenge); } serialized = baos.toByteArray(); } // Make sure there is no PrivateKey in the stream var str = new String(serialized, StandardCharsets.ISO_8859_1); assertThat(str).as("serialized stream contains a PrivateKey") .doesNotContain("Ljava/security/PrivateKey"); // Deserialize to new object DummyResource restored; try (var bais = new ByteArrayInputStream(serialized); var in = new ObjectInputStream(bais)) { var obj = in.readObject(); assertThat(obj).isInstanceOf(DummyResource.class); restored = (DummyResource) obj; } assertThat(restored).isNotSameAs(challenge); // Make sure the restored object is not attached to a login assertThrows(IllegalStateException.class, restored::getLogin); // Rebind to login restored.rebind(login); // Make sure the new login is set assertThat(restored.getLogin()).isEqualTo(login); } /** * Test if a rebind attempt fails. */ @Test public void testRebind() { assertThrows(IllegalStateException.class, () -> { var login = TestUtils.login(); var location = URI.create("http://example.com/acme/resource").toURL(); var resource = new DummyResource(login, location); assertThat(resource.getLogin()).isEqualTo(login); var login2 = TestUtils.login(); resource.rebind(login2); // fails to rebind to another login }); } /** * Minimum implementation of {@link AcmeResource}. */ private static class DummyResource extends AcmeResource { @Serial private static final long serialVersionUID = 7188822681353082472L; public DummyResource(Login login, URL location) { super(login, location); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/AuthorizationTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.within; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.IOException; import java.net.HttpURLConnection; import java.net.URL; import java.time.Duration; import java.time.Instant; import java.time.temporal.ChronoUnit; import java.util.Optional; import java.util.concurrent.atomic.AtomicBoolean; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.challenge.TlsAlpn01Challenge; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Unit tests for {@link Authorization}. */ public class AuthorizationTest { private static final String SNAILMAIL_TYPE = "snail-01"; // a non-existent challenge private static final String DUPLICATE_TYPE = "duplicate-01"; // a duplicate challenge private final URL locationUrl = url("http://example.com/acme/account"); /** * Test that {@link Authorization#findChallenge(String)} finds challenges. */ @Test public void testFindChallenge() throws IOException { var authorization = createChallengeAuthorization(); // A snail mail challenge is not available at all var c1 = authorization.findChallenge(SNAILMAIL_TYPE); assertThat(c1).isEmpty(); // HttpChallenge is available var c2 = authorization.findChallenge(Http01Challenge.TYPE); assertThat(c2).isNotEmpty(); assertThat(c2.get()).isInstanceOf(Http01Challenge.class); // Dns01Challenge is available var c3 = authorization.findChallenge(Dns01Challenge.TYPE); assertThat(c3).isNotEmpty(); assertThat(c3.get()).isInstanceOf(Dns01Challenge.class); // TlsAlpn01Challenge is available var c4 = authorization.findChallenge(TlsAlpn01Challenge.TYPE); assertThat(c4).isNotEmpty(); assertThat(c4.get()).isInstanceOf(TlsAlpn01Challenge.class); } /** * Test that {@link Authorization#findChallenge(Class)} finds challenges. */ @Test public void testFindChallengeByType() throws IOException { var authorization = createChallengeAuthorization(); // A snail mail challenge is not available at all var c1 = authorization.findChallenge(NonExistingChallenge.class); assertThat(c1).isEmpty(); // HttpChallenge is available var c2 = authorization.findChallenge(Http01Challenge.class); assertThat(c2).isNotEmpty(); // Dns01Challenge is available var c3 = authorization.findChallenge(Dns01Challenge.class); assertThat(c3).isNotEmpty(); // TlsAlpn01Challenge is available var c4 = authorization.findChallenge(TlsAlpn01Challenge.class); assertThat(c4).isNotEmpty(); } /** * Test that {@link Authorization#findChallenge(String)} fails on duplicate * challenges. */ @Test public void testFailDuplicateChallenges() { assertThrows(AcmeProtocolException.class, () -> { var authorization = createChallengeAuthorization(); authorization.findChallenge(DUPLICATE_TYPE); }); } /** * Test that authorization is properly updated. */ @Test public void testUpdate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAuthorizationResponse"); } }; var login = provider.createLogin(); provider.putTestChallenge("http-01", Http01Challenge::new); provider.putTestChallenge("dns-01", Dns01Challenge::new); provider.putTestChallenge("tls-alpn-01", TlsAlpn01Challenge::new); var auth = new Authorization(login, locationUrl); auth.fetch(); assertThat(auth.getIdentifier().getDomain()).isEqualTo("example.org"); assertThat(auth.getStatus()).isEqualTo(Status.VALID); assertThat(auth.isWildcard()).isFalse(); assertThat(auth.getExpires().orElseThrow()).isCloseTo("2016-01-02T17:12:40Z", within(1, ChronoUnit.SECONDS)); assertThat(auth.getLocation()).isEqualTo(locationUrl); assertThat(auth.getChallenges()).containsExactlyInAnyOrder( provider.getChallenge(Http01Challenge.TYPE), provider.getChallenge(Dns01Challenge.TYPE), provider.getChallenge(TlsAlpn01Challenge.TYPE)); provider.close(); } /** * Test that wildcard authorization are correct. */ @Test public void testWildcard() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAuthorizationWildcardResponse"); } }; var login = provider.createLogin(); provider.putTestChallenge("dns-01", Dns01Challenge::new); var auth = new Authorization(login, locationUrl); auth.fetch(); assertThat(auth.getIdentifier().getDomain()).isEqualTo("example.org"); assertThat(auth.getStatus()).isEqualTo(Status.VALID); assertThat(auth.isWildcard()).isTrue(); assertThat(auth.getExpires().orElseThrow()).isCloseTo("2016-01-02T17:12:40Z", within(1, ChronoUnit.SECONDS)); assertThat(auth.getLocation()).isEqualTo(locationUrl); assertThat(auth.getChallenges()).containsExactlyInAnyOrder( provider.getChallenge(Dns01Challenge.TYPE)); provider.close(); } /** * Test lazy loading. */ @Test public void testLazyLoading() throws Exception { var requestWasSent = new AtomicBoolean(false); var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { requestWasSent.set(true); assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAuthorizationResponse"); } }; var login = provider.createLogin(); provider.putTestChallenge("http-01", Http01Challenge::new); provider.putTestChallenge("dns-01", Dns01Challenge::new); provider.putTestChallenge("tls-alpn-01", TlsAlpn01Challenge::new); var auth = new Authorization(login, locationUrl); // Lazy loading assertThat(requestWasSent).isFalse(); assertThat(auth.getIdentifier().getDomain()).isEqualTo("example.org"); assertThat(requestWasSent).isTrue(); // Subsequent queries do not trigger another load requestWasSent.set(false); assertThat(auth.getIdentifier().getDomain()).isEqualTo("example.org"); assertThat(auth.getStatus()).isEqualTo(Status.VALID); assertThat(auth.isWildcard()).isFalse(); assertThat(auth.getExpires().orElseThrow()).isCloseTo("2016-01-02T17:12:40Z", within(1, ChronoUnit.SECONDS)); assertThat(requestWasSent).isFalse(); provider.close(); } /** * Test that authorization is properly updated, with retry-after header set. */ @Test public void testUpdateRetryAfter() throws Exception { var retryAfter = Instant.now().plus(Duration.ofSeconds(30)); var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAuthorizationResponse"); } @Override public Optional getRetryAfter() { return Optional.of(retryAfter); } }; var login = provider.createLogin(); provider.putTestChallenge("http-01", Http01Challenge::new); provider.putTestChallenge("dns-01", Dns01Challenge::new); provider.putTestChallenge("tls-alpn-01", TlsAlpn01Challenge::new); var auth = new Authorization(login, locationUrl); var returnedRetryAfter = auth.fetch(); assertThat(returnedRetryAfter).hasValue(retryAfter); assertThat(auth.getIdentifier().getDomain()).isEqualTo("example.org"); assertThat(auth.getStatus()).isEqualTo(Status.VALID); assertThat(auth.isWildcard()).isFalse(); assertThat(auth.getExpires().orElseThrow()).isCloseTo("2016-01-02T17:12:40Z", within(1, ChronoUnit.SECONDS)); assertThat(auth.getLocation()).isEqualTo(locationUrl); assertThat(auth.getChallenges()).containsExactlyInAnyOrder( provider.getChallenge(Http01Challenge.TYPE), provider.getChallenge(Dns01Challenge.TYPE), provider.getChallenge(TlsAlpn01Challenge.TYPE)); provider.close(); } /** * Test that an authorization can be deactivated. */ @Test public void testDeactivate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { var json = claims.toJSON(); assertThat(json.get("status").asString()).isEqualTo("deactivated"); assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAuthorizationResponse"); } }; var login = provider.createLogin(); provider.putTestChallenge("http-01", Http01Challenge::new); provider.putTestChallenge("dns-01", Dns01Challenge::new); provider.putTestChallenge("tls-alpn-01", TlsAlpn01Challenge::new); var auth = new Authorization(login, locationUrl); auth.deactivate(); provider.close(); } /** * Creates an {@link Authorization} instance with a set of challenges. */ private Authorization createChallengeAuthorization() throws IOException { try (var provider = new TestableConnectionProvider()) { var login = provider.createLogin(); provider.putTestChallenge(Http01Challenge.TYPE, Http01Challenge::new); provider.putTestChallenge(Dns01Challenge.TYPE, Dns01Challenge::new); provider.putTestChallenge(TlsAlpn01Challenge.TYPE, TlsAlpn01Challenge::new); provider.putTestChallenge(DUPLICATE_TYPE, Challenge::new); var authorization = new Authorization(login, locationUrl); authorization.setJSON(getJSON("authorizationChallenges")); return authorization; } } /** * Dummy challenge that is never going to be created. */ private static class NonExistingChallenge extends Challenge { public NonExistingChallenge(Login login, JSON data) { super(login, data); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/CertificateTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.*; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.OutputStreamWriter; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.security.cert.X509Certificate; import java.time.Instant; import java.time.ZonedDateTime; import java.time.temporal.ChronoUnit; import java.util.Arrays; import java.util.Collection; import java.util.Collections; import java.util.List; import java.util.Optional; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.connector.RequestSigner; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Certificate}. */ public class CertificateTest { private final URL resourceUrl = url("http://example.com/acme/resource"); private final URL locationUrl = url("http://example.com/acme/certificate"); private final URL alternate1Url = url("https://example.com/acme/alt-cert/1"); private final URL alternate2Url = url("https://example.com/acme/alt-cert/2"); /** * Test that a certificate can be downloaded. */ @Test public void testDownload() throws Exception { var originalCert = TestUtils.createCertificate("/cert.pem"); var alternateCert = TestUtils.createCertificate("/certid-cert.pem"); var provider = new TestableConnectionProvider() { List sendCert; @Override public int sendCertificateRequest(URL url, Login login) { assertThat(url).isIn(locationUrl, alternate1Url, alternate2Url); assertThat(login).isNotNull(); if (locationUrl.equals(url)) { sendCert = originalCert; } else { sendCert = alternateCert; } return HttpURLConnection.HTTP_OK; } @Override public List readCertificates() { return sendCert; } @Override public Collection getLinks(String relation) { assertThat(relation).isEqualTo("alternate"); return Arrays.asList(alternate1Url, alternate2Url); } }; var cert = new Certificate(provider.createLogin(), locationUrl); cert.download(); var downloadedCert = cert.getCertificate(); assertThat(downloadedCert.getEncoded()).isEqualTo(originalCert.get(0).getEncoded()); var downloadedChain = cert.getCertificateChain(); assertThat(downloadedChain).hasSize(originalCert.size()); for (var ix = 0; ix < downloadedChain.size(); ix++) { assertThat(downloadedChain.get(ix).getEncoded()).isEqualTo(originalCert.get(ix).getEncoded()); } byte[] writtenPem; byte[] originalPem; try (var baos = new ByteArrayOutputStream(); var w = new OutputStreamWriter(baos)) { cert.writeCertificate(w); w.flush(); writtenPem = baos.toByteArray(); } try (var baos = new ByteArrayOutputStream(); var in = getClass().getResourceAsStream("/cert.pem")) { int len; var buffer = new byte[2048]; while((len = in.read(buffer)) >= 0) { baos.write(buffer, 0, len); } originalPem = baos.toByteArray(); } assertThat(writtenPem).isEqualTo(originalPem); assertThat(cert.isIssuedBy("The ACME CA X1")).isFalse(); assertThat(cert.isIssuedBy(CERT_ISSUER)).isTrue(); assertThat(cert.getAlternates()).isNotNull(); assertThat(cert.getAlternates()).hasSize(2); assertThat(cert.getAlternates()).element(0).isEqualTo(alternate1Url); assertThat(cert.getAlternates()).element(1).isEqualTo(alternate2Url); assertThat(cert.getAlternateCertificates()).isNotNull(); assertThat(cert.getAlternateCertificates()).hasSize(2); assertThat(cert.getAlternateCertificates()) .element(0) .extracting(Certificate::getLocation) .isEqualTo(alternate1Url); assertThat(cert.getAlternateCertificates()) .element(1) .extracting(Certificate::getLocation) .isEqualTo(alternate2Url); assertThat(cert.findCertificate("The ACME CA X1")). isEmpty(); assertThat(cert.findCertificate(CERT_ISSUER).orElseThrow()) .isSameAs(cert); assertThat(cert.findCertificate("minica root ca 3a1356").orElseThrow()) .isSameAs(cert.getAlternateCertificates().get(0)); assertThat(cert.getAlternateCertificates().get(0).isIssuedBy("minica root ca 3a1356")) .isTrue(); provider.close(); } /** * Test that a certificate can be revoked. */ @Test public void testRevokeCertificate() throws AcmeException, IOException { var originalCert = TestUtils.createCertificate("/cert.pem"); var provider = new TestableConnectionProvider() { private boolean certRequested = false; @Override public int sendCertificateRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); certRequested = true; return HttpURLConnection.HTTP_OK; } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("revokeCertificateRequest").toString()); assertThat(login).isNotNull(); certRequested = false; return HttpURLConnection.HTTP_OK; } @Override public List readCertificates() { assertThat(certRequested).isTrue(); return originalCert; } @Override public Collection getLinks(String relation) { assertThat(relation).isEqualTo("alternate"); return Collections.emptyList(); } }; provider.putTestResource(Resource.REVOKE_CERT, resourceUrl); var cert = new Certificate(provider.createLogin(), locationUrl); cert.revoke(); provider.close(); } /** * Test that a certificate can be revoked with reason. */ @Test public void testRevokeCertificateWithReason() throws AcmeException, IOException { var originalCert = TestUtils.createCertificate("/cert.pem"); var provider = new TestableConnectionProvider() { private boolean certRequested = false; @Override public int sendCertificateRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); certRequested = true; return HttpURLConnection.HTTP_OK; } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("revokeCertificateWithReasonRequest").toString()); assertThat(login).isNotNull(); certRequested = false; return HttpURLConnection.HTTP_OK; } @Override public List readCertificates() { assertThat(certRequested).isTrue(); return originalCert; } @Override public Collection getLinks(String relation) { assertThat(relation).isEqualTo("alternate"); return Collections.emptyList(); } }; provider.putTestResource(Resource.REVOKE_CERT, resourceUrl); var cert = new Certificate(provider.createLogin(), locationUrl); cert.revoke(RevocationReason.KEY_COMPROMISE); provider.close(); } /** * Test that numeric revocation reasons are correctly translated. */ @Test public void testRevocationReason() { assertThat(RevocationReason.code(1)) .isEqualTo(RevocationReason.KEY_COMPROMISE); } /** * Test that a certificate can be revoked by its domain key pair. */ @Test public void testRevokeCertificateByKeyPair() throws AcmeException, IOException { var originalCert = TestUtils.createCertificate("/cert.pem"); var certKeyPair = TestUtils.createDomainKeyPair(); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("revokeCertificateWithReasonRequest").toString()); assertThat(session).isNotNull(); return HttpURLConnection.HTTP_OK; } }; provider.putTestResource(Resource.REVOKE_CERT, resourceUrl); var session = provider.createSession(); Certificate.revoke(session, certKeyPair, originalCert.get(0), RevocationReason.KEY_COMPROMISE); provider.close(); } /** * Test that RenewalInfo is returned. */ @Test public void testRenewalInfo() throws AcmeException, IOException { // certid-cert.pem and certId provided by ACME ARI specs and known good var certId = "aYhba4dGQEHhs3uEe6CuLN4ByNQ.AIdlQyE"; var certIdCert = TestUtils.createCertificate("/certid-cert.pem"); var certResourceUrl = URI.create(resourceUrl.toExternalForm() + "/" + certId).toURL(); var retryAfterInstant = Instant.now().plus(10L, ChronoUnit.DAYS); var provider = new TestableConnectionProvider() { private boolean certRequested = false; private boolean infoRequested = false; @Override public int sendCertificateRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); certRequested = true; return HttpURLConnection.HTTP_OK; } @Override public int sendRequest(URL url, Session session, ZonedDateTime ifModifiedSince) { assertThat(url).isEqualTo(certResourceUrl); assertThat(session).isNotNull(); assertThat(ifModifiedSince).isNull(); infoRequested = true; return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { assertThat(infoRequested).isTrue(); return getJSON("renewalInfo"); } @Override public List readCertificates() { assertThat(certRequested).isTrue(); return certIdCert; } @Override public Collection getLinks(String relation) { return Collections.emptyList(); } @Override public Optional getRetryAfter() { return Optional.of(retryAfterInstant); } }; provider.putTestResource(Resource.RENEWAL_INFO, resourceUrl); var cert = new Certificate(provider.createLogin(), locationUrl); assertThat(cert.hasRenewalInfo()).isTrue(); assertThat(cert.getRenewalInfoLocation()) .hasValue(certResourceUrl); var renewalInfo = cert.getRenewalInfo(); assertThat(renewalInfo.getRetryAfter()) .isEmpty(); assertThat(renewalInfo.getSuggestedWindowStart()) .isEqualTo("2021-01-03T00:00:00Z"); assertThat(renewalInfo.getSuggestedWindowEnd()) .isEqualTo("2021-01-07T00:00:00Z"); assertThat(renewalInfo.getExplanation()) .isNotEmpty() .contains(url("https://example.com/docs/example-mass-reissuance-event")); assertThat(renewalInfo.fetch()).hasValue(retryAfterInstant); assertThat(renewalInfo.getRetryAfter()).hasValue(retryAfterInstant); provider.close(); } /** * Test that a certificate is marked as replaced. */ @Test public void testMarkedAsReplaced() throws AcmeException, IOException { // certid-cert.pem and certId provided by ACME ARI specs and known good var certId = "aYhba4dGQEHhs3uEe6CuLN4ByNQ.AIdlQyE"; var certIdCert = TestUtils.createCertificate("/certid-cert.pem"); var certResourceUrl = URI.create(resourceUrl.toExternalForm() + "/" + certId).toURL(); var provider = new TestableConnectionProvider() { private boolean certRequested = false; @Override public int sendCertificateRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); certRequested = true; return HttpURLConnection.HTTP_OK; } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(certRequested).isTrue(); assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("replacedCertificateRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_OK; } @Override public List readCertificates() { assertThat(certRequested).isTrue(); return certIdCert; } @Override public Collection getLinks(String relation) { return Collections.emptyList(); } }; provider.putTestResource(Resource.RENEWAL_INFO, resourceUrl); var cert = new Certificate(provider.createLogin(), locationUrl); assertThat(cert.hasRenewalInfo()).isTrue(); assertThat(cert.getRenewalInfoLocation()).hasValue(certResourceUrl); provider.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/IdentifierTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.*; import static org.junit.jupiter.api.Assertions.assertThrows; import java.net.InetAddress; import java.net.UnknownHostException; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Unit tests for {@link Identifier}. */ public class IdentifierTest { @Test public void testConstants() { assertThat(Identifier.TYPE_DNS).isEqualTo("dns"); assertThat(Identifier.TYPE_IP).isEqualTo("ip"); } @Test public void testGetters() { var id1 = new Identifier("foo", "123.456"); assertThat(id1.getType()).isEqualTo("foo"); assertThat(id1.getValue()).isEqualTo("123.456"); assertThat(id1.toString()).isEqualTo("foo=123.456"); var map1 = id1.toMap(); assertThat(map1).hasSize(2); assertThat(map1.get("type")).isEqualTo("foo"); assertThat(map1.get("value")).isEqualTo("123.456"); var jb = new JSONBuilder(); jb.put("type", "bar"); jb.put("value", "654.321"); var id2 = new Identifier(jb.toJSON()); assertThat(id2.getType()).isEqualTo("bar"); assertThat(id2.getValue()).isEqualTo("654.321"); assertThat(id2.toString()).isEqualTo("bar=654.321"); var map2 = id2.toMap(); assertThat(map2).hasSize(2); assertThat(map2.get("type")).isEqualTo("bar"); assertThat(map2.get("value")).isEqualTo("654.321"); } @Test public void testDns() { var id1 = Identifier.dns("example.com"); assertThat(id1.getType()).isEqualTo(Identifier.TYPE_DNS); assertThat(id1.getValue()).isEqualTo("example.com"); assertThat(id1.getDomain()).isEqualTo("example.com"); var id2 = Identifier.dns("ëxämþlë.com"); assertThat(id2.getType()).isEqualTo(Identifier.TYPE_DNS); assertThat(id2.getValue()).isEqualTo("xn--xml-qla7ae5k.com"); assertThat(id2.getDomain()).isEqualTo("xn--xml-qla7ae5k.com"); } @Test public void testNoDns() { assertThrows(AcmeProtocolException.class, () -> new Identifier("foo", "example.com").getDomain() ); } @Test public void testIp() throws UnknownHostException { var id1 = Identifier.ip(InetAddress.getByName("192.0.2.2")); assertThat(id1.getType()).isEqualTo(Identifier.TYPE_IP); assertThat(id1.getValue()).isEqualTo("192.0.2.2"); assertThat(id1.getIP().getHostAddress()).isEqualTo("192.0.2.2"); var id2 = Identifier.ip(InetAddress.getByName("2001:db8:85a3::8a2e:370:7334")); assertThat(id2.getType()).isEqualTo(Identifier.TYPE_IP); assertThat(id2.getValue()).isEqualTo("2001:db8:85a3:0:0:8a2e:370:7334"); assertThat(id2.getIP().getHostAddress()).isEqualTo("2001:db8:85a3:0:0:8a2e:370:7334"); var id3 = Identifier.ip("192.0.2.99"); assertThat(id3.getType()).isEqualTo(Identifier.TYPE_IP); assertThat(id3.getValue()).isEqualTo("192.0.2.99"); assertThat(id3.getIP().getHostAddress()).isEqualTo("192.0.2.99"); } @Test public void testNoIp() { assertThrows(AcmeProtocolException.class, () -> new Identifier("foo", "example.com").getIP() ); } @Test public void testAncestorDomain() { var id1 = Identifier.dns("foo.bar.example.com"); var id1a = id1.withAncestorDomain("example.com"); assertThat(id1a).isNotSameAs(id1); assertThat(id1a.getType()).isEqualTo(Identifier.TYPE_DNS); assertThat(id1a.getValue()).isEqualTo("foo.bar.example.com"); assertThat(id1a.getDomain()).isEqualTo("foo.bar.example.com"); assertThat(id1a.toMap()).contains( entry("type", "dns"), entry("value", "foo.bar.example.com"), entry("ancestorDomain", "example.com") ); assertThat(id1a.toString()).isEqualTo("{ancestorDomain=example.com, type=dns, value=foo.bar.example.com}"); var id2 = Identifier.dns("föö.ëxämþlë.com").withAncestorDomain("ëxämþlë.com"); assertThat(id2.getType()).isEqualTo(Identifier.TYPE_DNS); assertThat(id2.getValue()).isEqualTo("xn--f-1gaa.xn--xml-qla7ae5k.com"); assertThat(id2.getDomain()).isEqualTo("xn--f-1gaa.xn--xml-qla7ae5k.com"); assertThat(id2.toMap()).contains( entry("type", "dns"), entry("value", "xn--f-1gaa.xn--xml-qla7ae5k.com"), entry("ancestorDomain", "xn--xml-qla7ae5k.com") ); var id3 = Identifier.dns("foo.bar.example.com").withAncestorDomain("example.com"); assertThat(id3.equals(id1)).isFalse(); assertThat(id3.equals(id1a)).isTrue(); assertThatExceptionOfType(AcmeProtocolException.class).isThrownBy(() -> Identifier.ip("192.0.2.99").withAncestorDomain("example.com") ); assertThatNullPointerException().isThrownBy(() -> Identifier.dns("example.org").withAncestorDomain(null) ); } @Test public void testAllowSubdomainAuth() { var id1 = Identifier.dns("example.com"); var id1a = id1.allowSubdomainAuth(); assertThat(id1a).isNotSameAs(id1); assertThat(id1a.getType()).isEqualTo(Identifier.TYPE_DNS); assertThat(id1a.getValue()).isEqualTo("example.com"); assertThat(id1a.getDomain()).isEqualTo("example.com"); assertThat(id1a.toMap()).contains( entry("type", "dns"), entry("value", "example.com"), entry("subdomainAuthAllowed", true) ); assertThat(id1a.toString()).isEqualTo("{subdomainAuthAllowed=true, type=dns, value=example.com}"); var id3 = Identifier.dns("example.com").allowSubdomainAuth(); assertThat(id3.equals(id1)).isFalse(); assertThat(id3.equals(id1a)).isTrue(); assertThatExceptionOfType(AcmeProtocolException.class).isThrownBy(() -> Identifier.ip("192.0.2.99").allowSubdomainAuth() ); } @Test public void testEquals() { var idRef = new Identifier("foo", "123.456"); var id1 = new Identifier("foo", "123.456"); assertThat(idRef.equals(id1)).isTrue(); assertThat(id1.equals(idRef)).isTrue(); var id2 = new Identifier("bar", "654.321"); assertThat(idRef.equals(id2)).isFalse(); var id3 = new Identifier("foo", "555.666"); assertThat(idRef.equals(id3)).isFalse(); var id4 = new Identifier("sna", "123.456"); assertThat(idRef.equals(id4)).isFalse(); assertThat(idRef.equals(new Object())).isFalse(); assertThat(idRef.equals(null)).isFalse(); } @Test public void testNull() { assertThrows(NullPointerException.class, () -> new Identifier(null, "123.456")); assertThrows(NullPointerException.class, () -> new Identifier("foo", null)); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/LoginTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.mockito.Mockito.*; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.IOException; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import org.junit.jupiter.api.Test; import org.mockito.ArgumentMatchers; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.AcmeProvider; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Login}. */ public class LoginTest { private final URL resourceUrl = url("https://example.com/acme/resource/123"); /** * Test the constructor. */ @Test public void testConstructor() throws IOException { var location = url(TestUtils.ACCOUNT_URL); var keypair = TestUtils.createKeyPair(); var session = TestUtils.session(); var login = new Login(location, keypair, session); assertThat(login.getAccount().getLocation()).isEqualTo(location); assertThat(login.getPublicKey()).isEqualTo(keypair.getPublic()); assertThat(login.getSession()).isEqualTo(session); assertThat(login.getAccount()).isNotNull(); assertThat(login.getAccount().getLogin()).isEqualTo(login); assertThat(login.getAccount().getLocation()).isEqualTo(location); assertThat(login.getAccount().getSession()).isEqualTo(session); } /** * Test the simple binders. */ @Test public void testBinder() throws IOException { var location = url(TestUtils.ACCOUNT_URL); var keypair = TestUtils.createKeyPair(); var session = TestUtils.session(); var login = new Login(location, keypair, session); var auth = login.bindAuthorization(resourceUrl); assertThat(auth).isNotNull(); assertThat(auth.getLogin()).isEqualTo(login); assertThat(auth.getLocation()).isEqualTo(resourceUrl); var cert = login.bindCertificate(resourceUrl); assertThat(cert).isNotNull(); assertThat(cert.getLogin()).isEqualTo(login); assertThat(cert.getLocation()).isEqualTo(resourceUrl); var order = login.bindOrder(resourceUrl); assertThat(order).isNotNull(); assertThat(order.getLogin()).isEqualTo(login); assertThat(order.getLocation()).isEqualTo(resourceUrl); } /** * Test that the account's keypair can be changed. */ @Test public void testKeyChange() throws IOException { var location = url(TestUtils.ACCOUNT_URL); var keypair = TestUtils.createKeyPair(); var session = TestUtils.session(); var login = new Login(location, keypair, session); assertThat(login.getPublicKey()).isEqualTo(keypair.getPublic()); var keypair2 = TestUtils.createKeyPair(); login.setKeyPair(keypair2); assertThat(login.getPublicKey()).isEqualTo(keypair2.getPublic()); } /** * Test that challenges are correctly created via provider. */ @Test public void testCreateChallenge() throws Exception { var challengeType = Http01Challenge.TYPE; var challengeUrl = url("https://example.com/acme/authz/0"); var data = new JSONBuilder() .put("type", challengeType) .put("url", challengeUrl) .toJSON(); var mockChallenge = mock(Http01Challenge.class); var mockProvider = mock(AcmeProvider.class); when(mockProvider.createChallenge( ArgumentMatchers.any(Login.class), ArgumentMatchers.eq(data))) .thenReturn(mockChallenge); var location = url(TestUtils.ACCOUNT_URL); var keypair = TestUtils.createKeyPair(); var session = TestUtils.session(mockProvider); var login = new Login(location, keypair, session); var challenge = login.createChallenge(data); assertThat(challenge).isInstanceOf(Http01Challenge.class); assertThat(challenge).isSameAs(mockChallenge); verify(mockProvider).createChallenge(login, data); } /** * Test that binding to a challenge invokes createChallenge */ @Test public void testBindChallenge() throws Exception { var locationUrl = URI.create("https://example.com/acme/challenge/1").toURL(); var mockChallenge = mock(Http01Challenge.class); when(mockChallenge.getType()).thenReturn(Http01Challenge.TYPE); var httpChallenge = getJSON("httpChallenge"); var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return httpChallenge; } @Override public Challenge createChallenge(Login login, JSON json) { assertThat(json).isEqualTo(httpChallenge); return mockChallenge; } }; var login = provider.createLogin(); var challenge = login.bindChallenge(locationUrl); assertThat(challenge).isInstanceOf(Http01Challenge.class); assertThat(challenge).isSameAs(mockChallenge); var challenge2 = login.bindChallenge(locationUrl, Http01Challenge.class); assertThat(challenge2).isSameAs(mockChallenge); var ex = assertThrows(AcmeProtocolException.class, () -> login.bindChallenge(locationUrl, Dns01Challenge.class)); assertThat(ex.getMessage()).isEqualTo("Challenge type http-01 does not match" + " requested class class org.shredzone.acme4j.challenge.Dns01Challenge"); } /** * Test that a new order can be created. */ @Test public void testNewOrder() throws AcmeException, IOException { var provider = new TestableConnectionProvider(); var login = provider.createLogin(); assertThat(login.newOrder()).isNotNull(); provider.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/OrderBuilderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.*; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.AcmeUtils.parseTimestamp; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.IOException; import java.net.HttpURLConnection; import java.net.InetAddress; import java.net.URL; import java.time.Duration; import java.util.Arrays; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link OrderBuilder}. */ public class OrderBuilderTest { private final URL resourceUrl = url("http://example.com/acme/resource"); private final URL locationUrl = url(TestUtils.ACCOUNT_URL); /** * Test that a new {@link Order} can be created. */ @Test public void testOrderCertificate() throws Exception { var notBefore = parseTimestamp("2016-01-01T00:00:00Z"); var notAfter = parseTimestamp("2016-01-08T00:00:00Z"); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("requestOrderRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("requestOrderResponse"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var account = new Account(login, locationUrl); var order = account.newOrder() .domains("example.com", "www.example.com") .domain("example.org") .domains(Arrays.asList("m.example.com", "m.example.org")) .identifier(Identifier.dns("d.example.com")) .identifiers(Arrays.asList( Identifier.dns("d2.example.com"), Identifier.ip(InetAddress.getByName("192.0.2.2")))) .notBefore(notBefore) .notAfter(notAfter) .create(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.getIdentifiers()).containsExactlyInAnyOrder( Identifier.dns("example.com"), Identifier.dns("www.example.com"), Identifier.dns("example.org"), Identifier.dns("m.example.com"), Identifier.dns("m.example.org"), Identifier.dns("d.example.com"), Identifier.dns("d2.example.com"), Identifier.ip(InetAddress.getByName("192.0.2.2"))); softly.assertThat(order.getNotBefore().orElseThrow()) .isEqualTo("2016-01-01T00:10:00Z"); softly.assertThat(order.getNotAfter().orElseThrow()) .isEqualTo("2016-01-08T00:10:00Z"); softly.assertThat(order.getExpires().orElseThrow()) .isEqualTo("2016-01-10T00:00:00Z"); softly.assertThat(order.getStatus()).isEqualTo(Status.PENDING); softly.assertThat(order.isAutoRenewing()).isFalse(); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalStartDate); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalEndDate); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalLifetime); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalLifetimeAdjust); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::isAutoRenewalGetEnabled); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getProfile); softly.assertThat(order.getLocation()).isEqualTo(locationUrl); softly.assertThat(order.getAuthorizations()).isNotNull(); softly.assertThat(order.getAuthorizations()).hasSize(2); } provider.close(); } /** * Test that a new auto-renewal {@link Order} can be created. */ @Test public void testAutoRenewOrderCertificate() throws Exception { var autoRenewStart = parseTimestamp("2018-01-01T00:00:00Z"); var autoRenewEnd = parseTimestamp("2019-01-01T00:00:00Z"); var validity = Duration.ofDays(7); var predate = Duration.ofDays(6); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("requestAutoRenewOrderRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("requestAutoRenewOrderResponse"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putMetadata("auto-renewal",JSON.parse( "{\"allow-certificate-get\": true}" ).toMap()); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var account = new Account(login, locationUrl); var order = account.newOrder() .domain("example.org") .autoRenewal() .autoRenewalStart(autoRenewStart) .autoRenewalEnd(autoRenewEnd) .autoRenewalLifetime(validity) .autoRenewalLifetimeAdjust(predate) .autoRenewalEnableGet() .create(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.getIdentifiers()).containsExactlyInAnyOrder(Identifier.dns("example.org")); softly.assertThat(order.getNotBefore()).isEmpty(); softly.assertThat(order.getNotAfter()).isEmpty(); softly.assertThat(order.isAutoRenewing()).isTrue(); softly.assertThat(order.getAutoRenewalStartDate().orElseThrow()).isEqualTo(autoRenewStart); softly.assertThat(order.getAutoRenewalEndDate()).isEqualTo(autoRenewEnd); softly.assertThat(order.getAutoRenewalLifetime()).isEqualTo(validity); softly.assertThat(order.getAutoRenewalLifetimeAdjust().orElseThrow()).isEqualTo(predate); softly.assertThat(order.isAutoRenewalGetEnabled()).isTrue(); softly.assertThat(order.getLocation()).isEqualTo(locationUrl); } provider.close(); } /** * Test that a new {@link Order} with ancestor domain can be created. */ @Test public void testOrderCertificateWithAncestor() throws Exception { var notBefore = parseTimestamp("2016-01-01T00:00:00Z"); var notAfter = parseTimestamp("2016-01-08T00:00:00Z"); var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("requestOrderRequestSub").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("requestOrderResponseSub"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); provider.putMetadata("subdomainAuthAllowed", true); var account = new Account(login, locationUrl); var order = account.newOrder() .identifier(Identifier.dns("foo.bar.example.com").withAncestorDomain("example.com")) .notBefore(notBefore) .notAfter(notAfter) .create(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.getIdentifiers()).containsExactlyInAnyOrder( Identifier.dns("foo.bar.example.com")); softly.assertThat(order.getNotBefore().orElseThrow()) .isEqualTo("2016-01-01T00:10:00Z"); softly.assertThat(order.getNotAfter().orElseThrow()) .isEqualTo("2016-01-08T00:10:00Z"); softly.assertThat(order.getExpires().orElseThrow()) .isEqualTo("2016-01-10T00:00:00Z"); softly.assertThat(order.getStatus()).isEqualTo(Status.PENDING); softly.assertThat(order.getLocation()).isEqualTo(locationUrl); softly.assertThat(order.getAuthorizations()).isNotNull(); softly.assertThat(order.getAuthorizations()).hasSize(2); } provider.close(); } /** * Test that a new {@link Order} with ancestor domain fails if not supported. */ @Test public void testOrderCertificateWithAncestorFails() throws Exception { var provider = new TestableConnectionProvider(); var login = provider.createLogin(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); assertThat(login.getSession().getMetadata().isSubdomainAuthAllowed()).isFalse(); var account = new Account(login, locationUrl); assertThatExceptionOfType(AcmeNotSupportedException.class).isThrownBy(() -> account.newOrder() .identifier(Identifier.dns("foo.bar.example.com").withAncestorDomain("example.com")) .create() ); provider.close(); } /** * Test that an auto-renewal {@link Order} cannot be created if unsupported by the CA. */ @Test public void testAutoRenewOrderCertificateFails() { assertThrows(AcmeNotSupportedException.class, () -> { var provider = new TestableConnectionProvider(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var login = provider.createLogin(); var account = new Account(login, locationUrl); account.newOrder() .domain("example.org") .autoRenewal() .create(); provider.close(); }); } /** * Test that auto-renew and notBefore/notAfter cannot be mixed. */ @Test public void testAutoRenewNotMixed() throws Exception { var someInstant = parseTimestamp("2018-01-01T00:00:00Z"); var provider = new TestableConnectionProvider(); var login = provider.createLogin(); var account = new Account(login, locationUrl); assertThrows(IllegalArgumentException.class, () -> { OrderBuilder ob = account.newOrder().autoRenewal(); ob.notBefore(someInstant); }, "accepted notBefore"); assertThrows(IllegalArgumentException.class, () -> { OrderBuilder ob = account.newOrder().autoRenewal(); ob.notAfter(someInstant); }, "accepted notAfter"); assertThrows(IllegalArgumentException.class, () -> { OrderBuilder ob = account.newOrder().notBefore(someInstant); ob.autoRenewal(); }, "accepted autoRenewal"); assertThrows(IllegalArgumentException.class, () -> { OrderBuilder ob = account.newOrder().notBefore(someInstant); ob.autoRenewalStart(someInstant); }, "accepted autoRenewalStart"); assertThrows(IllegalArgumentException.class, () -> { OrderBuilder ob = account.newOrder().notBefore(someInstant); ob.autoRenewalEnd(someInstant); }, "accepted autoRenewalEnd"); assertThrows(IllegalArgumentException.class, () -> { OrderBuilder ob = account.newOrder().notBefore(someInstant); ob.autoRenewalLifetime(Duration.ofDays(7)); }, "accepted autoRenewalLifetime"); provider.close(); } /** * Test that a new profile {@link Order} can be created. */ @Test public void testProfileOrderCertificate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("requestProfileOrderRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("requestProfileOrderResponse"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putMetadata("profiles",JSON.parse( "{\"classic\": \"The same profile you're accustomed to\"}" ).toMap()); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var account = new Account(login, locationUrl); var order = account.newOrder() .domain("example.org") .profile("classic") .create(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.getProfile()).isEqualTo("classic"); } provider.close(); } /** * Test that a profile {@link Order} cannot be created if the profile is unsupported * by the CA. */ @Test public void testUnsupportedProfileOrderCertificateFails() throws Exception { var provider = new TestableConnectionProvider(); provider.putMetadata("profiles",JSON.parse( "{\"classic\": \"The same profile you're accustomed to\"}" ).toMap()); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var login = provider.createLogin(); var account = new Account(login, locationUrl); assertThatExceptionOfType(AcmeNotSupportedException.class).isThrownBy(() -> { account.newOrder() .domain("example.org") .profile("invalid") .create(); }).withMessage("Server does not support profile: invalid"); provider.close(); } /** * Test that a profile {@link Order} cannot be created if the feature is unsupported * by the CA. */ @Test public void testProfileOrderCertificateFails() throws IOException { var provider = new TestableConnectionProvider(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var login = provider.createLogin(); var account = new Account(login, locationUrl); assertThatExceptionOfType(AcmeNotSupportedException.class).isThrownBy(() -> { account.newOrder() .domain("example.org") .profile("classic") .create(); }).withMessage("Server does not support profile"); provider.close(); } /** * Test that the ARI replaces field is set. */ @Test public void testARIReplaces() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(resourceUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("requestReplacesRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_CREATED; } @Override public JSON readJsonResponse() { return getJSON("requestReplacesResponse"); } @Override public URL getLocation() { return locationUrl; } }; var login = provider.createLogin(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); provider.putTestResource(Resource.RENEWAL_INFO, resourceUrl); var account = new Account(login, locationUrl); account.newOrder() .domain("example.org") .replaces("aYhba4dGQEHhs3uEe6CuLN4ByNQ.AIdlQyE") .create(); provider.close(); } /** * Test that exception is thrown if the ARI replaces field is set but ARI is not * supported. */ @Test public void testARIReplaceFails() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { fail("Request was sent"); return HttpURLConnection.HTTP_FORBIDDEN; } }; var login = provider.createLogin(); provider.putTestResource(Resource.NEW_ORDER, resourceUrl); var account = new Account(login, locationUrl); assertThatExceptionOfType(AcmeNotSupportedException.class).isThrownBy(() -> { account.newOrder() .domain("example.org") .replaces("aYhba4dGQEHhs3uEe6CuLN4ByNQ.AIdlQyE") .create(); }) .withMessage("Server does not support renewal-information"); provider.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/OrderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.time.Duration; import java.util.concurrent.atomic.AtomicBoolean; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Order}. */ public class OrderTest { private final URL locationUrl = url("http://example.com/acme/order/1234"); private final URL finalizeUrl = url("https://example.com/acme/acct/1/order/1/finalize"); /** * Test that order is properly updated. */ @Test public void testUpdate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateOrderResponse"); } }; var login = provider.createLogin(); var order = new Order(login, locationUrl); order.fetch(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.getStatus()).isEqualTo(Status.PENDING); softly.assertThat(order.getExpires().orElseThrow()).isEqualTo("2015-03-01T14:09:00Z"); softly.assertThat(order.getLocation()).isEqualTo(locationUrl); softly.assertThat(order.getIdentifiers()).containsExactlyInAnyOrder( Identifier.dns("example.com"), Identifier.dns("www.example.com")); softly.assertThat(order.getNotBefore().orElseThrow()) .isEqualTo("2016-01-01T00:00:00Z"); softly.assertThat(order.getNotAfter().orElseThrow()) .isEqualTo("2016-01-08T00:00:00Z"); softly.assertThat(order.getCertificate().getLocation()) .isEqualTo(url("https://example.com/acme/cert/1234")); softly.assertThat(order.getFinalizeLocation()).isEqualTo(finalizeUrl); softly.assertThat(order.isAutoRenewing()).isFalse(); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalStartDate); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalEndDate); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalLifetime); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getAutoRenewalLifetimeAdjust); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::isAutoRenewalGetEnabled); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(order::getProfile); softly.assertThat(order.getError()).isNotEmpty(); softly.assertThat(order.getError().orElseThrow().getType()) .isEqualTo(URI.create("urn:ietf:params:acme:error:connection")); softly.assertThat(order.getError().flatMap(Problem::getDetail).orElseThrow()) .isEqualTo("connection refused"); var auths = order.getAuthorizations(); softly.assertThat(auths).hasSize(2); softly.assertThat(auths.stream()) .map(Authorization::getLocation) .containsExactlyInAnyOrder( url("https://example.com/acme/authz/1234"), url("https://example.com/acme/authz/2345")); } provider.close(); } /** * Test lazy loading. */ @Test public void testLazyLoading() throws Exception { var requestWasSent = new AtomicBoolean(false); var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { requestWasSent.set(true); assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateOrderResponse"); } }; var login = provider.createLogin(); var order = new Order(login, locationUrl); try (var softly = new AutoCloseableSoftAssertions()) { // Lazy loading softly.assertThat(requestWasSent).isFalse(); softly.assertThat(order.getCertificate().getLocation()) .isEqualTo(url("https://example.com/acme/cert/1234")); softly.assertThat(requestWasSent).isTrue(); // Subsequent queries do not trigger another load requestWasSent.set(false); softly.assertThat(order.getCertificate().getLocation()) .isEqualTo(url("https://example.com/acme/cert/1234")); softly.assertThat(order.getStatus()).isEqualTo(Status.PENDING); softly.assertThat(order.getExpires().orElseThrow()).isEqualTo("2015-03-01T14:09:00Z"); softly.assertThat(requestWasSent).isFalse(); } provider.close(); } /** * Test that order is properly finalized. */ @Test public void testFinalize() throws Exception { var csr = TestUtils.getResourceAsByteArray("/csr.der"); var provider = new TestableConnectionProvider() { private boolean isFinalized = false; @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(finalizeUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("finalizeRequest").toString()); assertThat(login).isNotNull(); isFinalized = true; return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON(isFinalized ? "finalizeResponse" : "updateOrderResponse"); } }; var login = provider.createLogin(); var order = new Order(login, locationUrl); order.execute(csr); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.getStatus()).isEqualTo(Status.VALID); softly.assertThat(order.getExpires().orElseThrow()).isEqualTo("2015-03-01T14:09:00Z"); softly.assertThat(order.getLocation()).isEqualTo(locationUrl); softly.assertThat(order.getIdentifiers()).containsExactlyInAnyOrder( Identifier.dns("example.com"), Identifier.dns("www.example.com")); softly.assertThat(order.getNotBefore().orElseThrow()) .isEqualTo("2016-01-01T00:00:00Z"); softly.assertThat(order.getNotAfter().orElseThrow()) .isEqualTo("2016-01-08T00:00:00Z"); softly.assertThat(order.isAutoRenewalCertificate()).isFalse(); softly.assertThat(order.getCertificate().getLocation()) .isEqualTo(url("https://example.com/acme/cert/1234")); softly.assertThat(order.getFinalizeLocation()).isEqualTo(finalizeUrl); var auths = order.getAuthorizations(); softly.assertThat(auths).hasSize(2); softly.assertThat(auths.stream()) .map(Authorization::getLocation) .containsExactlyInAnyOrder( url("https://example.com/acme/authz/1234"), url("https://example.com/acme/authz/2345")); } provider.close(); } /** * Test that order is properly updated. */ @Test public void testAutoRenewUpdate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateAutoRenewOrderResponse"); } }; provider.putMetadata("auto-renewal", JSON.empty()); var login = provider.createLogin(); var order = new Order(login, locationUrl); order.fetch(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.isAutoRenewing()).isTrue(); softly.assertThat(order.getAutoRenewalStartDate().orElseThrow()) .isEqualTo("2016-01-01T00:00:00Z"); softly.assertThat(order.getAutoRenewalEndDate()) .isEqualTo("2017-01-01T00:00:00Z"); softly.assertThat(order.getAutoRenewalLifetime()) .isEqualTo(Duration.ofHours(168)); softly.assertThat(order.getAutoRenewalLifetimeAdjust().orElseThrow()) .isEqualTo(Duration.ofDays(6)); softly.assertThat(order.getNotBefore()).isEmpty(); softly.assertThat(order.getNotAfter()).isEmpty(); softly.assertThat(order.isAutoRenewalGetEnabled()).isTrue(); } provider.close(); } /** * Test that auto-renew order is properly finalized. */ @Test public void testAutoRenewFinalize() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("finalizeAutoRenewResponse"); } }; var login = provider.createLogin(); var order = login.bindOrder(locationUrl); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(order.isAutoRenewalCertificate()).isTrue(); softly.assertThat(order.getCertificate().getLocation()) .isEqualTo(url("https://example.com/acme/cert/1234")); softly.assertThat(order.isAutoRenewing()).isTrue(); softly.assertThat(order.getAutoRenewalStartDate().orElseThrow()) .isEqualTo("2018-01-01T00:00:00Z"); softly.assertThat(order.getAutoRenewalEndDate()) .isEqualTo("2019-01-01T00:00:00Z"); softly.assertThat(order.getAutoRenewalLifetime()) .isEqualTo(Duration.ofHours(168)); softly.assertThat(order.getAutoRenewalLifetimeAdjust().orElseThrow()) .isEqualTo(Duration.ofDays(6)); softly.assertThat(order.getNotBefore()).isEmpty(); softly.assertThat(order.getNotAfter()).isEmpty(); softly.assertThat(order.isAutoRenewalGetEnabled()).isTrue(); } provider.close(); } /** * Test that auto-renew order is properly canceled. */ @Test public void testCancel() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { var json = claims.toJSON(); assertThat(json.get("status").asString()).isEqualTo("canceled"); assertThat(url).isEqualTo(locationUrl); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("canceledOrderResponse"); } }; provider.putMetadata("auto-renewal", JSON.empty()); var login = provider.createLogin(); var order = new Order(login, locationUrl); order.cancelAutoRenewal(); assertThat(order.getStatus()).isEqualTo(Status.CANCELED); provider.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/ProblemTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Problem}. */ public class ProblemTest { @Test public void testProblem() { var baseUrl = url("https://example.com/acme/1"); var original = TestUtils.getJSON("problem"); var problem = new Problem(original, baseUrl); assertThatJson(problem.asJSON().toString()).isEqualTo(original.toString()); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(problem.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:malformed")); softly.assertThat(problem.getTitle().orElseThrow()) .isEqualTo("Some of the identifiers requested were rejected"); softly.assertThat(problem.getDetail().orElseThrow()) .isEqualTo("Identifier \"abc12_\" is malformed"); softly.assertThat(problem.getInstance().orElseThrow()) .isEqualTo(URI.create("https://example.com/documents/error.html")); softly.assertThat(problem.getIdentifier()).isEmpty(); softly.assertThat(problem.toString()).isEqualTo( "Identifier \"abc12_\" is malformed (" + "Invalid underscore in DNS name \"_example.com\" ‒ " + "This CA will not issue for \"example.net\")"); var subs = problem.getSubProblems(); softly.assertThat(subs).isNotNull().hasSize(2); var p1 = subs.get(0); softly.assertThat(p1.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:malformed")); softly.assertThat(p1.getTitle()).isEmpty(); softly.assertThat(p1.getDetail().orElseThrow()) .isEqualTo("Invalid underscore in DNS name \"_example.com\""); softly.assertThat(p1.getIdentifier().orElseThrow().getDomain()).isEqualTo("_example.com"); softly.assertThat(p1.toString()).isEqualTo("Invalid underscore in DNS name \"_example.com\""); var p2 = subs.get(1); softly.assertThat(p2.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:rejectedIdentifier")); softly.assertThat(p2.getTitle()).isEmpty(); softly.assertThat(p2.getDetail().orElseThrow()) .isEqualTo("This CA will not issue for \"example.net\""); softly.assertThat(p2.getIdentifier().orElseThrow().getDomain()).isEqualTo("example.net"); softly.assertThat(p2.toString()).isEqualTo("This CA will not issue for \"example.net\""); } } /** * Test that {@link Problem#toString()} always returns the most specific message. */ @Test public void testToString() { var baseUrl = url("https://example.com/acme/1"); var typeUri = URI.create("urn:ietf:params:acme:error:malformed"); var jb = new JSONBuilder(); jb.put("type", typeUri); var p1 = new Problem(jb.toJSON(), baseUrl); assertThat(p1.toString()).isEqualTo(typeUri.toString()); jb.put("title", "Some of the identifiers requested were rejected"); var p2 = new Problem(jb.toJSON(), baseUrl); assertThat(p2.toString()).isEqualTo("Some of the identifiers requested were rejected"); jb.put("detail", "Identifier \"abc12_\" is malformed"); var p3 = new Problem(jb.toJSON(), baseUrl); assertThat(p3.toString()).isEqualTo("Identifier \"abc12_\" is malformed"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/RenewalInfoTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.mockito.Mockito.mock; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.HttpURLConnection; import java.net.URL; import java.time.Duration; import java.time.Instant; import java.time.ZonedDateTime; import java.time.temporal.ChronoUnit; import java.util.Optional; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; /** * Unit test for {@link RenewalInfo}. */ public class RenewalInfoTest { private final URL locationUrl = url("http://example.com/acme/renewalInfo/1234"); private final Instant retryAfterInstant = Instant.now().plus(10L, ChronoUnit.DAYS); private final Instant startWindow = Instant.parse("2021-01-03T00:00:00Z"); private final Instant endWindow = Instant.parse("2021-01-07T00:00:00Z"); @Test public void testGetters() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendRequest(URL url, Session session, ZonedDateTime ifModifiedSince) { assertThat(url).isEqualTo(locationUrl); assertThat(session).isNotNull(); assertThat(ifModifiedSince).isNull(); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("renewalInfo"); } @Override public Optional getRetryAfter() { return Optional.of(retryAfterInstant); } }; var login = provider.createLogin(); var renewalInfo = new RenewalInfo(login, locationUrl); var recheckAfter = renewalInfo.fetch(); assertThat(recheckAfter).hasValue(retryAfterInstant); // Check getters try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(renewalInfo.getLocation()).isEqualTo(locationUrl); softly.assertThat(renewalInfo.getSuggestedWindowStart()) .isEqualTo(startWindow); softly.assertThat(renewalInfo.getSuggestedWindowEnd()) .isEqualTo(endWindow); softly.assertThat(renewalInfo.getExplanation()) .isNotEmpty() .contains(url("https://example.com/docs/example-mass-reissuance-event")); } // Check renewalIsNotRequired try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(renewalInfo.renewalIsNotRequired(startWindow.minusSeconds(1L))) .isTrue(); softly.assertThat(renewalInfo.renewalIsNotRequired(startWindow)) .isFalse(); softly.assertThat(renewalInfo.renewalIsNotRequired(endWindow.minusSeconds(1L))) .isFalse(); softly.assertThat(renewalInfo.renewalIsNotRequired(endWindow)) .isFalse(); } // Check renewalIsRecommended try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(renewalInfo.renewalIsRecommended(startWindow.minusSeconds(1L))) .isFalse(); softly.assertThat(renewalInfo.renewalIsRecommended(startWindow)) .isTrue(); softly.assertThat(renewalInfo.renewalIsRecommended(endWindow.minusSeconds(1L))) .isTrue(); softly.assertThat(renewalInfo.renewalIsRecommended(endWindow)) .isFalse(); } // Check renewalIsOverdue try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(renewalInfo.renewalIsOverdue(startWindow.minusSeconds(1L))) .isFalse(); softly.assertThat(renewalInfo.renewalIsOverdue(startWindow)) .isFalse(); softly.assertThat(renewalInfo.renewalIsOverdue(endWindow.minusSeconds(1L))) .isFalse(); softly.assertThat(renewalInfo.renewalIsOverdue(endWindow)) .isTrue(); } // Check getRandomProposal, is empty because end window is in the past var proposal = renewalInfo.getRandomProposal(null); assertThat(proposal).isEmpty(); provider.close(); } @Test public void testRandomProposal() { var login = mock(Login.class); var start = Instant.now(); var end = start.plus(1L, ChronoUnit.DAYS); var renewalInfo = new RenewalInfo(login, locationUrl) { @Override public Instant getSuggestedWindowStart() { return start; } @Override public Instant getSuggestedWindowEnd() { return end; } }; var noFreq = renewalInfo.getRandomProposal(null); assertThat(noFreq).isNotEmpty(); assertThat(noFreq.get()).isBetween(start, end); var oneHour = renewalInfo.getRandomProposal(Duration.ofHours(1L)); assertThat(oneHour).isNotEmpty(); assertThat(oneHour.get()).isBetween(start, end.minus(1L, ChronoUnit.HOURS)); var twoDays = renewalInfo.getRandomProposal(Duration.ofDays(2L)); assertThat(twoDays).isEmpty(); } @Test public void testDateAssertion() { var login = mock(Login.class); var start = Instant.now(); var end = start.minusSeconds(1L); // end before start var renewalInfo = new RenewalInfo(login, locationUrl) { @Override public Instant getSuggestedWindowStart() { return start; } @Override public Instant getSuggestedWindowEnd() { return end; } }; assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> renewalInfo.renewalIsRecommended(start)); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/SessionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.mockito.Mockito.*; import static org.shredzone.acme4j.toolbox.TestUtils.*; import java.io.IOException; import java.net.URI; import java.time.Duration; import java.time.ZonedDateTime; import java.util.Locale; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.mockito.ArgumentMatchers; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.provider.AcmeProvider; import org.shredzone.acme4j.provider.GenericAcmeProvider; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit test for {@link Session}. */ public class SessionTest { /** * Test constructor */ @Test public void testConstructor() { var serverUri = URI.create(TestUtils.ACME_SERVER_URI); assertThrows(NullPointerException.class, () -> new Session((URI) null)); var session = new Session(serverUri); assertThat(session).isNotNull(); assertThat(session.getServerUri()).isEqualTo(serverUri); var session2 = new Session(TestUtils.ACME_SERVER_URI); assertThat(session2).isNotNull(); assertThat(session2.getServerUri()).isEqualTo(serverUri); var session3 = new Session(serverUri, new GenericAcmeProvider()); assertThat(session3).isNotNull(); assertThat(session3.getServerUri()).isEqualTo(serverUri); assertThrows(IllegalArgumentException.class, () -> new Session("#*aBaDuRi*#"), "Bad URI in constructor"); assertThrows(IllegalArgumentException.class, () -> new Session(URI.create("acme://invalid"), new GenericAcmeProvider()), "Unsupported URI"); } /** * Test getters and setters. */ @Test public void testGettersAndSetters() { var serverUri = URI.create(TestUtils.ACME_SERVER_URI); var now = ZonedDateTime.now(); var session = new Session(serverUri); try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isNull(); nonceHolder.setNonce(DUMMY_NONCE); assertThat(nonceHolder.getNonce()).isEqualTo(DUMMY_NONCE); } assertThat(session.getServerUri()).isEqualTo(serverUri); assertThat(session.networkSettings()).isNotNull(); assertThat(session.getDirectoryExpires()).isNull(); session.setDirectoryExpires(now); assertThat(session.getDirectoryExpires()).isEqualTo(now); session.setDirectoryExpires(null); assertThat(session.getDirectoryExpires()).isNull(); assertThat(session.getDirectoryLastModified()).isNull(); session.setDirectoryLastModified(now); assertThat(session.getDirectoryLastModified()).isEqualTo(now); session.setDirectoryLastModified(null); assertThat(session.getDirectoryLastModified()).isNull(); session.setDirectoryExpires(now); session.setDirectoryLastModified(now); session.purgeDirectoryCache(); assertThat(session.getDirectoryExpires()).isNull(); assertThat(session.getDirectoryLastModified()).isNull(); assertThat(session.hasDirectory()).isFalse(); } /** * Test login methods. */ @Test public void testLogin() throws IOException { var serverUri = URI.create(TestUtils.ACME_SERVER_URI); var accountLocation = url(TestUtils.ACCOUNT_URL); var accountKeyPair = TestUtils.createKeyPair(); var session = new Session(serverUri); var login = session.login(accountLocation, accountKeyPair); assertThat(login).isNotNull(); assertThat(login.getSession()).isEqualTo(session); assertThat(login.getAccount().getLocation()).isEqualTo(accountLocation); assertThat(login.getPublicKey()).isEqualTo(accountKeyPair.getPublic()); } /** * Test that the directory is properly read. */ @Test public void testDirectory() throws AcmeException, IOException { var serverUri = URI.create(TestUtils.ACME_SERVER_URI); var mockProvider = mock(AcmeProvider.class); when(mockProvider.directory( ArgumentMatchers.any(Session.class), ArgumentMatchers.eq(serverUri))) .thenReturn(getJSON("directory")); var session = new Session(serverUri) { @Override public AcmeProvider provider() { return mockProvider; } }; // No directory has been fetched yet assertThat(session.hasDirectory()).isFalse(); assertThat(session.resourceUrl(Resource.NEW_ACCOUNT)) .isEqualTo(URI.create("https://example.com/acme/new-account").toURL()); // There is a local copy of the directory now assertThat(session.hasDirectory()).isTrue(); assertThat(session.resourceUrl(Resource.NEW_AUTHZ)) .isEqualTo(URI.create("https://example.com/acme/new-authz").toURL()); assertThat(session.resourceUrl(Resource.NEW_ORDER)) .isEqualTo(URI.create("https://example.com/acme/new-order").toURL()); assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(() -> session.resourceUrl(Resource.REVOKE_CERT)) .withMessage("Server does not support revokeCert"); assertThat(session.resourceUrlOptional(Resource.NEW_AUTHZ)) .isNotEmpty() .contains(URI.create("https://example.com/acme/new-authz").toURL()); assertThat(session.resourceUrlOptional(Resource.REVOKE_CERT)) .isEmpty(); var meta = session.getMetadata(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(meta).isNotNull(); softly.assertThat(meta.getTermsOfService().orElseThrow()) .isEqualTo(URI.create("https://example.com/acme/terms")); softly.assertThat(meta.getWebsite().orElseThrow().toExternalForm()) .isEqualTo("https://www.example.com/"); softly.assertThat(meta.getCaaIdentities()).containsExactlyInAnyOrder("example.com"); softly.assertThat(meta.isAutoRenewalEnabled()).isTrue(); softly.assertThat(meta.getAutoRenewalMaxDuration()).isEqualTo(Duration.ofDays(365)); softly.assertThat(meta.getAutoRenewalMinLifetime()).isEqualTo(Duration.ofHours(24)); softly.assertThat(meta.isAutoRenewalGetAllowed()).isTrue(); softly.assertThat(meta.isProfileAllowed()).isTrue(); softly.assertThat(meta.isProfileAllowed("classic")).isTrue(); softly.assertThat(meta.isProfileAllowed("custom")).isTrue(); softly.assertThat(meta.isProfileAllowed("invalid")).isFalse(); softly.assertThat(meta.getProfileDescription("classic")).contains("The profile you're accustomed to"); softly.assertThat(meta.getProfileDescription("custom")).contains("Some other profile"); softly.assertThat(meta.getProfiles()).contains("classic", "custom"); softly.assertThat(meta.getProfileDescription("invalid")).isEmpty(); softly.assertThat(meta.isExternalAccountRequired()).isTrue(); softly.assertThat(meta.isSubdomainAuthAllowed()).isTrue(); softly.assertThat(meta.getJSON()).isNotNull(); } // Make sure directory is read verify(mockProvider, atLeastOnce()).directory( ArgumentMatchers.any(Session.class), ArgumentMatchers.any(URI.class)); } /** * Test that the directory is properly read even if there are no metadata. */ @Test public void testNoMeta() throws AcmeException, IOException { var serverUri = URI.create(TestUtils.ACME_SERVER_URI); var mockProvider = mock(AcmeProvider.class); when(mockProvider.directory( ArgumentMatchers.any(Session.class), ArgumentMatchers.eq(serverUri))) .thenReturn(getJSON("directoryNoMeta")); var session = new Session(serverUri) { @Override public AcmeProvider provider() { return mockProvider; } }; assertThat(session.resourceUrl(Resource.NEW_ACCOUNT)) .isEqualTo(URI.create("https://example.com/acme/new-account").toURL()); assertThat(session.resourceUrl(Resource.NEW_AUTHZ)) .isEqualTo(URI.create("https://example.com/acme/new-authz").toURL()); assertThat(session.resourceUrl(Resource.NEW_ORDER)) .isEqualTo(URI.create("https://example.com/acme/new-order").toURL()); var meta = session.getMetadata(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(meta).isNotNull(); softly.assertThat(meta.getTermsOfService()).isEmpty(); softly.assertThat(meta.getWebsite()).isEmpty(); softly.assertThat(meta.getCaaIdentities()).isEmpty(); softly.assertThat(meta.isAutoRenewalEnabled()).isFalse(); softly.assertThat(meta.isSubdomainAuthAllowed()).isFalse(); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(meta::getAutoRenewalMaxDuration); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(meta::getAutoRenewalMinLifetime); softly.assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(meta::isAutoRenewalGetAllowed); softly.assertThat(meta.isProfileAllowed()).isFalse(); softly.assertThat(meta.isProfileAllowed("classic")).isFalse(); softly.assertThat(meta.getProfileDescription("classic")).isEmpty(); softly.assertThat(meta.getProfiles()).isEmpty(); } } /** * Test that the locale is properly set. */ @Test public void testLocale() { var session = new Session(URI.create(TestUtils.ACME_SERVER_URI)); // default configuration assertThat(session.getLocale()) .isEqualTo(Locale.getDefault()); assertThat(session.getLanguageHeader()) .isEqualTo(AcmeUtils.localeToLanguageHeader(Locale.getDefault())); // null session.setLocale(null); assertThat(session.getLocale()).isNull(); assertThat(session.getLanguageHeader()).isEqualTo("*"); // a locale session.setLocale(Locale.CANADA_FRENCH); assertThat(session.getLocale()).isEqualTo(Locale.CANADA_FRENCH); assertThat(session.getLanguageHeader()).isEqualTo("fr-CA,fr;q=0.8,*;q=0.1"); } /** * Test that getHttpClient returns a shared client instance. */ @Test public void testGetHttpClientWithReuse() { var session = new Session(URI.create(TestUtils.ACME_SERVER_URI)); var client1 = session.getHttpClient(); var client2 = session.getHttpClient(); // Both calls should return the same client instance assertThat(client1).isSameAs(client2); } /** * Test that getHttpClient is thread-safe. */ @Test public void testGetHttpClientThreadSafety() throws Exception { var session = new Session(URI.create(TestUtils.ACME_SERVER_URI)); var threads = new Thread[10]; var clients = new java.net.http.HttpClient[threads.length]; for (int i = 0; i < threads.length; i++) { final int index = i; threads[i] = new Thread(() -> { clients[index] = session.getHttpClient(); }); } for (var thread : threads) { thread.start(); } for (var thread : threads) { thread.join(); } // All threads should get the same client instance var firstClient = clients[0]; for (var client : clients) { assertThat(client).isSameAs(firstClient); } } /** * Test that connections from the same session share the same HttpClient. */ @Test public void testConnectionsShareHttpClient() throws AcmeException { var session = new Session(URI.create(TestUtils.ACME_SERVER_URI)); var conn1 = session.connect(); var conn2 = session.connect(); // Both connections should use the same HttpClient from the session var client1 = session.getHttpClient(); var client2 = session.getHttpClient(); assertThat(client1).isSameAs(client2); conn1.close(); conn2.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/StatusTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j; import static org.assertj.core.api.Assertions.assertThat; import java.util.Locale; import org.junit.jupiter.api.Test; /** * Unit tests for {@link Status} enumeration. */ public class StatusTest { /** * Test that invoking {@link Status#parse(String)} gives the correct status. */ @Test public void testParse() { // Would break toUpperCase() if English locale is not set, see #156. Locale.setDefault(new Locale("tr")); for (var s : Status.values()) { var parsed = Status.parse(s.name().toLowerCase(Locale.ENGLISH)); assertThat(parsed).isEqualTo(s); } // unknown status returns UNKNOWN assertThat(Status.parse("foo")).isEqualTo(Status.UNKNOWN); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.within; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.time.Duration; import java.time.Instant; import java.time.temporal.ChronoUnit; import java.util.Optional; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Challenge}. */ public class ChallengeTest { private final URL locationUrl = url("https://example.com/acme/some-location"); /** * Test that after unmarshaling, the challenge properties are set correctly. */ @Test public void testUnmarshal() { var challenge = new Challenge(TestUtils.login(), getJSON("genericChallenge")); // Test unmarshalled values try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(challenge.getType()).isEqualTo("generic-01"); softly.assertThat(challenge.getStatus()).isEqualTo(Status.INVALID); softly.assertThat(challenge.getLocation()).isEqualTo(url("http://example.com/challenge/123")); softly.assertThat(challenge.getValidated().orElseThrow()) .isCloseTo("2015-12-12T17:19:36.336Z", within(1, ChronoUnit.MILLIS)); softly.assertThat(challenge.getJSON().get("type").asString()).isEqualTo("generic-01"); softly.assertThat(challenge.getJSON().get("url").asURL()).isEqualTo(url("http://example.com/challenge/123")); var error = challenge.getError().orElseThrow(); softly.assertThat(error.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:incorrectResponse")); softly.assertThat(error.getDetail().orElseThrow()).isEqualTo("bad token"); softly.assertThat(error.getInstance().orElseThrow()) .isEqualTo(URI.create("http://example.com/documents/faq.html")); } } /** * Test that {@link Challenge#prepareResponse(JSONBuilder)} contains the type. */ @Test public void testRespond() { var challenge = new Challenge(TestUtils.login(), getJSON("genericChallenge")); var response = new JSONBuilder(); challenge.prepareResponse(response); assertThatJson(response.toString()).isEqualTo("{}"); } /** * Test that an exception is thrown on challenge type mismatch. */ @Test public void testNotAcceptable() { assertThrows(AcmeProtocolException.class, () -> new Http01Challenge(TestUtils.login(), getJSON("dns01Challenge")) ); } /** * Test that a challenge can be triggered. */ @Test public void testTrigger() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) { assertThat(url).isEqualTo(locationUrl); assertThatJson(claims.toString()).isEqualTo(getJSON("triggerHttpChallengeRequest").toString()); assertThat(login).isNotNull(); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("triggerHttpChallengeResponse"); } }; var login = provider.createLogin(); var challenge = new Http01Challenge(login, getJSON("triggerHttpChallenge")); challenge.trigger(); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getLocation()).isEqualTo(locationUrl); provider.close(); } /** * Test that a challenge is properly updated. */ @Test public void testUpdate() throws Exception { var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateHttpChallengeResponse"); } }; var login = provider.createLogin(); var challenge = new Http01Challenge(login, getJSON("triggerHttpChallengeResponse")); challenge.fetch(); assertThat(challenge.getStatus()).isEqualTo(Status.VALID); assertThat(challenge.getLocation()).isEqualTo(locationUrl); provider.close(); } /** * Test that a challenge is properly updated, with Retry-After header. */ @Test public void testUpdateRetryAfter() throws Exception { var retryAfter = Instant.now().plus(Duration.ofSeconds(30)); var provider = new TestableConnectionProvider() { @Override public int sendSignedPostAsGetRequest(URL url, Login login) { assertThat(url).isEqualTo(locationUrl); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { return getJSON("updateHttpChallengeResponse"); } @Override public Optional getRetryAfter() { return Optional.of(retryAfter); } }; var login = provider.createLogin(); var challenge = new Http01Challenge(login, getJSON("triggerHttpChallengeResponse")); var returnedRetryAfter = challenge.fetch(); assertThat(returnedRetryAfter).hasValue(retryAfter); assertThat(challenge.getStatus()).isEqualTo(Status.VALID); assertThat(challenge.getLocation()).isEqualTo(locationUrl); provider.close(); } /** * Test that unmarshalling something different like a challenge fails. */ @Test public void testBadUnmarshall() { assertThrows(AcmeProtocolException.class, () -> new Challenge(TestUtils.login(), getJSON("updateAccountResponse")) ); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/Dns01ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Dns01Challenge}. */ public class Dns01ChallengeTest { private final Login login = TestUtils.login(); /** * Test that {@link Dns01Challenge} generates a correct authorization key. */ @Test public void testDnsChallenge() { var challenge = new Dns01Challenge(login, getJSON("dns01Challenge")); assertThat(challenge.getType()).isEqualTo(Dns01Challenge.TYPE); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getDigest()).isEqualTo("rzMmotrIgsithyBYc0vgiLUEEKYx0WetQRgEF2JIozA"); assertThat(challenge.getAuthorization()).isEqualTo("pNvmJivs0WCko2suV7fhe-59oFqyYx_yB7tx6kIMAyE.HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0"); assertThat(challenge.getRRName("www.example.org")).isEqualTo("_acme-challenge.www.example.org."); assertThat(challenge.getRRName(Identifier.dns("www.example.org"))).isEqualTo("_acme-challenge.www.example.org."); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> challenge.getRRName(Identifier.ip("127.0.0.10"))); var response = new JSONBuilder(); challenge.prepareResponse(response); assertThatJson(response.toString()).isEqualTo("{}"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/DnsAccount01ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link DnsAccount01Challenge}. */ class DnsAccount01ChallengeTest { private final Login login = TestUtils.login(); /** * Test that {@link DnsAccount01Challenge} generates a correct authorization key. */ @Test public void testDnsChallenge() { var challenge = new DnsAccount01Challenge(login, getJSON("dnsAccount01Challenge")); assertThat(challenge.getType()).isEqualTo(DnsAccount01Challenge.TYPE); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getDigest()).isEqualTo("MSB8ZUQOmbNfHors7PG580PBz4f9hDuOPDN_j1bNcXI"); assertThat(challenge.getAuthorization()).isEqualTo("ODE4OWY4NTktYjhmYS00YmY1LTk5MDgtZTFjYTZmNjZlYTUx.HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0"); assertThat(challenge.getRRName("www.example.org")) .isEqualTo("_agozs7u2dml4wbyd._acme-challenge.www.example.org."); assertThat(challenge.getRRName(Identifier.dns("www.example.org"))) .isEqualTo("_agozs7u2dml4wbyd._acme-challenge.www.example.org."); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> challenge.getRRName(Identifier.ip("127.0.0.10"))); var response = new JSONBuilder(); challenge.prepareResponse(response); assertThatJson(response.toString()).isEqualTo("{}"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/DnsPersist01ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2026 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.*; import static org.shredzone.acme4j.toolbox.TestUtils.ACCOUNT_URL; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import java.time.Instant; import java.util.TreeMap; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link DnsPersist01Challenge}. */ class DnsPersist01ChallengeTest { private final Login login = TestUtils.login(); /** * Test that {@link DnsPersist01Challenge} generates a correct TXT record. */ @Test public void testDnsChallenge() { var challenge = new DnsPersist01Challenge(login, getJSON("dnsPersist01Challenge")); assertThat(challenge.getType()).isEqualTo(DnsPersist01Challenge.TYPE); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getIssuerDomainNames()).containsExactly("authority.example", "ca.example.net"); assertThat(challenge.getRRName("www.example.org")) .isEqualTo("_validation-persist.www.example.org."); assertThat(challenge.getRRName(Identifier.dns("www.example.org"))) .isEqualTo("_validation-persist.www.example.org."); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> challenge.getRRName(Identifier.ip("127.0.0.10"))); assertThat(challenge.getRData()) .isEqualTo("\"authority.example;\" \" accounturi=" + ACCOUNT_URL + "\""); assertThat(challenge.getAccountUrl().toString()) .isEqualTo(ACCOUNT_URL); var response = new JSONBuilder(); challenge.prepareResponse(response); assertThatJson(response.toString()).isEqualTo("{}"); } /** * Test that {@link DnsPersist01Challenge} generates a correct TXT record. */ @Test public void testBuilder() { var challenge = new DnsPersist01Challenge(login, getJSON("dnsPersist01Challenge")); var until = Instant.ofEpochSecond(1767225600L); assertThat(challenge.buildRData().build()) .isEqualTo("\"authority.example;\" \" accounturi=" + ACCOUNT_URL + "\""); assertThat(challenge.buildRData().wildcard().build()) .isEqualTo("\"authority.example;\" \" accounturi=" + ACCOUNT_URL + ";\" \" policy=wildcard\""); assertThat(challenge.buildRData().issuerDomainName("ca.example.net").build()) .isEqualTo("\"ca.example.net;\" \" accounturi=" + ACCOUNT_URL + "\""); assertThat(challenge.buildRData().persistUntil(until).build()) .isEqualTo("\"authority.example;\" \" accounturi=" + ACCOUNT_URL + ";\" \" persistUntil=1767225600\""); assertThat(challenge.buildRData() .wildcard() .issuerDomainName("ca.example.net") .persistUntil(until) .build() ).isEqualTo("\"ca.example.net;\" \" accounturi=" + ACCOUNT_URL + ";\" \" policy=wildcard;\" \" persistUntil=1767225600\""); assertThatIllegalArgumentException() .isThrownBy(() -> challenge.buildRData().issuerDomainName("ca.invalid").build()) .withMessage("Domain ca.invalid is not in the list of issuer-domain-names"); } /** * Test that {@link DnsPersist01Challenge} generates a correct TXT record, without * quotes. */ @Test public void testBuilderNoQuotes() { var challenge = new DnsPersist01Challenge(login, getJSON("dnsPersist01Challenge")); var until = Instant.ofEpochSecond(1767225600L); assertThat(challenge.buildRData().noQuotes().build()) .isEqualTo("authority.example; accounturi=" + ACCOUNT_URL); assertThat(challenge.buildRData() .wildcard() .issuerDomainName("ca.example.net") .persistUntil(until) .noQuotes() .build() ).isEqualTo("ca.example.net; accounturi=" + ACCOUNT_URL + "; policy=wildcard; persistUntil=1767225600"); } @Test public void testConstraintChecks() { var json = getJSON("dnsPersist01Challenge").toMap(); // Must fail if issuer-domain-names is missing var json1 = new TreeMap<>(json); json1.remove("issuer-domain-names"); var challenge1 = new DnsPersist01Challenge(login, JSON.fromMap(json1)); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(challenge1::getIssuerDomainNames) .withMessage("issuer-domain-names missing or empty"); // Must fail if issuer-domain-names is empty var json2 = new TreeMap<>(json); json2.put("issuer-domain-names", new String[0]); var challenge2 = new DnsPersist01Challenge(login, JSON.fromMap(json2)); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(challenge2::getIssuerDomainNames) .withMessage("issuer-domain-names missing or empty"); // Must not fail if issuer-domain-names contains exactly 10 records var json3 = new TreeMap<>(json); json3.put("issuer-domain-names", createDomainList(10)); var challenge3 = new DnsPersist01Challenge(login, JSON.fromMap(json3)); assertThatNoException() .isThrownBy(challenge3::getIssuerDomainNames); // Must fail if issuer-domain-names contains more than 10 records var json4 = new TreeMap<>(json); json4.put("issuer-domain-names", createDomainList(11)); var challenge4 = new DnsPersist01Challenge(login, JSON.fromMap(json4)); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(challenge4::getIssuerDomainNames) .withMessage("issuer-domain-names size limit exceeded: 11 > 10"); // Must fail if issuer-domain-names contains a trailing dot var json5 = new TreeMap<>(json); json5.put("issuer-domain-names", new String[] {"foo.example.com."}); var challenge5 = new DnsPersist01Challenge(login, JSON.fromMap(json5)); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(challenge5::getIssuerDomainNames) .withMessage("issuer-domain-names must not have trailing dots"); // Must fail if accounturi is wrong var json6 = new TreeMap<>(json); json6.put("accounturi", "https://wrong.example.com/bad/account/1234"); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> new DnsPersist01Challenge(login, JSON.fromMap(json6))) .withMessage("challenge is intended for a different account: https://wrong.example.com/bad/account/1234"); // Must not fail at the moment if accounturi is missing // (downward compatiblilty for draft-ietf-acme-dns-persist-00) var json7 = new TreeMap<>(json); json7.remove("accounturi"); assertThatNoException() .isThrownBy(() -> new DnsPersist01Challenge(login, JSON.fromMap(json7))); } private String[] createDomainList(int length) { var result = new String[length]; for (var ix = 0; ix < length; ix++) { result[ix] = "foo" + ix + ".example.com"; } return result; } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/Http01ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link Http01Challenge}. */ public class Http01ChallengeTest { private static final String TOKEN = "rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ"; private static final String KEY_AUTHORIZATION = "rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ.HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0"; private final Login login = TestUtils.login(); /** * Test that {@link Http01Challenge} generates a correct authorization key. */ @Test public void testHttpChallenge() { var challenge = new Http01Challenge(login, getJSON("httpChallenge")); assertThat(challenge.getType()).isEqualTo(Http01Challenge.TYPE); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getToken()).isEqualTo(TOKEN); assertThat(challenge.getAuthorization()).isEqualTo(KEY_AUTHORIZATION); var response = new JSONBuilder(); challenge.prepareResponse(response); assertThatJson(response.toString()).isEqualTo("{}"); } /** * Test that an exception is thrown if there is no token. */ @Test public void testNoTokenSet() { assertThrows(AcmeProtocolException.class, () -> { Http01Challenge challenge = new Http01Challenge(login, getJSON("httpNoTokenChallenge")); challenge.getToken(); }); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/TlsAlpn01ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatNoException; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import java.security.cert.CertificateParsingException; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; import org.shredzone.acme4j.util.KeyPairUtils; /** * Unit tests for {@link TlsAlpn01ChallengeTest}. */ public class TlsAlpn01ChallengeTest { private static final String TOKEN = "rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ"; private static final String KEY_AUTHORIZATION = "rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ.HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0"; private final Login login = TestUtils.login(); /** * Test that {@link TlsAlpn01Challenge} generates a correct authorization key. */ @Test public void testTlsAlpn01Challenge() { var challenge = new TlsAlpn01Challenge(login, getJSON("tlsAlpnChallenge")); assertThat(challenge.getType()).isEqualTo(TlsAlpn01Challenge.TYPE); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getToken()).isEqualTo(TOKEN); assertThat(challenge.getAuthorization()).isEqualTo(KEY_AUTHORIZATION); assertThat(challenge.getAcmeValidation()).isEqualTo(AcmeUtils.sha256hash(KEY_AUTHORIZATION)); var response = new JSONBuilder(); challenge.prepareResponse(response); assertThatJson(response.toString()).isEqualTo("{}"); } /** * Test that {@link TlsAlpn01Challenge} generates a correct test certificate */ @Test public void testTlsAlpn01Certificate() throws CertificateParsingException { var challenge = new TlsAlpn01Challenge(login, getJSON("tlsAlpnChallenge")); var keypair = KeyPairUtils.createKeyPair(2048); var subject = Identifier.dns("example.com"); var certificate = challenge.createCertificate(keypair, subject); // Only check the main requirements. Cert generation is fully tested in CertificateUtilsTest. assertThat(certificate).isNotNull(); assertThat(certificate.getSubjectX500Principal().getName()).isEqualTo("CN=acme.invalid"); assertThat(certificate.getSubjectAlternativeNames().stream() .map(l -> l.get(1)) .map(Object::toString)).contains(subject.getDomain()); assertThat(certificate.getCriticalExtensionOIDs()).contains(TlsAlpn01Challenge.ACME_VALIDATION_OID); assertThatNoException().isThrownBy(() -> certificate.verify(keypair.getPublic())); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/challenge/TokenChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2019 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.challenge; import static org.junit.jupiter.api.Assertions.assertThrows; import java.io.IOException; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Unit tests for {@link TokenChallenge}. */ public class TokenChallengeTest { /** * Test that invalid tokens are detected. */ @Test public void testInvalidToken() throws IOException { var provider = new TestableConnectionProvider(); var login = provider.createLogin(); var jb = new JSONBuilder(); jb.put("url", "https://example.com/acme/1234"); jb.put("type", "generic"); jb.put("token", ""); var challenge = new TokenChallenge(login, jb.toJSON()); assertThrows(AcmeProtocolException.class, challenge::getToken); provider.close(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/DefaultConnectionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static java.nio.charset.StandardCharsets.UTF_8; import static java.time.temporal.ChronoUnit.SECONDS; import static com.github.tomakehurst.wiremock.client.WireMock.*; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.getResourceAsByteArray; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.ByteArrayOutputStream; import java.io.OutputStreamWriter; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.security.KeyPair; import java.security.cert.X509Certificate; import java.time.Duration; import java.time.Instant; import java.time.ZoneId; import java.time.ZoneOffset; import java.time.ZonedDateTime; import java.time.format.DateTimeFormatter; import java.util.Arrays; import java.util.Base64; import java.util.List; import java.util.Locale; import com.github.tomakehurst.wiremock.junit5.WireMockRuntimeInfo; import com.github.tomakehurst.wiremock.junit5.WireMockTest; import org.jose4j.jws.JsonWebSignature; import org.jose4j.jwx.CompactSerializer; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.exception.AcmeRateLimitedException; import org.shredzone.acme4j.exception.AcmeServerException; import org.shredzone.acme4j.exception.AcmeUnauthorizedException; import org.shredzone.acme4j.exception.AcmeUserActionRequiredException; import org.shredzone.acme4j.toolbox.AcmeUtils; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.JoseUtils; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link DefaultConnection}. */ @WireMockTest public class DefaultConnectionTest { private static final Base64.Encoder URL_ENCODER = Base64.getUrlEncoder().withoutPadding(); private static final Base64.Decoder URL_DECODER = Base64.getUrlDecoder(); private static final DateTimeFormatter DATE_FORMATTER = DateTimeFormatter.RFC_1123_DATE_TIME.withZone(ZoneOffset.UTC); private static final String DIRECTORY_PATH = "/dir"; private static final String NEW_NONCE_PATH = "/newNonce"; private static final String REQUEST_PATH = "/test/test"; private static final String TEST_ACCEPT_LANGUAGE = "ja-JP,ja;q=0.8,*;q=0.1"; private static final String TEST_ACCEPT_CHARSET = "utf-8"; private static final String TEST_USER_AGENT_PATTERN = "^acme4j/.*$"; private final URL accountUrl = TestUtils.url(TestUtils.ACCOUNT_URL); private Session session; private Login login; private KeyPair keyPair; private String baseUrl; private URL directoryUrl; private URL newNonceUrl; private URL requestUrl; @BeforeEach public void setup(WireMockRuntimeInfo wmRuntimeInfo) throws Exception { baseUrl = wmRuntimeInfo.getHttpBaseUrl(); directoryUrl = URI.create(baseUrl + DIRECTORY_PATH).toURL(); newNonceUrl = URI.create(baseUrl + NEW_NONCE_PATH).toURL(); requestUrl = URI.create(baseUrl + REQUEST_PATH).toURL(); session = new Session(directoryUrl.toURI()); session.setLocale(Locale.JAPAN); keyPair = TestUtils.createKeyPair(); login = session.login(accountUrl, keyPair); var directory = new JSONBuilder(); directory.put("newNonce", newNonceUrl); stubFor(get(DIRECTORY_PATH).willReturn(okJson(directory.toString()))); } /** * Test that {@link DefaultConnection#getNonce()} is empty if there is no * {@code Replay-Nonce} header. */ @Test public void testNoNonceFromHeader() throws AcmeException { stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok())); try (var nonceHolder = session.lockNonce(); var conn = session.connect()) { assertThat(nonceHolder.getNonce()).isNull(); conn.sendRequest(directoryUrl, session, null); assertThat(conn.getNonce()).isEmpty(); } } /** * Test that {@link DefaultConnection#getNonce()} extracts a {@code Replay-Nonce} * header correctly. */ @Test public void testGetNonceFromHeader() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Replay-Nonce", TestUtils.DUMMY_NONCE) )); try (var nonceHolder = session.lockNonce(); var conn = session.connect()) { assertThat(nonceHolder.getNonce()).isNull(); conn.sendRequest(requestUrl, session, null); assertThat(conn.getNonce().orElseThrow()).isEqualTo(TestUtils.DUMMY_NONCE); assertThat(nonceHolder.getNonce()).isEqualTo(TestUtils.DUMMY_NONCE); } verify(getRequestedFor(urlEqualTo(REQUEST_PATH))); } /** * Test that {@link DefaultConnection#getNonce()} handles fails correctly. */ @Test public void testGetNonceFromHeaderFailed() throws AcmeException { var retryAfter = Instant.now().plusSeconds(30L).truncatedTo(SECONDS); stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_UNAVAILABLE) .withHeader("Content-Type", "application/problem+json") // do not send a body here because it is a HEAD request! )); try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isNull(); assertThatExceptionOfType(AcmeException.class).isThrownBy(() -> { try (var conn = session.connect()) { conn.resetNonce(session); } }); } verify(headRequestedFor(urlEqualTo(NEW_NONCE_PATH))); } /** * Test that {@link DefaultConnection#getNonce()} handles a general HTTP error * correctly. */ @Test public void testGetNonceFromHeaderHttpError() { stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_INTERNAL_ERROR) // do not send a body here because it is a HEAD request! )); try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isNull(); var ex = assertThrows(AcmeException.class, () -> { try (var conn = session.connect()) { conn.resetNonce(session); } }); assertThat(ex.getMessage()).isEqualTo("Server responded with HTTP 500 while trying to retrieve a nonce"); } verify(headRequestedFor(urlEqualTo(NEW_NONCE_PATH))); } /** * Test that {@link DefaultConnection#getNonce()} fails on an invalid * {@code Replay-Nonce} header. */ @Test public void testInvalidNonceFromHeader() { var badNonce = "#$%&/*+*#'"; stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Replay-Nonce", badNonce) )); var ex = assertThrows(AcmeProtocolException.class, () -> { try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); conn.getNonce(); } }); assertThat(ex.getMessage()).startsWith("Invalid replay nonce"); verify(getRequestedFor(urlEqualTo(REQUEST_PATH))); } /** * Test that {@link DefaultConnection#resetNonce(Session)} fetches a new nonce via * new-nonce resource and a HEAD request. */ @Test public void testResetNonceSucceedsIfNoncePresent() throws AcmeException { stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok() .withHeader("Replay-Nonce", TestUtils.DUMMY_NONCE) )); try (var nonceHolder = session.lockNonce(); var conn = session.connect()) { assertThat(nonceHolder.getNonce()).isNull(); conn.resetNonce(session); assertThat(nonceHolder.getNonce()).isEqualTo(TestUtils.DUMMY_NONCE); } } /** * Test that {@link DefaultConnection#resetNonce(Session)} throws an exception if * there is no nonce header. */ @Test public void testResetNonceThrowsException() { stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok())); try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isNull(); assertThrows(AcmeProtocolException.class, () -> { try (var conn = session.connect()) { conn.resetNonce(session); } }); assertThat(nonceHolder.getNonce()).isNull(); } } /** * Test that an absolute Location header is evaluated. */ @Test public void testGetAbsoluteLocation() throws Exception { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Location", "https://example.com/otherlocation") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); var location = conn.getLocation(); assertThat(location).isEqualTo(URI.create("https://example.com/otherlocation").toURL()); } } /** * Test that a relative Location header is evaluated. */ @Test public void testGetRelativeLocation() throws Exception { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Location", "/otherlocation") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); var location = conn.getLocation(); assertThat(location).isEqualTo(URI.create(baseUrl + "/otherlocation").toURL()); } } /** * Test that absolute and relative Link headers are evaluated. */ @Test public void testGetLink() throws Exception { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Link", ";rel=\"next\"") .withHeader("Link", ";rel=recover") .withHeader("Link", "; rel=\"terms-of-service\"") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getLinks("next")).containsExactly(URI.create("https://example.com/acme/new-authz").toURL()); assertThat(conn.getLinks("recover")).containsExactly(URI.create(baseUrl + "/recover-acct").toURL()); assertThat(conn.getLinks("terms-of-service")).containsExactly(URI.create("https://example.com/acme/terms").toURL()); assertThat(conn.getLinks("secret-stuff")).isEmpty(); } } /** * Test that multiple link headers are evaluated. */ @Test public void testGetMultiLink() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Link", "; rel=\"terms-of-service\"") .withHeader("Link", "; rel=\"terms-of-service\"") .withHeader("Link", "<../terms3>; rel=\"terms-of-service\"") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getLinks("terms-of-service")).containsExactlyInAnyOrder( url("https://example.com/acme/terms1"), url("https://example.com/acme/terms2"), url(baseUrl + "/terms3") ); } } /** * Test that link headers with multiple header fields are evaluated */ @Test public void testGetMultiHeaderFieldLink() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Link", "; rel=\"terms-of-service\"; title=\"Please Read\"") .withHeader("Link", "; title=\"Please read and accept\"; rel=\"terms-of-service\"") .withHeader("Link", "<../terms3>; anchor=\"foo\"; rel=\"terms-of-service\" ; title=\"More ToS to read\"") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getLinks("terms-of-service")).containsExactlyInAnyOrder( url("https://example.com/acme/terms1"), url("https://example.com/acme/terms2"), url(baseUrl + "/terms3") ); } } /** * Test that no link headers are properly handled. */ @Test public void testGetNoLink() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok())); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getLinks("something")).isEmpty(); } } /** * Test that no Location header returns {@code null}. */ @Test public void testNoLocation() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok())); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(conn::getLocation); } verify(getRequestedFor(urlEqualTo(REQUEST_PATH))); } /** * Test if Retry-After header with absolute date is correctly parsed. */ @Test public void testHandleRetryAfterHeaderDate() throws AcmeException { var retryDate = Instant.now().plus(Duration.ofHours(10)).truncatedTo(SECONDS); stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Retry-After", DATE_FORMATTER.format(retryDate)) )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getRetryAfter()).hasValue(retryDate); } } /** * Test if Retry-After header with relative timespan is correctly parsed. */ @Test public void testHandleRetryAfterHeaderDelta() throws AcmeException { var delta = 10 * 60 * 60; var now = Instant.now().truncatedTo(SECONDS); var retryMsg = "relative time"; stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Retry-After", String.valueOf(delta)) .withHeader("Date", DATE_FORMATTER.format(now)) )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getRetryAfter()).hasValue(now.plusSeconds(delta)); } } /** * Test if no Retry-After header is correctly handled. */ @Test public void testHandleRetryAfterHeaderNull() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Date", DATE_FORMATTER.format(Instant.now())) )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getRetryAfter()).isEmpty(); } verify(getRequestedFor(urlEqualTo(REQUEST_PATH))); } /** * Test if no exception is thrown on a standard request. */ @Test public void testAccept() throws AcmeException { stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withBody("") )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } try (var conn = session.connect()) { var rc = conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); assertThat(rc).isEqualTo(HttpURLConnection.HTTP_OK); } verify(postRequestedFor(urlEqualTo(REQUEST_PATH))); } /** * Test if an {@link AcmeServerException} is thrown on an acme problem. */ @Test public void testAcceptThrowsException() { var problem = new JSONBuilder(); problem.put("type", "urn:ietf:params:acme:error:unauthorized"); problem.put("detail", "Invalid response: 404"); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_FORBIDDEN) .withHeader("Content-Type", "application/problem+json") .withBody(problem.toString()) )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } var ex = assertThrows(AcmeException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); } }); assertThat(ex).isInstanceOf(AcmeUnauthorizedException.class); assertThat(((AcmeUnauthorizedException) ex).getType()) .isEqualTo(URI.create("urn:ietf:params:acme:error:unauthorized")); assertThat(ex.getMessage()).isEqualTo("Invalid response: 404"); } /** * Test if an {@link AcmeUserActionRequiredException} is thrown on an acme problem. */ @Test public void testAcceptThrowsUserActionRequiredException() { var problem = new JSONBuilder(); problem.put("type", "urn:ietf:params:acme:error:userActionRequired"); problem.put("detail", "Accept the TOS"); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_FORBIDDEN) .withHeader("Content-Type", "application/problem+json") .withHeader("Link", "; rel=\"terms-of-service\"") .withBody(problem.toString()) )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } var ex = assertThrows(AcmeException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); } }); assertThat(ex).isInstanceOf(AcmeUserActionRequiredException.class); assertThat(((AcmeUserActionRequiredException) ex).getType()) .isEqualTo(URI.create("urn:ietf:params:acme:error:userActionRequired")); assertThat(ex.getMessage()).isEqualTo("Accept the TOS"); assertThat(((AcmeUserActionRequiredException) ex).getTermsOfServiceUri().orElseThrow()) .isEqualTo(URI.create("https://example.com/tos.pdf")); } /** * Test if an {@link AcmeRateLimitedException} is thrown on an acme problem. */ @Test public void testAcceptThrowsRateLimitedException() { var problem = new JSONBuilder(); problem.put("type", "urn:ietf:params:acme:error:rateLimited"); problem.put("detail", "Too many invocations"); var retryAfter = Instant.now().plusSeconds(30L).truncatedTo(SECONDS); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_FORBIDDEN) .withHeader("Content-Type", "application/problem+json") .withHeader("Link", "; rel=\"help\"") .withHeader("Retry-After", DATE_FORMATTER.format(retryAfter)) .withBody(problem.toString()) )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } var ex = assertThrows(AcmeRateLimitedException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); } }); assertThat(ex.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:rateLimited")); assertThat(ex.getMessage()).isEqualTo("Too many invocations"); assertThat(ex.getRetryAfter().orElseThrow()).isEqualTo(retryAfter); assertThat(ex.getDocuments()).isNotNull(); assertThat(ex.getDocuments()).hasSize(1); assertThat(ex.getDocuments().iterator().next()).isEqualTo(url("https://example.com/rates.pdf")); } /** * Test if an {@link AcmeServerException} is thrown on another problem. */ @Test public void testAcceptThrowsOtherException() { var problem = new JSONBuilder(); problem.put("type", "urn:zombie:error:apocalypse"); problem.put("detail", "Zombie apocalypse in progress"); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_INTERNAL_ERROR) .withHeader("Content-Type", "application/problem+json") .withBody(problem.toString()) )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } var ex = assertThrows(AcmeServerException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); } }); assertThat(ex.getType()).isEqualTo(URI.create("urn:zombie:error:apocalypse")); assertThat(ex.getMessage()).isEqualTo("Zombie apocalypse in progress"); } /** * Test if an {@link AcmeException} is thrown if there is no error type. */ @Test public void testAcceptThrowsNoTypeException() { stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_INTERNAL_ERROR) .withHeader("Content-Type", "application/problem+json") .withBody("{}") )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } var ex = assertThrows(AcmeProtocolException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); } }); assertThat(ex.getMessage()).isNotEmpty(); } /** * Test if an {@link AcmeException} is thrown if there is a generic error. */ @Test public void testAcceptThrowsServerException() { stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_INTERNAL_ERROR) .withStatusMessage("Infernal Server Error") .withHeader("Content-Type", "text/html") .withBody("Infernal Server Error") )); try (var nonceHolder = session.lockNonce()) { nonceHolder.setNonce(TestUtils.DUMMY_NONCE); } var ex = assertThrows(AcmeException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), login); } }); assertThat(ex.getMessage()).isEqualTo("HTTP 500"); } /** * Test GET requests. */ @Test public void testSendRequest() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok())); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); } verify(getRequestedFor(urlEqualTo(REQUEST_PATH)) .withHeader("Accept", equalTo("application/json")) .withHeader("Accept-Charset", equalTo(TEST_ACCEPT_CHARSET)) .withHeader("Accept-Language", equalTo(TEST_ACCEPT_LANGUAGE)) .withHeader("User-Agent", matching(TEST_USER_AGENT_PATTERN)) ); } /** * Test GET requests with If-Modified-Since. */ @Test public void testSendRequestIfModifiedSince() throws AcmeException { var ifModifiedSince = ZonedDateTime.now(ZoneId.of("UTC")).truncatedTo(SECONDS); stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(aResponse() .withStatus(HttpURLConnection.HTTP_NOT_MODIFIED)) ); try (var conn = session.connect()) { var rc = conn.sendRequest(requestUrl, session, ifModifiedSince); assertThat(rc).isEqualTo(HttpURLConnection.HTTP_NOT_MODIFIED); } verify(getRequestedFor(urlEqualTo(REQUEST_PATH)) .withHeader("If-Modified-Since", equalToDateTime(ifModifiedSince)) .withHeader("Accept", equalTo("application/json")) .withHeader("Accept-Charset", equalTo(TEST_ACCEPT_CHARSET)) .withHeader("Accept-Language", equalTo(TEST_ACCEPT_LANGUAGE)) .withHeader("User-Agent", matching(TEST_USER_AGENT_PATTERN)) ); } /** * Test signed POST requests. */ @Test public void testSendSignedRequest() throws Exception { var nonce1 = URL_ENCODER.encodeToString("foo-nonce-1-foo".getBytes()); var nonce2 = URL_ENCODER.encodeToString("foo-nonce-2-foo".getBytes()); stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce1))); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce2) )); try (var conn = session.connect()) { var cb = new JSONBuilder(); cb.put("foo", 123).put("bar", "a-string"); conn.sendSignedRequest(requestUrl, cb, login); } try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isEqualTo(nonce2); } verify(postRequestedFor(urlEqualTo(REQUEST_PATH)) .withHeader("Accept", equalTo("application/json")) .withHeader("Accept-Charset", equalTo(TEST_ACCEPT_CHARSET)) .withHeader("Accept-Language", equalTo(TEST_ACCEPT_LANGUAGE)) .withHeader("User-Agent", matching(TEST_USER_AGENT_PATTERN)) ); var requests = findAll(postRequestedFor(urlEqualTo(REQUEST_PATH))); assertThat(requests).hasSize(1); var data = JSON.parse(requests.get(0).getBodyAsString()); var encodedHeader = data.get("protected").asString(); var encodedSignature = data.get("signature").asString(); var encodedPayload = data.get("payload").asString(); var expectedHeader = new StringBuilder(); expectedHeader.append('{'); expectedHeader.append("\"nonce\":\"").append(nonce1).append("\","); expectedHeader.append("\"url\":\"").append(requestUrl).append("\","); expectedHeader.append("\"alg\":\"RS256\","); expectedHeader.append("\"kid\":\"").append(accountUrl).append('"'); expectedHeader.append('}'); assertThatJson(new String(URL_DECODER.decode(encodedHeader), UTF_8)).isEqualTo(expectedHeader.toString()); assertThatJson(new String(URL_DECODER.decode(encodedPayload), UTF_8)).isEqualTo("{\"foo\":123,\"bar\":\"a-string\"}"); assertThat(encodedSignature).isNotEmpty(); var jws = new JsonWebSignature(); jws.setCompactSerialization(CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature)); jws.setKey(login.getPublicKey()); assertThat(jws.verifySignature()).isTrue(); } /** * Test signed POST-as-GET requests. */ @Test public void testSendSignedPostAsGetRequest() throws Exception { var nonce1 = URL_ENCODER.encodeToString("foo-nonce-1-foo".getBytes()); var nonce2 = URL_ENCODER.encodeToString("foo-nonce-2-foo".getBytes()); stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce1))); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce2))); try (var conn = session.connect()) { conn.sendSignedPostAsGetRequest(requestUrl, login); } try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isEqualTo(nonce2); } verify(postRequestedFor(urlEqualTo(REQUEST_PATH)) .withHeader("Accept", equalTo("application/json")) .withHeader("Accept-Charset", equalTo(TEST_ACCEPT_CHARSET)) .withHeader("Accept-Language", equalTo(TEST_ACCEPT_LANGUAGE)) .withHeader("Content-Type", equalTo("application/jose+json")) .withHeader("User-Agent", matching(TEST_USER_AGENT_PATTERN)) ); var requests = findAll(postRequestedFor(urlEqualTo(REQUEST_PATH))); assertThat(requests).hasSize(1); var data = JSON.parse(requests.get(0).getBodyAsString()); var encodedHeader = data.get("protected").asString(); var encodedSignature = data.get("signature").asString(); var encodedPayload = data.get("payload").asString(); var expectedHeader = new StringBuilder(); expectedHeader.append('{'); expectedHeader.append("\"nonce\":\"").append(nonce1).append("\","); expectedHeader.append("\"url\":\"").append(requestUrl).append("\","); expectedHeader.append("\"alg\":\"RS256\","); expectedHeader.append("\"kid\":\"").append(accountUrl).append('"'); expectedHeader.append('}'); assertThatJson(new String(URL_DECODER.decode(encodedHeader), UTF_8)).isEqualTo(expectedHeader.toString()); assertThat(new String(URL_DECODER.decode(encodedPayload), UTF_8)).isEqualTo(""); assertThat(encodedSignature).isNotEmpty(); var jws = new JsonWebSignature(); jws.setCompactSerialization(CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature)); jws.setKey(login.getPublicKey()); assertThat(jws.verifySignature()).isTrue(); } /** * Test certificate POST-as-GET requests. */ @Test public void testSendCertificateRequest() throws AcmeException { var nonce1 = URL_ENCODER.encodeToString("foo-nonce-1-foo".getBytes()); var nonce2 = URL_ENCODER.encodeToString("foo-nonce-2-foo".getBytes()); stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce1))); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce2))); try (var conn = session.connect()) { conn.sendCertificateRequest(requestUrl, login); } try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isEqualTo(nonce2); } verify(postRequestedFor(urlEqualTo(REQUEST_PATH)) .withHeader("Accept", equalTo("application/pem-certificate-chain")) .withHeader("Accept-Charset", equalTo(TEST_ACCEPT_CHARSET)) .withHeader("Accept-Language", equalTo(TEST_ACCEPT_LANGUAGE)) .withHeader("Content-Type", equalTo("application/jose+json")) .withHeader("User-Agent", matching(TEST_USER_AGENT_PATTERN)) ); } /** * Test signed POST requests without KeyIdentifier. */ @Test public void testSendSignedRequestNoKid() throws Exception { var nonce1 = URL_ENCODER.encodeToString("foo-nonce-1-foo".getBytes()); var nonce2 = URL_ENCODER.encodeToString("foo-nonce-2-foo".getBytes()); stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce1))); stubFor(post(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Replay-Nonce", nonce2))); try (var conn = session.connect()) { var cb = new JSONBuilder(); cb.put("foo", 123).put("bar", "a-string"); conn.sendSignedRequest(requestUrl, cb, session, (url, payload, nonce) -> JoseUtils.createJoseRequest(url, keyPair, payload, nonce, null)); } try (var nonceHolder = session.lockNonce()) { assertThat(nonceHolder.getNonce()).isEqualTo(nonce2); } verify(postRequestedFor(urlEqualTo(REQUEST_PATH)) .withHeader("Accept", equalTo("application/json")) .withHeader("Accept-Charset", equalTo(TEST_ACCEPT_CHARSET)) .withHeader("Accept-Language", equalTo(TEST_ACCEPT_LANGUAGE)) .withHeader("Content-Type", equalTo("application/jose+json")) .withHeader("User-Agent", matching(TEST_USER_AGENT_PATTERN)) ); var requests = findAll(postRequestedFor(urlEqualTo(REQUEST_PATH))); assertThat(requests).hasSize(1); var data = JSON.parse(requests.get(0).getBodyAsString()); String encodedHeader = data.get("protected").asString(); String encodedSignature = data.get("signature").asString(); String encodedPayload = data.get("payload").asString(); var expectedHeader = new StringBuilder(); expectedHeader.append('{'); expectedHeader.append("\"nonce\":\"").append(nonce1).append("\","); expectedHeader.append("\"url\":\"").append(requestUrl).append("\","); expectedHeader.append("\"alg\":\"RS256\","); expectedHeader.append("\"jwk\":{"); expectedHeader.append("\"kty\":\"").append(TestUtils.KTY).append("\","); expectedHeader.append("\"e\":\"").append(TestUtils.E).append("\","); expectedHeader.append("\"n\":\"").append(TestUtils.N).append("\""); expectedHeader.append("}}"); assertThatJson(new String(URL_DECODER.decode(encodedHeader), UTF_8)) .isEqualTo(expectedHeader.toString()); assertThatJson(new String(URL_DECODER.decode(encodedPayload), UTF_8)) .isEqualTo("{\"foo\":123,\"bar\":\"a-string\"}"); assertThat(encodedSignature).isNotEmpty(); var jws = new JsonWebSignature(); jws.setCompactSerialization(CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature)); jws.setKey(login.getPublicKey()); assertThat(jws.verifySignature()).isTrue(); } /** * Test signed POST requests if there is no nonce. */ @Test public void testSendSignedRequestNoNonce() { stubFor(head(urlEqualTo(NEW_NONCE_PATH)).willReturn(notFound())); assertThrows(AcmeException.class, () -> { try (var conn = session.connect()) { conn.sendSignedRequest(requestUrl, new JSONBuilder(), session, (url, payload, nonce) -> JoseUtils.createJoseRequest(url, keyPair, payload, nonce, null)); } }); } /** * Test getting a JSON response. */ @Test public void testReadJsonResponse() throws AcmeException { var response = new JSONBuilder(); response.put("foo", 123); response.put("bar", "a-string"); stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Content-Type", "application/json") .withBody(response.toString()) )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); var result = conn.readJsonResponse(); assertThat(result).isNotNull(); assertThat(result.keySet()).hasSize(2); assertThat(result.get("foo").asInt()).isEqualTo(123); assertThat(result.get("bar").asString()).isEqualTo("a-string"); } } /** * Test that a certificate is downloaded correctly. */ @Test public void testReadCertificate() throws Exception { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Content-Type", "application/pem-certificate-chain") .withBody(getResourceAsByteArray("/cert.pem")) )); List downloaded; try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); downloaded = conn.readCertificates(); } var original = TestUtils.createCertificate("/cert.pem"); assertThat(original).hasSize(2); assertThat(downloaded).isNotNull(); assertThat(downloaded).hasSize(original.size()); for (var ix = 0; ix < downloaded.size(); ix++) { assertThat(downloaded.get(ix).getEncoded()).isEqualTo(original.get(ix).getEncoded()); } } /** * Test that a bad certificate throws an exception. */ @Test public void testReadBadCertificate() throws Exception { // Build a broken certificate chain PEM file byte[] brokenPem; try (var baos = new ByteArrayOutputStream(); var w = new OutputStreamWriter(baos)) { for (var cert : TestUtils.createCertificate("/cert.pem")) { var badCert = cert.getEncoded(); Arrays.sort(badCert); // break it AcmeUtils.writeToPem(badCert, AcmeUtils.PemLabel.CERTIFICATE, w); } w.flush(); brokenPem = baos.toByteArray(); } stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Content-Type", "application/pem-certificate-chain") .withBody(brokenPem) )); assertThrows(AcmeProtocolException.class, () -> { try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); conn.readCertificates(); } }); } /** * Test that {@link DefaultConnection#getLastModified()} returns valid dates. */ @Test public void testLastModifiedUnset() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok())); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getLastModified().isPresent()).isFalse(); } } @Test public void testLastModifiedSet() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Last-Modified", "Thu, 07 May 2020 19:42:46 GMT") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); var lm = conn.getLastModified(); assertThat(lm.isPresent()).isTrue(); assertThat(lm.get().format(DateTimeFormatter.ISO_DATE_TIME)) .isEqualTo("2020-05-07T19:42:46Z"); } } @Test public void testLastModifiedInvalid() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Last-Modified", "iNvAlId") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getLastModified().isPresent()).isFalse(); } } /** * Test that {@link DefaultConnection#getExpiration()} returns valid dates. */ @Test public void testExpirationUnset() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok())); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getExpiration().isPresent()).isFalse(); } } @Test public void testExpirationNoCache() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Cache-Control", "public, no-cache") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getExpiration().isPresent()).isFalse(); } } @Test public void testExpirationMaxAgeZero() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Cache-Control", "public, max-age=0, no-cache") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getExpiration().isPresent()).isFalse(); } } @Test public void testExpirationMaxAgeButNoCache() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Cache-Control", "public, max-age=3600, no-cache") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getExpiration().isPresent()).isFalse(); } } @Test public void testExpirationMaxAge() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Cache-Control", "max-age=3600") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); var exp = conn.getExpiration(); assertThat(exp.isPresent()).isTrue(); assertThat(exp.get().isAfter(ZonedDateTime.now().plusHours(1).minusMinutes(1))).isTrue(); assertThat(exp.get().isBefore(ZonedDateTime.now().plusHours(1).plusMinutes(1))).isTrue(); } } @Test public void testExpirationExpires() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Expires", "Thu, 18 Jun 2020 08:43:04 GMT") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); var exp = conn.getExpiration(); assertThat(exp.isPresent()).isTrue(); assertThat(exp.get().format(DateTimeFormatter.ISO_DATE_TIME)) .isEqualTo("2020-06-18T08:43:04Z"); } } @Test public void testExpirationInvalidExpires() throws AcmeException { stubFor(get(urlEqualTo(REQUEST_PATH)).willReturn(ok() .withHeader("Expires", "iNvAlId") )); try (var conn = session.connect()) { conn.sendRequest(requestUrl, session, null); assertThat(conn.getExpiration().isPresent()).isFalse(); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/DummyConnection.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import java.net.URL; import java.security.cert.X509Certificate; import java.time.Instant; import java.time.ZonedDateTime; import java.util.Collection; import java.util.List; import java.util.Optional; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Dummy implementation of {@link Connection} that always fails. Single methods are * supposed to be overridden for testing. */ public class DummyConnection implements Connection { @Override public void resetNonce(Session session) { throw new UnsupportedOperationException(); } @Override public int sendRequest(URL url, Session session, ZonedDateTime ifModifiedSince) { throw new UnsupportedOperationException(); } @Override public int sendCertificateRequest(URL url, Login login) { throw new UnsupportedOperationException(); } @Override public int sendSignedPostAsGetRequest(URL url, Login login) { throw new UnsupportedOperationException(); } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Login login) throws AcmeException { throw new UnsupportedOperationException(); } @Override public int sendSignedRequest(URL url, JSONBuilder claims, Session session, RequestSigner signer) { throw new UnsupportedOperationException(); } @Override public JSON readJsonResponse() { throw new UnsupportedOperationException(); } @Override public List readCertificates() { throw new UnsupportedOperationException(); } @Override public Optional getRetryAfter() { throw new UnsupportedOperationException(); } @Override public Optional getNonce() { throw new UnsupportedOperationException(); } @Override public URL getLocation() { throw new UnsupportedOperationException(); } @Override public Optional getLastModified() { throw new UnsupportedOperationException(); } @Override public Optional getExpiration() { throw new UnsupportedOperationException(); } @Override public Collection getLinks(String relation) { throw new UnsupportedOperationException(); } @Override public void close() { // closing is always safe } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/HttpConnectorTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static org.assertj.core.api.Assertions.assertThat; import java.net.URI; import java.net.http.HttpClient; import org.junit.jupiter.api.Test; /** * Unit tests for {@link HttpConnector}. */ public class HttpConnectorTest { /** * Test if a {@link java.net.http.HttpRequest.Builder} can be created and has proper * default values. */ @Test public void testRequestBuilderDefaultValues() throws Exception { var url = URI.create("http://example.org:123/foo").toURL(); var settings = new NetworkSettings(); var httpClient = HttpClient.newBuilder().build(); var connector = new HttpConnector(settings, httpClient); var request = connector.createRequestBuilder(url).build(); assertThat(request.uri().toString()).isEqualTo(url.toExternalForm()); assertThat(request.timeout().orElseThrow()).isEqualTo(settings.getTimeout()); assertThat(request.headers().firstValue("User-Agent").orElseThrow()) .isEqualTo(HttpConnector.defaultUserAgent()); } /** * Tests that the user agent is correct. */ @Test public void testUserAgent() { var userAgent = HttpConnector.defaultUserAgent(); assertThat(userAgent).contains("acme4j/"); assertThat(userAgent).contains("Java/"); } /** * Test that getHttpClient returns the HttpClient passed to the constructor. */ @Test public void testGetHttpClient() { var settings = new NetworkSettings(); var httpClient = HttpClient.newBuilder().build(); var connector = new HttpConnector(settings, httpClient); // Should return the same client instance that was passed in assertThat(connector.getHttpClient()).isSameAs(httpClient); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/NetworkSettingsTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2019 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import java.net.Authenticator; import java.net.InetSocketAddress; import java.net.ProxySelector; import java.net.http.HttpClient; import java.time.Duration; import org.junit.jupiter.api.Test; /** * Unit tests for {@link NetworkSettings}. */ public class NetworkSettingsTest { /** * Test getters and setters. */ @Test public void testGettersAndSetters() { var settings = new NetworkSettings(); var proxyAddress = new InetSocketAddress("198.51.100.1", 8080); var proxySelector = ProxySelector.of(proxyAddress); assertThat(settings.getProxySelector()).isSameAs(HttpClient.Builder.NO_PROXY); settings.setProxySelector(proxySelector); assertThat(settings.getProxySelector()).isSameAs(proxySelector); settings.setProxySelector(null); assertThat(settings.getProxySelector()).isEqualTo(HttpClient.Builder.NO_PROXY); assertThat(settings.getTimeout()).isEqualTo(Duration.ofSeconds(30)); settings.setTimeout(Duration.ofMillis(5120)); assertThat(settings.getTimeout()).isEqualTo(Duration.ofMillis(5120)); var defaultAuthenticator = Authenticator.getDefault(); assertThat(settings.getAuthenticator()).isNull(); settings.setAuthenticator(defaultAuthenticator); assertThat(settings.getAuthenticator()).isSameAs(defaultAuthenticator); assertThat(settings.isCompressionEnabled()).isTrue(); settings.setCompressionEnabled(false); assertThat(settings.isCompressionEnabled()).isFalse(); } @Test public void testInvalidTimeouts() { var settings = new NetworkSettings(); assertThrows(IllegalArgumentException.class, () -> settings.setTimeout(null), "timeout accepted null"); assertThrows(IllegalArgumentException.class, () -> settings.setTimeout(Duration.ZERO), "timeout accepted zero duration"); assertThrows(IllegalArgumentException.class, () -> settings.setTimeout(Duration.ofSeconds(20).negated()), "timeout accepted negative duration"); } @Test public void testSystemProperty() { assertThat(NetworkSettings.GZIP_PROPERTY_NAME) .startsWith("org.shredzone.acme4j") .contains("gzip"); System.clearProperty(NetworkSettings.GZIP_PROPERTY_NAME); var settingsNone = new NetworkSettings(); assertThat(settingsNone.isCompressionEnabled()).isTrue(); System.setProperty(NetworkSettings.GZIP_PROPERTY_NAME, "true"); var settingsTrue = new NetworkSettings(); assertThat(settingsTrue.isCompressionEnabled()).isTrue(); System.setProperty(NetworkSettings.GZIP_PROPERTY_NAME, "false"); var settingsFalse = new NetworkSettings(); assertThat(settingsFalse.isCompressionEnabled()).isFalse(); System.setProperty(NetworkSettings.GZIP_PROPERTY_NAME, "1234"); var settingsNonBoolean = new NetworkSettings(); assertThat(settingsNonBoolean.isCompressionEnabled()).isFalse(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/ResourceIteratorTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.IOException; import java.net.HttpURLConnection; import java.net.URL; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; import java.util.Iterator; import java.util.List; import java.util.NoSuchElementException; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Authorization; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.provider.TestableConnectionProvider; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * Unit test for {@link ResourceIterator}. */ public class ResourceIteratorTest { private static final int PAGES = 4; private static final int RESOURCES_PER_PAGE = 5; private static final String TYPE = "authorizations"; private final List resourceURLs = new ArrayList<>(PAGES * RESOURCES_PER_PAGE); private final List pageURLs = new ArrayList<>(PAGES); @BeforeEach public void setup() { resourceURLs.clear(); for (var ix = 0; ix < RESOURCES_PER_PAGE * PAGES; ix++) { resourceURLs.add(url("https://example.com/acme/auth/" + ix)); } pageURLs.clear(); for (var ix = 0; ix < PAGES; ix++) { pageURLs.add(url("https://example.com/acme/batch/" + ix)); } } /** * Test if the {@link ResourceIterator} handles a {@code null} start URL. */ @Test public void nullTest() { assertThrows(NoSuchElementException.class, () -> { var it = createIterator(null); assertThat(it).isNotNull(); assertThat(it.hasNext()).isFalse(); it.next(); // throws NoSuchElementException }); } /** * Test if the {@link ResourceIterator} returns all objects in the correct order. */ @Test public void iteratorTest() throws IOException { var result = new ArrayList(); var it = createIterator(pageURLs.get(0)); while (it.hasNext()) { result.add(it.next().getLocation()); } assertThat(result).isEqualTo(resourceURLs); } /** * Test unusual {@link Iterator#next()} and {@link Iterator#hasNext()} usage. */ @Test public void nextHasNextTest() throws IOException { var result = new ArrayList(); var it = createIterator(pageURLs.get(0)); assertThat(it.hasNext()).isTrue(); assertThat(it.hasNext()).isTrue(); // don't try this at home, kids... try { for (;;) { result.add(it.next().getLocation()); } } catch (NoSuchElementException ex) { assertThat(it.hasNext()).isFalse(); assertThat(it.hasNext()).isFalse(); } assertThat(result).isEqualTo(resourceURLs); } /** * Test that {@link Iterator#remove()} fails. */ @Test public void removeTest() { assertThrows(UnsupportedOperationException.class, () -> { var it = createIterator(pageURLs.get(0)); it.next(); it.remove(); // throws UnsupportedOperationException }); } /** * Creates a new {@link Iterator} of {@link Authorization} objects. * * @param first * URL of the first page * @return Created {@link Iterator} */ private Iterator createIterator(URL first) throws IOException { var provider = new TestableConnectionProvider() { private int ix; @Override public int sendSignedPostAsGetRequest(URL url, Login login) { ix = pageURLs.indexOf(url); assertThat(ix).isGreaterThanOrEqualTo(0); return HttpURLConnection.HTTP_OK; } @Override public JSON readJsonResponse() { var start = ix * RESOURCES_PER_PAGE; var end = (ix + 1) * RESOURCES_PER_PAGE; var cb = new JSONBuilder(); cb.array(TYPE, resourceURLs.subList(start, end)); return JSON.parse(cb.toString()); } @Override public Collection getLinks(String relation) { if ("next".equals(relation) && (ix + 1 < pageURLs.size())) { return Collections.singletonList(pageURLs.get(ix + 1)); } return Collections.emptyList(); } }; var login = provider.createLogin(); provider.close(); return new ResourceIterator<>(login, TYPE, first, Login::bindAuthorization); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/ResourceTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static org.assertj.core.api.Assertions.assertThat; import org.assertj.core.api.SoftAssertions; import org.junit.jupiter.api.Test; /** * Unit test for {@link Resource}. */ public class ResourceTest { /** * Test {@link Resource#path()}. */ @Test public void testPath() { SoftAssertions.assertSoftly(softly -> { softly.assertThat(Resource.NEW_NONCE.path()).isEqualTo("newNonce"); softly.assertThat(Resource.NEW_ACCOUNT.path()).isEqualTo("newAccount"); softly.assertThat(Resource.NEW_ORDER.path()).isEqualTo("newOrder"); softly.assertThat(Resource.NEW_AUTHZ.path()).isEqualTo("newAuthz"); softly.assertThat(Resource.REVOKE_CERT.path()).isEqualTo("revokeCert"); softly.assertThat(Resource.KEY_CHANGE.path()).isEqualTo("keyChange"); softly.assertThat(Resource.RENEWAL_INFO.path()).isEqualTo("renewalInfo"); }); // fails if there are untested future Resource values assertThat(Resource.values()).hasSize(7); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/SessionProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; import java.net.URI; import java.net.URL; import java.net.http.HttpClient; import java.util.ServiceLoader; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.provider.AcmeProvider; import org.shredzone.acme4j.toolbox.JSON; /** * Unit tests for {@link Session#provider()}. Requires that both enclosed * {@link AcmeProvider} implementations are registered via Java's {@link ServiceLoader} * API when the test is run. */ public class SessionProviderTest { /** * There are no testing providers accepting {@code acme://example.org}. Test that * connecting to this URI will result in an {@link IllegalArgumentException}. */ @Test public void testNone() { assertThatIllegalArgumentException() .isThrownBy(() -> new Session(new URI("acme://example.org")).provider()) .withMessage("No ACME provider found for acme://example.org"); } /** * Test that connecting to an acme URI will return an {@link AcmeProvider}, and that * the result is cached. */ @Test public void testConnectURI() throws Exception { var session = new Session(new URI("acme://example.com")); var provider = session.provider(); assertThat(provider).isInstanceOf(Provider1.class); var provider2 = session.provider(); assertThat(provider2).isInstanceOf(Provider1.class); assertThat(provider2).isSameAs(provider); } /** * There are two testing providers accepting {@code acme://example.net}. Test that * connecting to this URI will result in an {@link IllegalArgumentException}. */ @Test public void testDuplicate() { assertThatIllegalArgumentException() .isThrownBy(() -> new Session(new URI("acme://example.net")).provider()) .withMessage("Both ACME providers Provider1 and Provider2 accept" + " acme://example.net. Please check your classpath."); } public static class Provider1 implements AcmeProvider { @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && ("example.com".equals(serverUri.getHost()) || "example.net".equals(serverUri.getHost())); } @Override public Connection connect(URI serverUri, NetworkSettings networkSettings, HttpClient httpClient) { throw new UnsupportedOperationException(); } @Override public URL resolve(URI serverUri) { throw new UnsupportedOperationException(); } @Override public JSON directory(Session session, URI serverUri) { throw new UnsupportedOperationException(); } @Override public Challenge createChallenge(Login login, JSON data) { throw new UnsupportedOperationException(); } } public static class Provider2 implements AcmeProvider { @Override public boolean accepts(URI serverUri) { return "acme".equals(serverUri.getScheme()) && "example.net".equals(serverUri.getHost()); } @Override public Connection connect(URI serverUri, NetworkSettings networkSettings, HttpClient httpClient) { throw new UnsupportedOperationException(); } @Override public URL resolve(URI serverUri) { throw new UnsupportedOperationException(); } @Override public JSON directory(Session session, URI serverUri) { throw new UnsupportedOperationException(); } @Override public Challenge createChallenge(Login login, JSON data) { throw new UnsupportedOperationException(); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/connector/TrimmingInputStreamTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2018 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.connector; import static org.assertj.core.api.Assertions.assertThat; import java.io.ByteArrayInputStream; import java.io.IOException; import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; /** * Unit tests for {@link TrimmingInputStream}. */ public class TrimmingInputStreamTest { private final static String FULL_TEXT = "Gallia est omnis divisa in partes tres,\r\n\r\n\r\n" + "quarum unam incolunt Belgae, aliam Aquitani,\r\r\r\n\n" + "tertiam, qui ipsorum lingua Celtae, nostra Galli appellantur."; private final static String TRIMMED_TEXT = "Gallia est omnis divisa in partes tres,\n" + "quarum unam incolunt Belgae, aliam Aquitani,\n" + "tertiam, qui ipsorum lingua Celtae, nostra Galli appellantur."; @Test public void testEmpty() throws IOException { var out = trimByStream(""); assertThat(out).isEqualTo(""); } @Test public void testLineBreakOnly() throws IOException { var out1 = trimByStream("\n"); assertThat(out1).isEqualTo(""); var out2 = trimByStream("\r"); assertThat(out2).isEqualTo(""); var out3 = trimByStream("\r\n"); assertThat(out3).isEqualTo(""); } @Test public void testTrim() throws IOException { var out = trimByStream(FULL_TEXT); assertThat(out).isEqualTo(TRIMMED_TEXT); } @Test public void testTrimEndOnly() throws IOException { var out = trimByStream(FULL_TEXT + "\r\n\r\n"); assertThat(out).isEqualTo(TRIMMED_TEXT + "\n"); } @Test public void testTrimStartOnly() throws IOException { var out = trimByStream("\n\n" + FULL_TEXT); assertThat(out).isEqualTo(TRIMMED_TEXT); } @Test public void testTrimFull() throws IOException { var out = trimByStream("\n\n" + FULL_TEXT + "\r\n\r\n"); assertThat(out).isEqualTo(TRIMMED_TEXT + "\n"); } @Test public void testAvailable() throws IOException { try (var in = new TrimmingInputStream( new ByteArrayInputStream("Test".getBytes(StandardCharsets.US_ASCII)))) { assertThat(in.available()).isNotEqualTo(0); } } /** * Trims a string by running it through the {@link TrimmingInputStream}. */ private String trimByStream(String str) throws IOException { var out = new StringBuilder(); try (var in = new TrimmingInputStream( new ByteArrayInputStream(str.getBytes(StandardCharsets.US_ASCII)))) { int ch; while ((ch = in.read()) >= 0) { out.append((char) ch); } } return out.toString(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import java.io.IOException; import org.junit.jupiter.api.Test; /** * Unit tests for {@link AcmeException}. */ public class AcmeExceptionTest { @Test public void testAcmeException() { var ex = new AcmeException(); assertThat(ex.getMessage()).isNull(); assertThat(ex.getCause()).isNull(); } @Test public void testMessageAcmeException() { var message = "Failure"; var ex = new AcmeException(message); assertThat(ex.getMessage()).isEqualTo(message); assertThat(ex.getCause()).isNull(); } @Test public void testCausedAcmeException() { var message = "Failure"; var cause = new IOException("No network"); var ex = new AcmeException(message, cause); assertThat(ex.getMessage()).isEqualTo(message); assertThat(ex.getCause()).isEqualTo(cause); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeLazyLoadingExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import static org.mockito.Mockito.mock; import java.io.Serial; import java.net.URL; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.AcmeResource; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link AcmeLazyLoadingException}. */ public class AcmeLazyLoadingExceptionTest { private final URL resourceUrl = TestUtils.url("http://example.com/acme/resource/123"); @Test public void testAcmeLazyLoadingException() { var login = mock(Login.class); var resource = new TestResource(login, resourceUrl); var cause = new AcmeException("Something went wrong"); var ex = new AcmeLazyLoadingException(resource, cause); assertThat(ex).isInstanceOf(RuntimeException.class); assertThat(ex.getMessage()).contains(resourceUrl.toString()); assertThat(ex.getMessage()).contains(TestResource.class.getSimpleName()); assertThat(ex.getCause()).isEqualTo(cause); assertThat(ex.getType()).isEqualTo(TestResource.class); assertThat(ex.getLocation()).isEqualTo(resourceUrl); } private static class TestResource extends AcmeResource { @Serial private static final long serialVersionUID = 1023419539450677538L; public TestResource(Login login, URL location) { super(login, location); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeNetworkExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import java.io.IOException; import org.junit.jupiter.api.Test; /** * Unit tests for {@link AcmeNetworkException}. */ public class AcmeNetworkExceptionTest { @Test public void testAcmeNetworkException() { var cause = new IOException("Network not reachable"); var ex = new AcmeNetworkException(cause); assertThat(ex.getMessage()).isNotNull(); assertThat(ex.getCause()).isEqualTo(cause); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeNotSupportedExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import org.junit.jupiter.api.Test; /** * Unit tests for {@link AcmeNotSupportedException}. */ public class AcmeNotSupportedExceptionTest { @Test public void testAcmeNotSupportedException() { var msg = "revoke"; var ex = new AcmeNotSupportedException(msg); assertThat(ex).isInstanceOf(RuntimeException.class); assertThat(ex.getMessage()).isEqualTo("Server does not support revoke"); assertThat(ex.getCause()).isNull(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeProtocolExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import org.junit.jupiter.api.Test; /** * Unit tests for {@link AcmeProtocolException}. */ public class AcmeProtocolExceptionTest { @Test public void testAcmeProtocolException() { var msg = "Bad content"; var ex = new AcmeProtocolException(msg); assertThat(ex).isInstanceOf(RuntimeException.class); assertThat(ex.getMessage()).isEqualTo(msg); assertThat(ex.getCause()).isNull(); } @Test public void testCausedAcmeProtocolException() { var message = "Bad content"; var cause = new NumberFormatException("Not a number: abc"); var ex = new AcmeProtocolException(message, cause); assertThat(ex.getMessage()).isEqualTo(message); assertThat(ex.getCause()).isEqualTo(cause); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeRateLimitedExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.createProblem; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import java.time.Duration; import java.time.Instant; import java.util.Arrays; import org.junit.jupiter.api.Test; /** * Unit tests for {@link AcmeRateLimitedException}. */ public class AcmeRateLimitedExceptionTest { /** * Test that parameters are correctly returned. */ @Test public void testAcmeRateLimitedException() { var type = URI.create("urn:ietf:params:acme:error:rateLimited"); var detail = "Too many requests per minute"; var retryAfter = Instant.now().plus(Duration.ofMinutes(1)); var documents = Arrays.asList( url("http://example.com/doc1.html"), url("http://example.com/doc2.html")); var problem = createProblem(type, detail, null); var ex = new AcmeRateLimitedException(problem, retryAfter, documents); assertThat(ex.getType()).isEqualTo(type); assertThat(ex.getMessage()).isEqualTo(detail); assertThat(ex.getRetryAfter().orElseThrow()).isEqualTo(retryAfter); assertThat(ex.getDocuments()).containsAll(documents); } /** * Test that optional parameters are null-safe. */ @Test public void testNullAcmeRateLimitedException() { var type = URI.create("urn:ietf:params:acme:error:rateLimited"); var detail = "Too many requests per minute"; var problem = createProblem(type, detail, null); var ex = new AcmeRateLimitedException(problem, null, null); assertThat(ex.getType()).isEqualTo(type); assertThat(ex.getMessage()).isEqualTo(detail); assertThat(ex.getRetryAfter()).isEmpty(); assertThat(ex.getDocuments()).isEmpty(); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/exception/AcmeUserActionRequiredExceptionTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.exception; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.createProblem; import java.net.MalformedURLException; import java.net.URI; import org.junit.jupiter.api.Test; /** * Unit tests for {@link AcmeUserActionRequiredException}. */ public class AcmeUserActionRequiredExceptionTest { /** * Test that parameters are correctly returned. */ @Test public void testAcmeUserActionRequiredException() throws MalformedURLException { var type = URI.create("urn:ietf:params:acme:error:userActionRequired"); var detail = "Accept new TOS"; var tosUri = URI.create("http://example.com/agreement.pdf"); var instanceUrl = URI.create("http://example.com/howToAgree.html").toURL(); var problem = createProblem(type, detail, instanceUrl); var ex = new AcmeUserActionRequiredException(problem, tosUri); assertThat(ex.getType()).isEqualTo(type); assertThat(ex.getMessage()).isEqualTo(detail); assertThat(ex.getTermsOfServiceUri().orElseThrow()).isEqualTo(tosUri); assertThat(ex.getInstance()).isEqualTo(instanceUrl); assertThat(ex.toString()).isEqualTo("Please visit " + instanceUrl + " - details: " + detail); } /** * Test that optional parameters are null-safe. */ @Test public void testNullAcmeUserActionRequiredException() throws MalformedURLException { var type = URI.create("urn:ietf:params:acme:error:userActionRequired"); var detail = "Call our service"; var instanceUrl = URI.create("http://example.com/howToContactUs.html").toURL(); var problem = createProblem(type, detail, instanceUrl); var ex = new AcmeUserActionRequiredException(problem, null); assertThat(ex.getType()).isEqualTo(type); assertThat(ex.getMessage()).isEqualTo(detail); assertThat(ex.getTermsOfServiceUri()).isEmpty(); assertThat(ex.getInstance()).isEqualTo(instanceUrl); assertThat(ex.toString()).isEqualTo("Please visit " + instanceUrl + " - details: " + detail); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/AbstractAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.mockito.Mockito.*; import static org.shredzone.acme4j.toolbox.TestUtils.getJSON; import java.net.HttpURLConnection; import java.net.URI; import java.net.URL; import java.net.http.HttpClient; import java.time.ZonedDateTime; import java.time.temporal.ChronoUnit; import java.util.Optional; import java.util.concurrent.atomic.AtomicBoolean; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.DnsAccount01Challenge; import org.shredzone.acme4j.challenge.DnsPersist01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.challenge.TlsAlpn01Challenge; import org.shredzone.acme4j.challenge.TokenChallenge; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.connector.DefaultConnection; import org.shredzone.acme4j.connector.HttpConnector; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.connector.NonceHolder; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Unit tests for {@link AbstractAcmeProvider}. */ public class AbstractAcmeProviderTest { private static final URI SERVER_URI = URI.create("http://example.com/acme"); private static final URL RESOLVED_URL = TestUtils.url("http://example.com/acme/directory"); private static final NetworkSettings NETWORK_SETTINGS = new NetworkSettings(); /** * Test that connect returns a connection. */ @Test public void testConnect() { var invoked = new AtomicBoolean(); var httpClient = HttpClient.newBuilder().build(); var provider = new TestAbstractAcmeProvider() { @Override protected HttpConnector createHttpConnector(NetworkSettings settings, HttpClient client) { assertThat(settings).isSameAs(NETWORK_SETTINGS); assertThat(client).isSameAs(httpClient); invoked.set(true); return super.createHttpConnector(settings, client); } }; var connection = provider.connect(SERVER_URI, NETWORK_SETTINGS, httpClient); assertThat(connection).isNotNull(); assertThat(connection).isInstanceOf(DefaultConnection.class); assertThat(invoked).isTrue(); } /** * Verify that the resources directory is read. */ @Test public void testResources() throws AcmeException { var connection = mock(Connection.class); var session = mock(Session.class); when(connection.readJsonResponse()).thenReturn(getJSON("directory")); when(session.lockNonce()).thenReturn(mock(NonceHolder.class)); var provider = new TestAbstractAcmeProvider(connection); var map = provider.directory(session, SERVER_URI); assertThatJson(map.toString()).isEqualTo(TestUtils.getJSON("directory").toString()); verify(connection).sendRequest(RESOLVED_URL, session, null); verify(connection).getNonce(); verify(connection).getLastModified(); verify(connection).getExpiration(); verify(connection).readJsonResponse(); verify(connection).close(); verifyNoMoreInteractions(connection); } /** * Verify that the cache control headers are evaluated. */ @Test public void testResourcesCacheControl() throws AcmeException { var lastModified = ZonedDateTime.now().minus(13, ChronoUnit.DAYS); var expiryDate = ZonedDateTime.now().plus(60, ChronoUnit.DAYS); var connection = mock(Connection.class); var session = mock(Session.class); when(connection.readJsonResponse()).thenReturn(getJSON("directory")); when(connection.getLastModified()).thenReturn(Optional.of(lastModified)); when(connection.getExpiration()).thenReturn(Optional.of(expiryDate)); when(session.lockNonce()).thenReturn(mock(NonceHolder.class)); when(session.getDirectoryExpires()).thenReturn(null); when(session.getDirectoryLastModified()).thenReturn(null); when(session.networkSettings()).thenReturn(NETWORK_SETTINGS); when(session.getHttpClient()).thenReturn(HttpClient.newBuilder().build()); var provider = new TestAbstractAcmeProvider(connection); var map = provider.directory(session, SERVER_URI); assertThatJson(map.toString()).isEqualTo(TestUtils.getJSON("directory").toString()); verify(session).setDirectoryLastModified(eq(lastModified)); verify(session).setDirectoryExpires(eq(expiryDate)); verify(session).getDirectoryExpires(); verify(session).getDirectoryLastModified(); verify(session).networkSettings(); verify(session).getHttpClient(); verify(session).lockNonce(); verifyNoMoreInteractions(session); verify(connection).sendRequest(RESOLVED_URL, session, null); verify(connection).getNonce(); verify(connection).getLastModified(); verify(connection).getExpiration(); verify(connection).readJsonResponse(); verify(connection).close(); verifyNoMoreInteractions(connection); } /** * Verify that resorces are not fetched if not yet expired. */ @Test public void testResourcesNotExprired() throws AcmeException { var expiryDate = ZonedDateTime.now().plus(60, ChronoUnit.DAYS); var connection = mock(Connection.class); var session = mock(Session.class); when(session.getDirectoryExpires()).thenReturn(expiryDate); var provider = new TestAbstractAcmeProvider(); var map = provider.directory(session, SERVER_URI); assertThat(map).isNull(); verify(session).getDirectoryExpires(); verifyNoMoreInteractions(session); verifyNoMoreInteractions(connection); } /** * Verify that resorces are fetched if expired. */ @Test public void testResourcesExprired() throws AcmeException { var expiryDate = ZonedDateTime.now().plus(60, ChronoUnit.DAYS); var pastExpiryDate = ZonedDateTime.now().minus(10, ChronoUnit.MINUTES); var connection = mock(Connection.class); var session = mock(Session.class); when(connection.readJsonResponse()).thenReturn(getJSON("directory")); when(connection.getExpiration()).thenReturn(Optional.of(expiryDate)); when(connection.getLastModified()).thenReturn(Optional.empty()); when(session.getDirectoryExpires()).thenReturn(pastExpiryDate); when(session.networkSettings()).thenReturn(NETWORK_SETTINGS); when(session.getHttpClient()).thenReturn(HttpClient.newBuilder().build()); when(session.lockNonce()).thenReturn(mock(NonceHolder.class)); var provider = new TestAbstractAcmeProvider(connection); var map = provider.directory(session, SERVER_URI); assertThatJson(map.toString()).isEqualTo(TestUtils.getJSON("directory").toString()); verify(session).setDirectoryExpires(eq(expiryDate)); verify(session).setDirectoryLastModified(eq(null)); verify(session).getDirectoryExpires(); verify(session).getDirectoryLastModified(); verify(session).networkSettings(); verify(session).getHttpClient(); verify(session).lockNonce(); verifyNoMoreInteractions(session); verify(connection).sendRequest(RESOLVED_URL, session, null); verify(connection).getNonce(); verify(connection).getLastModified(); verify(connection).getExpiration(); verify(connection).readJsonResponse(); verify(connection).close(); verifyNoMoreInteractions(connection); } /** * Verify that if-modified-since is used. */ @Test public void testResourcesIfModifiedSince() throws AcmeException { var modifiedSinceDate = ZonedDateTime.now().minus(60, ChronoUnit.DAYS); var connection = mock(Connection.class); var session = mock(Session.class); when(connection.sendRequest(eq(RESOLVED_URL), eq(session), eq(modifiedSinceDate))) .thenReturn(HttpURLConnection.HTTP_NOT_MODIFIED); when(connection.getLastModified()).thenReturn(Optional.of(modifiedSinceDate)); when(session.getDirectoryLastModified()).thenReturn(modifiedSinceDate); when(session.networkSettings()).thenReturn(NETWORK_SETTINGS); when(session.getHttpClient()).thenReturn(HttpClient.newBuilder().build()); when(session.lockNonce()).thenReturn(mock(NonceHolder.class)); var provider = new TestAbstractAcmeProvider(connection); var map = provider.directory(session, SERVER_URI); assertThat(map).isNull(); verify(session).getDirectoryExpires(); verify(session).getDirectoryLastModified(); verify(session).networkSettings(); verify(session).getHttpClient(); verify(session).lockNonce(); verifyNoMoreInteractions(session); verify(connection).sendRequest(RESOLVED_URL, session, modifiedSinceDate); verify(connection).close(); verifyNoMoreInteractions(connection); } /** * Test that challenges are generated properly. */ @Test public void testCreateChallenge() { var login = TestUtils.login(); var provider = new TestAbstractAcmeProvider(); var c1 = provider.createChallenge(login, getJSON("httpChallenge")); assertThat(c1).isNotNull(); assertThat(c1).isInstanceOf(Http01Challenge.class); var c2 = provider.createChallenge(login, getJSON("httpChallenge")); assertThat(c2).isNotSameAs(c1); var c3 = provider.createChallenge(login, getJSON("dns01Challenge")); assertThat(c3).isNotNull(); assertThat(c3).isInstanceOf(Dns01Challenge.class); var c4 = provider.createChallenge(login, getJSON("dnsAccount01Challenge")); assertThat(c4).isNotNull(); assertThat(c4).isInstanceOf(DnsAccount01Challenge.class); var c8 = provider.createChallenge(login, getJSON("dnsPersist01Challenge")); assertThat(c8).isNotNull(); assertThat(c8).isInstanceOf(DnsPersist01Challenge.class); var c5 = provider.createChallenge(login, getJSON("tlsAlpnChallenge")); assertThat(c5).isNotNull(); assertThat(c5).isInstanceOf(TlsAlpn01Challenge.class); var json6 = new JSONBuilder() .put("type", "foobar-01") .put("url", "https://example.com/some/challenge") .toJSON(); var c6 = provider.createChallenge(login, json6); assertThat(c6).isNotNull(); assertThat(c6).isInstanceOf(Challenge.class); var json7 = new JSONBuilder() .put("type", "foobar-01") .put("token", "abc123") .put("url", "https://example.com/some/challenge") .toJSON(); var c7 = provider.createChallenge(login, json7); assertThat(c7).isNotNull(); assertThat(c7).isInstanceOf(TokenChallenge.class); assertThrows(AcmeProtocolException.class, () -> { var json8 = new JSONBuilder() .put("url", "https://example.com/some/challenge") .toJSON(); provider.createChallenge(login, json8); }); assertThrows(NullPointerException.class, () -> provider.createChallenge(login, null)); } private static class TestAbstractAcmeProvider extends AbstractAcmeProvider { private final Connection connection; public TestAbstractAcmeProvider() { this.connection = null; } public TestAbstractAcmeProvider(Connection connection) { this.connection = connection; } @Override public boolean accepts(URI serverUri) { assertThat(serverUri).isEqualTo(SERVER_URI); return true; } @Override public URL resolve(URI serverUri) { assertThat(serverUri).isEqualTo(SERVER_URI); return RESOLVED_URL; } @Override public Connection connect(URI serverUri, NetworkSettings networkSettings, HttpClient httpClient) { assertThat(serverUri).isEqualTo(SERVER_URI); return connection != null ? connection : super.connect(serverUri, networkSettings, httpClient); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/GenericAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import static org.assertj.core.api.Assertions.assertThat; import static org.shredzone.acme4j.toolbox.TestUtils.DEFAULT_NETWORK_SETTINGS; import java.net.URI; import java.net.URISyntaxException; import java.net.http.HttpClient; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.connector.DefaultConnection; /** * Unit tests for {@link GenericAcmeProvider}. */ public class GenericAcmeProviderTest { /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new GenericAcmeProvider(); assertThat(provider.accepts(new URI("http://example.com/acme"))).isTrue(); assertThat(provider.accepts(new URI("https://example.com/acme"))).isTrue(); assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); } /** * Test if the provider resolves the URI correctly. */ @Test public void testResolve() throws URISyntaxException { var serverUri = new URI("http://example.com/acme?foo=abc&bar=123"); var provider = new GenericAcmeProvider(); var resolvedUrl = provider.resolve(serverUri); assertThat(resolvedUrl.toString()).isEqualTo(serverUri.toString()); var httpClient = HttpClient.newBuilder().build(); var connection = provider.connect(serverUri, DEFAULT_NETWORK_SETTINGS, httpClient); assertThat(connection).isInstanceOf(DefaultConnection.class); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/TestableConnectionProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider; import java.io.IOException; import java.net.URI; import java.net.URL; import java.net.http.HttpClient; import java.security.KeyPair; import java.time.Instant; import java.util.HashMap; import java.util.Map; import java.util.Optional; import java.util.function.BiFunction; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.connector.DummyConnection; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.toolbox.JSONBuilder; import org.shredzone.acme4j.toolbox.TestUtils; /** * Test implementation of {@link AcmeProvider}. It also implements a dummy implementation * of {@link Connection} that is always returned on {@link #connect(URI, NetworkSettings)}. */ public class TestableConnectionProvider extends DummyConnection implements AcmeProvider { private final Map> creatorMap = new HashMap<>(); private final Map createdMap = new HashMap<>(); private final JSONBuilder directory = new JSONBuilder(); private final KeyPair keyPair = TestUtils.createKeyPair(); private JSONBuilder metadata = null; /** * Register a {@link Resource} mapping. * * @param r * {@link Resource} to be mapped * @param u * {@link URL} to be returned */ public void putTestResource(Resource r, URL u) { directory.put(r.path(), u); } /** * Add a property to the metadata registry. * * @param key * Metadata key * @param value * Metadata value */ public void putMetadata(String key, Object value) { if (metadata == null) { metadata = directory.object("meta"); } metadata.put(key, value); } /** * Register a {@link Challenge}. * * @param type * Challenge type to register. * @param creator * Creator {@link BiFunction} that creates a matching {@link Challenge} */ public void putTestChallenge(String type, BiFunction creator) { creatorMap.put(type, creator); } /** * Returns the {@link Challenge} instance that has been created. Fails if no such * challenge was created. * * @param type Challenge type * @return Created {@link Challenge} instance */ public Challenge getChallenge(String type) { if (!createdMap.containsKey(type)) { throw new IllegalArgumentException("No challenge of type " + type + " was created"); } return createdMap.get(type); } /** * Creates a {@link Session} that uses this {@link AcmeProvider}. */ public Session createSession() { return TestUtils.session(this); } /** * Creates a {@link Login} that uses this {@link AcmeProvider}. */ public Login createLogin() throws IOException { var session = createSession(); return session.login(URI.create(TestUtils.ACCOUNT_URL).toURL(), keyPair); } public KeyPair getAccountKeyPair() { return keyPair; } @Override public Optional getRetryAfter() { return Optional.empty(); } @Override public boolean accepts(URI serverUri) { throw new UnsupportedOperationException(); } @Override public URL resolve(URI serverUri) { throw new UnsupportedOperationException(); } @Override public Connection connect(URI serverUri, NetworkSettings networkSettings, HttpClient httpClient) { return this; } @Override public JSON directory(Session session, URI serverUri) { if (directory.toMap().isEmpty()) { throw new UnsupportedOperationException(); } return directory.toJSON(); } @Override public Challenge createChallenge(Login login, JSON data) { if (creatorMap.isEmpty()) { throw new UnsupportedOperationException(); } Challenge created; var type = data.get("type").asString(); if (creatorMap.containsKey(type)) { created = creatorMap.get(type).apply(login, data); } else { created = new Challenge(login, data); } createdMap.put(type, created); return created; } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/actalis/ActalisAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.actalis; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import java.net.URISyntaxException; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; public class ActalisAcmeProviderTest { private static final String PRODUCTION_DIRECTORY_URL = "https://acme-api.actalis.com/acme/directory"; /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new ActalisAcmeProvider(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(provider.accepts(new URI("acme://actalis.com"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://actalis.com/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse(); softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse(); } } /** * Test if acme URIs are properly resolved. */ @Test public void testResolve() throws URISyntaxException { var provider = new ActalisAcmeProvider(); assertThat(provider.resolve(new URI("acme://actalis.com"))).isEqualTo(url(PRODUCTION_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://actalis.com/"))).isEqualTo(url(PRODUCTION_DIRECTORY_URL)); assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://letsencrypt.org/v99"))); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/google/GoogleAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.google; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import java.net.URISyntaxException; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; /** * Unit tests for {@link GoogleAcmeProvider}. */ public class GoogleAcmeProviderTest { private static final String PRODUCTION_DIRECTORY_URL = "https://dv.acme-v02.api.pki.goog/directory"; private static final String STAGING_DIRECTORY_URL = "https://dv.acme-v02.test-api.pki.goog/directory"; /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new GoogleAcmeProvider(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(provider.accepts(new URI("acme://pki.goog"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pki.goog/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pki.goog/staging"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse(); softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse(); } } /** * Test if acme URIs are properly resolved. */ @Test public void testResolve() throws URISyntaxException { var provider = new GoogleAcmeProvider(); assertThat(provider.resolve(new URI("acme://pki.goog"))).isEqualTo(url(PRODUCTION_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://pki.goog/"))).isEqualTo(url(PRODUCTION_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://pki.goog/staging"))).isEqualTo(url(STAGING_DIRECTORY_URL)); assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://pki.goog/v99"))); } /** * Test if correct MAC algorithm is proposed. */ @Test public void testMacAlgorithm() { var provider = new GoogleAcmeProvider(); assertThat(provider.getProposedEabMacAlgorithm()).isNotEmpty().contains("HS256"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/letsencrypt/LetsEncryptAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.letsencrypt; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import java.net.URISyntaxException; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; /** * Unit tests for {@link LetsEncryptAcmeProvider}. */ public class LetsEncryptAcmeProviderTest { private static final String V02_DIRECTORY_URL = "https://acme-v02.api.letsencrypt.org/directory"; private static final String STAGING_DIRECTORY_URL = "https://acme-staging-v02.api.letsencrypt.org/directory"; /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new LetsEncryptAcmeProvider(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(provider.accepts(new URI("acme://letsencrypt.org"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://letsencrypt.org/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://letsencrypt.org/staging"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://letsencrypt.org/v02"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse(); softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse(); } } /** * Test if acme URIs are properly resolved. */ @Test public void testResolve() throws URISyntaxException { var provider = new LetsEncryptAcmeProvider(); assertThat(provider.resolve(new URI("acme://letsencrypt.org"))).isEqualTo(url(V02_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://letsencrypt.org/"))).isEqualTo(url(V02_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://letsencrypt.org/v02"))).isEqualTo(url(V02_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://letsencrypt.org/staging"))).isEqualTo(url(STAGING_DIRECTORY_URL)); assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://letsencrypt.org/v99"))); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/pebble/PebbleAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.pebble; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.mockito.Mockito.spy; import static org.mockito.Mockito.verify; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.InputStream; import java.net.URI; import java.net.URISyntaxException; import java.net.http.HttpClient; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import javax.net.ssl.TrustManagerFactory; import javax.net.ssl.X509TrustManager; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.connector.NetworkSettings; /** * Unit tests for {@link PebbleAcmeProvider}. */ public class PebbleAcmeProviderTest { /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new PebbleAcmeProvider(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(provider.accepts(new URI("acme://pebble"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pebble/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pebble:12345"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pebble:12345/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pebble/some-host.example.com"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://pebble/some-host.example.com:12345"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse(); softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse(); } } /** * Test if acme URIs are properly resolved. */ @Test public void testResolve() throws URISyntaxException { var provider = new PebbleAcmeProvider(); assertThat(provider.resolve(new URI("acme://pebble"))) .isEqualTo(url("https://localhost:14000/dir")); assertThat(provider.resolve(new URI("acme://pebble/"))) .isEqualTo(url("https://localhost:14000/dir")); assertThat(provider.resolve(new URI("acme://pebble:12345"))) .isEqualTo(url("https://localhost:12345/dir")); assertThat(provider.resolve(new URI("acme://pebble:12345/"))) .isEqualTo(url("https://localhost:12345/dir")); assertThat(provider.resolve(new URI("acme://pebble/pebble.example.com"))) .isEqualTo(url("https://pebble.example.com:14000/dir")); assertThat(provider.resolve(new URI("acme://pebble/pebble.example.com:12345"))) .isEqualTo(url("https://pebble.example.com:12345/dir")); assertThat(provider.resolve(new URI("acme://pebble/pebble.example.com:12345/"))) .isEqualTo(url("https://pebble.example.com:12345/dir")); assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://pebble/bad.example.com:port"))); assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://pebble/bad.example.com:1234/foo"))); } /** * Test that createPebbleTrustManagerFactory creates a TrustManagerFactory * with the Pebble certificate loaded from the PEM file. */ @Test public void testCreatePebbleTrustManagerFactory() throws Exception { var provider = new PebbleAcmeProvider(); // Create the TrustManagerFactory TrustManagerFactory tmf = provider.createPebbleTrustManagerFactory(); assertThat(tmf).isNotNull(); // Get the trust managers javax.net.ssl.TrustManager[] trustManagers = tmf.getTrustManagers(); assertThat(trustManagers.length).isGreaterThan(0); // Find an X509TrustManager X509TrustManager x509TrustManager = null; for (javax.net.ssl.TrustManager tm : trustManagers) { if (tm instanceof X509TrustManager) { x509TrustManager = (X509TrustManager) tm; break; } } assertThat(x509TrustManager).isNotNull(); // Verify the Pebble certificate is in the accepted issuers X509Certificate[] acceptedIssuers = x509TrustManager.getAcceptedIssuers(); assertThat(acceptedIssuers.length).isGreaterThan(0); // Load the Pebble certificate from the resource to compare X509Certificate pebbleCert = loadPebbleCertificate(); assertThat(pebbleCert).isNotNull(); // Verify that the Pebble certificate is in the accepted issuers boolean foundPebbleCert = false; for (X509Certificate cert : acceptedIssuers) { if (cert.getSerialNumber().equals(pebbleCert.getSerialNumber()) && cert.getIssuerDN().equals(pebbleCert.getIssuerDN())) { foundPebbleCert = true; break; } } // Verify the Pebble certificate is present in the trust store assertThat(foundPebbleCert) .as("Pebble certificate should be present in the TrustManagerFactory") .isTrue(); } /** * Test that createHttpClient creates an HttpClient with Pebble SSL context * and verifies it calls createPebbleTrustManagerFactory when creating the SSL context. */ @Test public void testCreateHttpClient() throws Exception { var provider = spy(new PebbleAcmeProvider()); var settings = new NetworkSettings(); var httpClient = provider.createHttpClient(settings); assertThat(httpClient).isNotNull(); assertThat(httpClient.followRedirects()).isEqualTo(HttpClient.Redirect.NORMAL); assertThat(httpClient.connectTimeout().orElseThrow()).isEqualTo(settings.getTimeout()); // Verify that createPebbleTrustManagerFactory was called exactly once // (it's called when creating the SSL context, which happens once per createHttpClient call) verify(provider).createPebbleTrustManagerFactory(); // Verify that the SSL context is configured (not null) var sslContext = httpClient.sslContext(); assertThat(sslContext).isNotNull(); // Verify Pebble-specific SSL context properties // These properties confirm that the SSL context was created using createPebbleTrustManagerFactory assertThat(sslContext.getProtocol()).isEqualTo("TLS"); // Verify the SSL context is properly initialized assertThat(sslContext.getProvider()).isNotNull(); } /** * Loads the Pebble certificate from the resource file. * This matches how PebbleAcmeProvider loads it. */ private X509Certificate loadPebbleCertificate() throws Exception { // Try the same resource paths as PebbleAcmeProvider String[] resourcePaths = { "/pebble.minica.pem", "/META-INF/pebble.minica.pem", "/org/shredzone/acme4j/provider/pebble/pebble.minica.pem" }; for (String resourcePath : resourcePaths) { try (InputStream in = PebbleAcmeProvider.class.getResourceAsStream(resourcePath)) { if (in != null) { CertificateFactory cf = CertificateFactory.getInstance("X.509"); return (X509Certificate) cf.generateCertificate(in); } } } throw new AssertionError("Could not find Pebble certificate resource"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/sslcom/SslComAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.sslcom; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import java.net.URISyntaxException; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; /** * Unit tests for {@link SslComAcmeProviderTest}. */ public class SslComAcmeProviderTest { private static final String PRODUCTION_ECC_DIRECTORY_URL = "https://acme.ssl.com/sslcom-dv-ecc"; private static final String PRODUCTION_RSA_DIRECTORY_URL = "https://acme.ssl.com/sslcom-dv-rsa"; private static final String STAGING_ECC_DIRECTORY_URL = "https://acme-try.ssl.com/sslcom-dv-ecc"; private static final String STAGING_RSA_DIRECTORY_URL = "https://acme-try.ssl.com/sslcom-dv-rsa"; /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new SslComAcmeProvider(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(provider.accepts(new URI("acme://ssl.com"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://ssl.com/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://ssl.com/ecc"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://ssl.com/rsa"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://ssl.com/staging"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://ssl.com/staging/ecc"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://ssl.com/staging/rsa"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse(); softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse(); } } /** * Test if acme URIs are properly resolved. */ @Test public void testResolve() throws URISyntaxException { var provider = new SslComAcmeProvider(); assertThat(provider.resolve(new URI("acme://ssl.com"))).isEqualTo(url(PRODUCTION_ECC_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://ssl.com/"))).isEqualTo(url(PRODUCTION_ECC_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://ssl.com/ecc"))).isEqualTo(url(PRODUCTION_ECC_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://ssl.com/rsa"))).isEqualTo(url(PRODUCTION_RSA_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://ssl.com/staging"))).isEqualTo(url(STAGING_ECC_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://ssl.com/staging/ecc"))).isEqualTo(url(STAGING_ECC_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://ssl.com/staging/rsa"))).isEqualTo(url(STAGING_RSA_DIRECTORY_URL)); assertThatIllegalArgumentException().isThrownBy(() -> provider.resolve(new URI("acme://ssl.com/v99"))); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/provider/zerossl/ZeroSSLAcmeProviderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.provider.zerossl; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URI; import java.net.URISyntaxException; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.junit.jupiter.api.Test; /** * Unit tests for {@link ZeroSSLAcmeProvider}. */ public class ZeroSSLAcmeProviderTest { private static final String V02_DIRECTORY_URL = "https://acme.zerossl.com/v2/DV90"; /** * Tests if the provider accepts the correct URIs. */ @Test public void testAccepts() throws URISyntaxException { var provider = new ZeroSSLAcmeProvider(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(provider.accepts(new URI("acme://zerossl.com"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://zerossl.com/"))).isTrue(); softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse(); softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse(); softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse(); } } /** * Test if acme URIs are properly resolved. */ @Test public void testResolve() throws URISyntaxException { var provider = new ZeroSSLAcmeProvider(); assertThat(provider.resolve(new URI("acme://zerossl.com"))).isEqualTo(url(V02_DIRECTORY_URL)); assertThat(provider.resolve(new URI("acme://zerossl.com/"))).isEqualTo(url(V02_DIRECTORY_URL)); assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://zerossl.com/v99"))); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/toolbox/AcmeUtilsTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static java.nio.charset.StandardCharsets.UTF_8; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.within; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.AcmeUtils.*; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.OutputStreamWriter; import java.io.Writer; import java.lang.reflect.Modifier; import java.net.URI; import java.security.Security; import java.security.cert.CertificateEncodingException; import java.time.temporal.ChronoUnit; import java.util.Locale; import java.util.stream.Stream; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.Arguments; import org.junit.jupiter.params.provider.CsvSource; import org.junit.jupiter.params.provider.MethodSource; import org.junit.jupiter.params.provider.NullSource; import org.junit.jupiter.params.provider.ValueSource; import org.shredzone.acme4j.exception.AcmeProtocolException; /** * Unit tests for {@link AcmeUtils}. */ public class AcmeUtilsTest { @BeforeAll public static void setup() { Security.addProvider(new BouncyCastleProvider()); } /** * Test that constructor is private. */ @Test public void testPrivateConstructor() throws Exception { var constructor = AcmeUtils.class.getDeclaredConstructor(); assertThat(Modifier.isPrivate(constructor.getModifiers())).isTrue(); constructor.setAccessible(true); constructor.newInstance(); } /** * Test sha-256 hash and hex encode. */ @Test public void testSha256HashHexEncode() { var hexEncode = hexEncode(sha256hash("foobar")); assertThat(hexEncode).isEqualTo("c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2"); } /** * Test base64 URL encode. */ @Test public void testBase64UrlEncode() { var base64UrlEncode = base64UrlEncode(sha256hash("foobar")); assertThat(base64UrlEncode).isEqualTo("w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI"); } /** * Test base64 URL decode. */ @Test public void testBase64UrlDecode() { var base64UrlDecode = base64UrlDecode("w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI"); assertThat(base64UrlDecode).isEqualTo(sha256hash("foobar")); } /** * Test base32 encode. */ @ParameterizedTest @CsvSource({ // Test vectors according to RFC 4648 section 10 "'',''", "f,MY======", "fo,MZXQ====", "foo,MZXW6===", "foob,MZXW6YQ=", "fooba,MZXW6YTB", "foobar,MZXW6YTBOI======", }) public void testBase32Encode(String unencoded, String encoded) { assertThat(base32Encode(unencoded.getBytes(UTF_8))).isEqualTo(encoded); } /** * Test base64 URL validation for valid values */ @ParameterizedTest @ValueSource(strings = { "", "Zg", "Zm9v", }) public void testBase64UrlValid(String url) { assertThat(isValidBase64Url(url)).isTrue(); } /** * Test base64 URL validation for invalid values */ @ParameterizedTest @ValueSource(strings = { " ", "Zg=", "Zg==", " Zm9v ", ".illegal#Text", }) @NullSource public void testBase64UrlInvalid(String url) { assertThat(isValidBase64Url(url)).isFalse(); } /** * Test ACE conversion. */ @Test public void testToAce() { // Test ASCII domains in different notations assertThat(toAce("example.com")).isEqualTo("example.com"); assertThat(toAce(" example.com ")).isEqualTo("example.com"); assertThat(toAce("ExAmPlE.CoM")).isEqualTo("example.com"); assertThat(toAce("foo.example.com")).isEqualTo("foo.example.com"); assertThat(toAce("bar.foo.example.com")).isEqualTo("bar.foo.example.com"); // Test IDN domains assertThat(toAce("ExÄmþle.¢öM")).isEqualTo("xn--exmle-hra7p.xn--m-7ba6w"); // Test alternate separators assertThat(toAce("example\u3002com")).isEqualTo("example.com"); assertThat(toAce("example\uff0ecom")).isEqualTo("example.com"); assertThat(toAce("example\uff61com")).isEqualTo("example.com"); // Test ACE encoded domains, they must not change assertThat(toAce("xn--exmle-hra7p.xn--m-7ba6w")) .isEqualTo("xn--exmle-hra7p.xn--m-7ba6w"); } /** * Test valid strings. */ @ParameterizedTest @MethodSource("provideTimestamps") public void testParser(String input, String expected) { Arguments.of(input, expected, within(1, ChronoUnit.MILLIS)); } private static Stream provideTimestamps() { return Stream.of( Arguments.of("2015-12-27T22:58:35.006769519Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.00676951Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.0067695Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.006769Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.00676Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.0067Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.006Z", "2015-12-27T22:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.01Z", "2015-12-27T22:58:35.010Z"), Arguments.of("2015-12-27T22:58:35.2Z", "2015-12-27T22:58:35.200Z"), Arguments.of("2015-12-27T22:58:35Z", "2015-12-27T22:58:35.000Z"), Arguments.of("2015-12-27t22:58:35z", "2015-12-27T22:58:35.000Z"), Arguments.of("2015-12-27T22:58:35.006769519+02:00", "2015-12-27T20:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.006+02:00", "2015-12-27T20:58:35.006Z"), Arguments.of("2015-12-27T22:58:35+02:00", "2015-12-27T20:58:35.000Z"), Arguments.of("2015-12-27T21:58:35.006769519-02:00", "2015-12-27T23:58:35.006Z"), Arguments.of("2015-12-27T21:58:35.006-02:00", "2015-12-27T23:58:35.006Z"), Arguments.of("2015-12-27T21:58:35-02:00", "2015-12-27T23:58:35.000Z"), Arguments.of("2015-12-27T22:58:35.006769519+0200", "2015-12-27T20:58:35.006Z"), Arguments.of("2015-12-27T22:58:35.006+0200", "2015-12-27T20:58:35.006Z"), Arguments.of("2015-12-27T22:58:35+0200", "2015-12-27T20:58:35.000Z"), Arguments.of("2015-12-27T21:58:35.006769519-0200", "2015-12-27T23:58:35.006Z"), Arguments.of("2015-12-27T21:58:35.006-0200", "2015-12-27T23:58:35.006Z"), Arguments.of("2015-12-27T21:58:35-0200", "2015-12-27T23:58:35.000Z") ); } /** * Test invalid strings. */ @Test public void testInvalid() { assertThrows(IllegalArgumentException.class, () -> parseTimestamp(""), "accepted empty string"); assertThrows(IllegalArgumentException.class, () -> parseTimestamp("abc"), "accepted nonsense string"); assertThrows(IllegalArgumentException.class, () -> parseTimestamp("2015-12-27"), "accepted date only string"); assertThrows(IllegalArgumentException.class, () -> parseTimestamp("2015-12-27T"), "accepted string without time"); } /** * Test that locales are correctly converted to language headers. */ @Test public void testLocaleToLanguageHeader() { assertThat(localeToLanguageHeader(Locale.ENGLISH)) .isEqualTo("en,*;q=0.1"); assertThat(localeToLanguageHeader(new Locale("en", "US"))) .isEqualTo("en-US,en;q=0.8,*;q=0.1"); assertThat(localeToLanguageHeader(Locale.GERMAN)) .isEqualTo("de,*;q=0.1"); assertThat(localeToLanguageHeader(Locale.GERMANY)) .isEqualTo("de-DE,de;q=0.8,*;q=0.1"); assertThat(localeToLanguageHeader(new Locale(""))) .isEqualTo("*"); assertThat(localeToLanguageHeader(null)) .isEqualTo("*"); } /** * Test that error prefix is correctly removed. */ @Test public void testStripErrorPrefix() { assertThat(stripErrorPrefix("urn:ietf:params:acme:error:unauthorized")).isEqualTo("unauthorized"); assertThat(stripErrorPrefix("urn:somethingelse:error:message")).isNull(); assertThat(stripErrorPrefix(null)).isNull(); } /** * Test that {@link AcmeUtils#writeToPem(byte[], PemLabel, Writer)} writes a correct PEM * file. */ @Test public void testWriteToPem() throws IOException, CertificateEncodingException { var certChain = TestUtils.createCertificate("/cert.pem"); var pemFile = new ByteArrayOutputStream(); try (var w = new OutputStreamWriter(pemFile)) { for (var cert : certChain) { AcmeUtils.writeToPem(cert.getEncoded(), AcmeUtils.PemLabel.CERTIFICATE, w); } } var originalFile = new ByteArrayOutputStream(); try (var in = getClass().getResourceAsStream("/cert.pem")) { var buffer = new byte[2048]; int len; while ((len = in.read(buffer)) >= 0) { originalFile.write(buffer, 0, len); } } assertThat(pemFile.toByteArray()).isEqualTo(originalFile.toByteArray()); } /** * Test {@link AcmeUtils#getContentType(String)} for JSON types. */ @ParameterizedTest @ValueSource(strings = { "application/json", "application/json; charset=utf-8", "application/json; charset=utf-8 (Plain text)", "application/json; charset=\"utf-8\"", "application/json; charset=\"UTF-8\"; foo=4", " application/json ;foo=4", }) public void testGetContentTypeForJson(String contentType) { assertThat(AcmeUtils.getContentType(contentType)).isEqualTo("application/json"); } /** * Test {@link AcmeUtils#getContentType(String)} with other types. */ @Test public void testGetContentType() { assertThat(AcmeUtils.getContentType(null)).isNull(); assertThat(AcmeUtils.getContentType("Application/Problem+JSON")) .isEqualTo("application/problem+json"); assertThrows(AcmeProtocolException.class, () -> AcmeUtils.getContentType("application/json; charset=\"iso-8859-1\"")); } /** * Test that {@link AcmeUtils#validateContact(java.net.URI)} refuses invalid * contacts. */ @Test public void testValidateContact() { AcmeUtils.validateContact(URI.create("mailto:foo@example.com")); assertThrows(IllegalArgumentException.class, () -> AcmeUtils.validateContact(URI.create("mailto:foo@example.com,bar@example.com")), "multiple recipients are accepted"); assertThrows(IllegalArgumentException.class, () -> AcmeUtils.validateContact(URI.create("mailto:foo@example.com?to=bar@example.com")), "hfields are accepted"); assertThrows(IllegalArgumentException.class, () -> AcmeUtils.validateContact(URI.create("mailto:?to=foo@example.com")), "only hfields are accepted"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/toolbox/JSONBuilderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static org.assertj.core.api.Assertions.assertThat; import java.io.IOException; import java.time.Duration; import java.time.ZoneId; import java.time.ZonedDateTime; import java.util.Arrays; import java.util.Collections; import java.util.Map; import org.jose4j.json.JsonUtil; import org.jose4j.lang.JoseException; import org.junit.jupiter.api.Test; /** * Unit test for {@link JSONBuilder}. */ public class JSONBuilderTest { /** * Test that an empty JSON builder is empty. */ @Test public void testEmpty() { var cb = new JSONBuilder(); assertThat(cb.toString()).isEqualTo("{}"); } /** * Test basic data types. Also test that methods return {@code this}, and that * existing keys are replaced. */ @Test public void testBasics() { JSONBuilder res; var cb = new JSONBuilder(); res = cb.put("fooStr", "String"); assertThat(res).isSameAs(cb); res = cb.put("fooInt", 123); assertThat(res).isSameAs(cb); res = cb.put("fooInt", 456); assertThat(res).isSameAs(cb); assertThat(cb.toString()).isEqualTo("{\"fooStr\":\"String\",\"fooInt\":456}"); var map = cb.toMap(); assertThat(map.keySet()).hasSize(2); assertThat(map).extracting("fooInt").isEqualTo(456); assertThat(map).extracting("fooStr").isEqualTo("String"); var json = cb.toJSON(); assertThat(json.keySet()).hasSize(2); assertThat(json.get("fooInt").asInt()).isEqualTo(456); assertThat(json.get("fooStr").asString()).isEqualTo("String"); } /** * Test date type. */ @Test public void testDate() { var date = ZonedDateTime.of(2016, 6, 1, 5, 13, 46, 0, ZoneId.of("GMT+2")).toInstant(); var duration = Duration.ofMinutes(5); var cb = new JSONBuilder(); cb.put("fooDate", date); cb.put("fooDuration", duration); cb.put("fooNull", (Object) null); assertThat(cb.toString()).isEqualTo("{\"fooDate\":\"2016-06-01T03:13:46Z\",\"fooDuration\":300,\"fooNull\":null}"); } /** * Test base64 encoding. */ @Test public void testBase64() { var data = "abc123".getBytes(); JSONBuilder res; var cb = new JSONBuilder(); res = cb.putBase64("foo", data); assertThat(res).isSameAs(cb); assertThat(cb.toString()).isEqualTo("{\"foo\":\"YWJjMTIz\"}"); } /** * Test JWK. */ @Test public void testKey() throws IOException, JoseException { var keyPair = TestUtils.createKeyPair(); JSONBuilder res; var cb = new JSONBuilder(); res = cb.putKey("foo", keyPair.getPublic()); assertThat(res).isSameAs(cb); var json = JsonUtil.parseJson(cb.toString()); assertThat(json).containsKey("foo"); var jwk = (Map) json.get("foo"); assertThat(jwk.keySet()).hasSize(3); assertThat(jwk).extracting("n").isEqualTo(TestUtils.N); assertThat(jwk).extracting("e").isEqualTo(TestUtils.E); assertThat(jwk).extracting("kty").isEqualTo(TestUtils.KTY); } /** * Test sub claims (objects). */ @Test public void testObject() { var cb = new JSONBuilder(); var sub = cb.object("sub"); assertThat(sub).isNotSameAs(cb); assertThat(cb.toString()).isEqualTo("{\"sub\":{}}"); cb.put("foo", 123); sub.put("foo", 456); assertThat(cb.toString()).isEqualTo("{\"sub\":{\"foo\":456},\"foo\":123}"); } /** * Test arrays. */ @Test public void testArray() { JSONBuilder res; var cb1 = new JSONBuilder(); res = cb1.array("ar", Collections.emptyList()); assertThat(res).isSameAs(cb1); assertThat(cb1.toString()).isEqualTo("{\"ar\":[]}"); var cb2 = new JSONBuilder(); res = cb2.array("ar", Collections.singletonList(123)); assertThat(res).isSameAs(cb2); assertThat(cb2.toString()).isEqualTo("{\"ar\":[123]}"); var cb3 = new JSONBuilder(); res = cb3.array("ar", Arrays.asList(123, "foo", 456)); assertThat(res).isSameAs(cb3); assertThat(cb3.toString()).isEqualTo("{\"ar\":[123,\"foo\",456]}"); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/toolbox/JSONTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2016 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static java.nio.charset.StandardCharsets.UTF_8; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.net.URI; import java.net.URL; import java.time.LocalDate; import java.time.ZoneId; import java.util.ArrayList; import java.util.NoSuchElementException; import java.util.stream.Collectors; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeNotSupportedException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON.Value; /** * Unit test for {@link JSON}. */ public class JSONTest { private static final URL BASE_URL = url("https://example.com/acme/1"); /** * Test that an empty {@link JSON} is empty. */ @Test public void testEmpty() { var empty = JSON.empty(); assertThat(empty.toString()).isEqualTo("{}"); assertThat(empty.toMap().keySet()).isEmpty(); } /** * Test parsers. */ @Test public void testParsers() throws IOException { String json = "{\"foo\":\"a-text\",\n\"bar\":123}"; var fromString = JSON.parse(json); assertThatJson(fromString.toString()).isEqualTo(json); var map = fromString.toMap(); assertThat(map).hasSize(2); assertThat(map.keySet()).containsExactlyInAnyOrder("foo", "bar"); assertThat(map.get("foo")).isEqualTo("a-text"); assertThat(map.get("bar")).isEqualTo(123L); try (var in = new ByteArrayInputStream(json.getBytes(UTF_8))) { var fromStream = JSON.parse(in); assertThatJson(fromStream.toString()).isEqualTo(json); var map2 = fromStream.toMap(); assertThat(map2).hasSize(2); assertThat(map2.keySet()).containsExactlyInAnyOrder("foo", "bar"); assertThat(map2.get("foo")).isEqualTo("a-text"); assertThat(map2.get("bar")).isEqualTo(123L); } } /** * Test that bad JSON fails. */ @Test public void testParsersBadJSON() { assertThrows(AcmeProtocolException.class, () -> JSON.parse("This is no JSON.") ); } /** * Test all object related methods. */ @Test public void testObject() { var json = TestUtils.getJSON("datatypes"); assertThat(json.keySet()).containsExactlyInAnyOrder( "text", "number", "boolean", "uri", "url", "date", "array", "collect", "status", "binary", "duration", "problem", "encoded"); assertThat(json.contains("text")).isTrue(); assertThat(json.contains("music")).isFalse(); assertThat(json.get("text")).isNotNull(); assertThat(json.get("music")).isNotNull(); } /** * Test all array related methods. */ @Test public void testArray() { var json = TestUtils.getJSON("datatypes"); var array = json.get("array").asArray(); assertThat(array.isEmpty()).isFalse(); assertThat(array).hasSize(4).doesNotContainNull(); } /** * Test empty array. */ @Test public void testEmptyArray() { var json = TestUtils.getJSON("datatypes"); var array = json.get("missingArray").asArray(); assertThat(array.isEmpty()).isTrue(); assertThat(array).hasSize(0); assertThat(array.stream().count()).isEqualTo(0L); } /** * Test all array iterator related methods. */ @Test public void testArrayIterator() { var json = TestUtils.getJSON("datatypes"); var array = json.get("array").asArray(); var it = array.iterator(); assertThat(it).isNotNull(); assertThat(it.hasNext()).isTrue(); assertThat(it.next().asString()).isEqualTo("foo"); assertThat(it.hasNext()).isTrue(); assertThat(it.next().asInt()).isEqualTo(987); assertThat(it.hasNext()).isTrue(); assertThat(it.next().asArray()).hasSize(3); assertThat(it.hasNext()).isTrue(); assertThrows(UnsupportedOperationException.class, it::remove); assertThat(it.next().asObject()).isNotNull(); assertThat(it.hasNext()).isFalse(); assertThrows(NoSuchElementException.class, it::next); } /** * Test the array stream. */ @Test public void testArrayStream() { var json = TestUtils.getJSON("datatypes"); var array = json.get("array").asArray(); var streamValues = array.stream().collect(Collectors.toList()); var iteratorValues = new ArrayList(); for (var value : array) { iteratorValues.add(value); } assertThat(streamValues).containsAll(iteratorValues); } /** * Test all getters on existing values. */ @Test public void testGetter() { var date = LocalDate.of(2016, 1, 8).atStartOfDay(ZoneId.of("UTC")).toInstant(); var json = TestUtils.getJSON("datatypes"); assertThat(json.get("text").asString()).isEqualTo("lorem ipsum"); assertThat(json.get("number").asInt()).isEqualTo(123); assertThat(json.get("boolean").asBoolean()).isTrue(); assertThat(json.get("uri").asURI()).isEqualTo(URI.create("mailto:foo@example.com")); assertThat(json.get("url").asURL()).isEqualTo(url("http://example.com")); assertThat(json.get("date").asInstant()).isEqualTo(date); assertThat(json.get("status").asStatus()).isEqualTo(Status.VALID); assertThat(json.get("binary").asBinary()).isEqualTo("Chainsaw".getBytes()); assertThat(json.get("duration").asDuration()).hasSeconds(86400L); assertThat(json.get("text").isPresent()).isTrue(); assertThat(json.get("text").optional().isPresent()).isTrue(); assertThat(json.get("text").map(Value::asString).isPresent()).isTrue(); var array = json.get("array").asArray(); assertThat(array.get(0).asString()).isEqualTo("foo"); assertThat(array.get(1).asInt()).isEqualTo(987); var array2 = array.get(2).asArray(); assertThat(array2.get(0).asInt()).isEqualTo(1); assertThat(array2.get(1).asInt()).isEqualTo(2); assertThat(array2.get(2).asInt()).isEqualTo(3); var sub = array.get(3).asObject(); assertThat(sub.get("test").asString()).isEqualTo("ok"); var encodedSub = json.get("encoded").asEncodedObject(); assertThatJson(encodedSub.toString()).isEqualTo("{\"key\":\"value\"}"); var problem = json.get("problem").asProblem(BASE_URL); assertThat(problem).isNotNull(); assertThat(problem.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:rateLimited")); assertThat(problem.getDetail().orElseThrow()).isEqualTo("too many requests"); assertThat(problem.getInstance().orElseThrow()) .isEqualTo(URI.create("https://example.com/documents/errors.html")); } /** * Test that getters are null safe. */ @Test public void testNullGetter() { var json = TestUtils.getJSON("datatypes"); assertThat(json.get("none")).isNotNull(); assertThat(json.get("none").isPresent()).isFalse(); assertThat(json.get("none").optional().isPresent()).isFalse(); assertThat(json.get("none").map(Value::asString).isPresent()).isFalse(); assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(() -> json.getFeature("none")) .withMessage("Server does not support none"); assertThatExceptionOfType(AcmeNotSupportedException.class) .isThrownBy(() -> json.get("none").onFeature("my-feature")) .withMessage("Server does not support my-feature"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asString(), "asString"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asURI(), "asURI"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asURL(), "asURL"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asInstant(), "asInstant"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asDuration(), "asDuration"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asObject(), "asObject"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asEncodedObject(), "asEncodedObject"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asStatus(), "asStatus"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asBinary(), "asBinary"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asProblem(BASE_URL), "asProblem"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asInt(), "asInt"); assertThrows(AcmeProtocolException.class, () -> json.get("none").asBoolean(), "asBoolean"); } /** * Test that wrong getters return an exception. */ @Test public void testWrongGetter() { var json = TestUtils.getJSON("datatypes"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asObject(), "asObject"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asEncodedObject(), "asEncodedObject"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asArray(), "asArray"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asInt(), "asInt"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asURI(), "asURI"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asURL(), "asURL"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asInstant(), "asInstant"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asDuration(), "asDuration"); assertThrows(AcmeProtocolException.class, () -> json.get("text").asProblem(BASE_URL), "asProblem"); } /** * Test that serialization works correctly. */ @Test public void testSerialization() throws IOException, ClassNotFoundException { var originalJson = TestUtils.getJSON("newAuthorizationResponse"); // Serialize byte[] data; try (var out = new ByteArrayOutputStream()) { try (var oos = new ObjectOutputStream(out)) { oos.writeObject(originalJson); } data = out.toByteArray(); } // Deserialize JSON testJson; try (var in = new ByteArrayInputStream(data)) { try (var ois = new ObjectInputStream(in)) { testJson = (JSON) ois.readObject(); } } assertThat(testJson).isNotSameAs(originalJson); assertThat(testJson.toString()).isNotEmpty(); assertThatJson(testJson.toString()).isEqualTo(originalJson.toString()); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/toolbox/JoseUtilsTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2019 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static java.nio.charset.StandardCharsets.UTF_8; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.fail; import static org.shredzone.acme4j.toolbox.TestUtils.url; import java.net.URL; import java.util.Base64; import java.util.HashMap; import javax.crypto.SecretKey; import org.jose4j.jwk.PublicJsonWebKey; import org.jose4j.jws.JsonWebSignature; import org.jose4j.jwx.CompactSerializer; import org.jose4j.lang.JoseException; import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.CsvSource; /** * Unit tests for {@link JoseUtils}. */ public class JoseUtilsTest { private static final Base64.Encoder URL_ENCODER = Base64.getUrlEncoder().withoutPadding(); private static final Base64.Decoder URL_DECODER = Base64.getUrlDecoder(); /** * Test if a JOSE ACME POST request is correctly created. */ @Test public void testCreateJosePostRequest() throws Exception { var resourceUrl = url("http://example.com/acme/resource"); var accountKey = TestUtils.createKeyPair(); var nonce = URL_ENCODER.encodeToString("foo-nonce-1-foo".getBytes()); var payload = new JSONBuilder(); payload.put("foo", 123); payload.put("bar", "a-string"); var jose = JoseUtils .createJoseRequest(resourceUrl, accountKey, payload, nonce, TestUtils.ACCOUNT_URL) .toMap(); var encodedHeader = jose.get("protected").toString(); var encodedSignature = jose.get("signature").toString(); var encodedPayload = jose.get("payload").toString(); var expectedHeader = new StringBuilder(); expectedHeader.append('{'); expectedHeader.append("\"nonce\":\"").append(nonce).append("\","); expectedHeader.append("\"url\":\"").append(resourceUrl).append("\","); expectedHeader.append("\"alg\":\"RS256\","); expectedHeader.append("\"kid\":\"").append(TestUtils.ACCOUNT_URL).append('"'); expectedHeader.append('}'); assertThatJson(new String(URL_DECODER.decode(encodedHeader), UTF_8)) .isEqualTo(expectedHeader.toString()); assertThatJson(new String(URL_DECODER.decode(encodedPayload), UTF_8)) .isEqualTo("{\"foo\":123,\"bar\":\"a-string\"}"); assertThat(encodedSignature).isNotEmpty(); var jws = new JsonWebSignature(); jws.setCompactSerialization(CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature)); jws.setKey(accountKey.getPublic()); assertThat(jws.verifySignature()).isTrue(); } /** * Test if a JOSE ACME POST-as-GET request is correctly created. */ @Test public void testCreateJosePostAsGetRequest() throws Exception { var resourceUrl = url("http://example.com/acme/resource"); var accountKey = TestUtils.createKeyPair(); var nonce = URL_ENCODER.encodeToString("foo-nonce-1-foo".getBytes()); var jose = JoseUtils .createJoseRequest(resourceUrl, accountKey, null, nonce, TestUtils.ACCOUNT_URL) .toMap(); var encodedHeader = jose.get("protected").toString(); var encodedSignature = jose.get("signature").toString(); var encodedPayload = jose.get("payload").toString(); var expectedHeader = new StringBuilder(); expectedHeader.append('{'); expectedHeader.append("\"nonce\":\"").append(nonce).append("\","); expectedHeader.append("\"url\":\"").append(resourceUrl).append("\","); expectedHeader.append("\"alg\":\"RS256\","); expectedHeader.append("\"kid\":\"").append(TestUtils.ACCOUNT_URL).append('"'); expectedHeader.append('}'); assertThatJson(new String(URL_DECODER.decode(encodedHeader), UTF_8)) .isEqualTo(expectedHeader.toString()); assertThat(new String(URL_DECODER.decode(encodedPayload), UTF_8)).isEmpty(); assertThat(encodedSignature).isNotEmpty(); var jws = new JsonWebSignature(); jws.setCompactSerialization(CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature)); jws.setKey(accountKey.getPublic()); assertThat(jws.verifySignature()).isTrue(); } /** * Test if a JOSE ACME Key-Change request is correctly created. */ @Test public void testCreateJoseKeyChangeRequest() throws Exception { var resourceUrl = url("http://example.com/acme/resource"); var accountKey = TestUtils.createKeyPair(); var payload = new JSONBuilder(); payload.put("foo", 123); payload.put("bar", "a-string"); var jose = JoseUtils .createJoseRequest(resourceUrl, accountKey, payload, null, null) .toMap(); var encodedHeader = jose.get("protected").toString(); var encodedSignature = jose.get("signature").toString(); var encodedPayload = jose.get("payload").toString(); var expectedHeader = new StringBuilder(); expectedHeader.append('{'); expectedHeader.append("\"url\":\"").append(resourceUrl).append("\","); expectedHeader.append("\"alg\":\"RS256\","); expectedHeader.append("\"jwk\": {"); expectedHeader.append("\"kty\": \"").append(TestUtils.KTY).append("\","); expectedHeader.append("\"e\": \"").append(TestUtils.E).append("\","); expectedHeader.append("\"n\": \"").append(TestUtils.N).append("\"}"); expectedHeader.append("}"); assertThatJson(new String(URL_DECODER.decode(encodedHeader), UTF_8)) .isEqualTo(expectedHeader.toString()); assertThatJson(new String(URL_DECODER.decode(encodedPayload), UTF_8)) .isEqualTo("{\"foo\":123,\"bar\":\"a-string\"}"); assertThat(encodedSignature).isNotEmpty(); var jws = new JsonWebSignature(); jws.setCompactSerialization(CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature)); jws.setKey(accountKey.getPublic()); assertThat(jws.verifySignature()).isTrue(); } /** * Test if an external account binding is correctly created. */ @ParameterizedTest @CsvSource({"SHA-256,HS256", "SHA-384,HS384", "SHA-512,HS512", "SHA-512,HS256"}) public void testCreateExternalAccountBinding(String keyAlg, String macAlg) throws Exception { var accountKey = TestUtils.createKeyPair(); var keyIdentifier = "NCC-1701"; var macKey = TestUtils.createSecretKey(keyAlg); var resourceUrl = url("http://example.com/acme/resource"); var binding = JoseUtils.createExternalAccountBinding( keyIdentifier, accountKey.getPublic(), macKey, macAlg, resourceUrl); var encodedHeader = binding.get("protected").toString(); var encodedSignature = binding.get("signature").toString(); var encodedPayload = binding.get("payload").toString(); var serialized = CompactSerializer.serialize(encodedHeader, encodedPayload, encodedSignature); assertExternalAccountBinding(serialized, resourceUrl, keyIdentifier, macKey, macAlg); } /** * Test if public key is correctly converted to JWK structure. */ @Test public void testPublicKeyToJWK() throws Exception { var json = JoseUtils.publicKeyToJWK(TestUtils.createKeyPair().getPublic()); assertThat(json).hasSize(3); assertThat(json.get("kty")).isEqualTo(TestUtils.KTY); assertThat(json.get("n")).isEqualTo(TestUtils.N); assertThat(json.get("e")).isEqualTo(TestUtils.E); } /** * Test if JWK structure is correctly converted to public key. */ @Test public void testJWKToPublicKey() throws Exception { var json = new HashMap(); json.put("kty", TestUtils.KTY); json.put("n", TestUtils.N); json.put("e", TestUtils.E); var key = JoseUtils.jwkToPublicKey(json); assertThat(key.getEncoded()).isEqualTo(TestUtils.createKeyPair().getPublic().getEncoded()); } /** * Test if thumbprint is correctly computed. */ @Test public void testThumbprint() throws Exception { var thumb = JoseUtils.thumbprint(TestUtils.createKeyPair().getPublic()); var encoded = Base64.getUrlEncoder().withoutPadding().encodeToString(thumb); assertThat(encoded).isEqualTo(TestUtils.THUMBPRINT); } /** * Test if RSA using SHA-256 keys are properly detected. */ @Test public void testRsaKey() throws Exception { var rsaKeyPair = TestUtils.createKeyPair(); var jwk = PublicJsonWebKey.Factory.newPublicJwk(rsaKeyPair.getPublic()); var type = JoseUtils.keyAlgorithm(jwk); assertThat(type).isEqualTo("RS256"); } /** * Test if ECDSA using NIST P-256 curve and SHA-256 keys are properly detected. */ @Test public void testP256ECKey() throws Exception { var ecKeyPair = TestUtils.createECKeyPair("secp256r1"); var jwk = PublicJsonWebKey.Factory.newPublicJwk(ecKeyPair.getPublic()); var type = JoseUtils.keyAlgorithm(jwk); assertThat(type).isEqualTo("ES256"); } /** * Test if ECDSA using NIST P-384 curve and SHA-384 keys are properly detected. */ @Test public void testP384ECKey() throws Exception { var ecKeyPair = TestUtils.createECKeyPair("secp384r1"); var jwk = PublicJsonWebKey.Factory.newPublicJwk(ecKeyPair.getPublic()); var type = JoseUtils.keyAlgorithm(jwk); assertThat(type).isEqualTo("ES384"); } /** * Test if ECDSA using NIST P-521 curve and SHA-512 keys are properly detected. */ @Test public void testP521ECKey() throws Exception { var ecKeyPair = TestUtils.createECKeyPair("secp521r1"); var jwk = PublicJsonWebKey.Factory.newPublicJwk(ecKeyPair.getPublic()); var type = JoseUtils.keyAlgorithm(jwk); assertThat(type).isEqualTo("ES512"); } /** * Test if MAC key algorithms are properly detected. */ @Test public void testMacKey() throws Exception { assertThat(JoseUtils.macKeyAlgorithm(TestUtils.createSecretKey("SHA-256"))).isEqualTo("HS256"); assertThat(JoseUtils.macKeyAlgorithm(TestUtils.createSecretKey("SHA-384"))).isEqualTo("HS384"); assertThat(JoseUtils.macKeyAlgorithm(TestUtils.createSecretKey("SHA-512"))).isEqualTo("HS512"); } /** * Asserts that the serialized external account binding is valid. Unit test fails if * the account binding is invalid. * * @param serialized * Serialized external account binding JOSE structure * @param resourceUrl * Expected resource {@link URL} * @param keyIdentifier * Expected key identifier * @param macKey * Expected {@link SecretKey} * @param macAlg * Expected algorithm */ public static void assertExternalAccountBinding(String serialized, URL resourceUrl, String keyIdentifier, SecretKey macKey, String macAlg) { try { var jws = new JsonWebSignature(); jws.setCompactSerialization(serialized); jws.setKey(macKey); assertThat(jws.verifySignature()).isTrue(); assertThat(jws.getHeader("url")).isEqualTo(resourceUrl.toString()); assertThat(jws.getHeader("kid")).isEqualTo(keyIdentifier); assertThat(jws.getHeader("alg")).isEqualTo(macAlg); var decodedPayload = jws.getPayload(); var expectedPayload = new StringBuilder(); expectedPayload.append('{'); expectedPayload.append("\"kty\":\"").append(TestUtils.KTY).append("\","); expectedPayload.append("\"e\":\"").append(TestUtils.E).append("\","); expectedPayload.append("\"n\":\"").append(TestUtils.N).append("\""); expectedPayload.append("}"); assertThatJson(decodedPayload).isEqualTo(expectedPayload.toString()); } catch (JoseException ex) { fail(ex); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/toolbox/TestUtils.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.toolbox; import static java.nio.charset.StandardCharsets.UTF_8; import static java.util.stream.Collectors.toUnmodifiableList; import java.io.ByteArrayOutputStream; import java.io.FileOutputStream; import java.io.IOException; import java.io.UncheckedIOException; import java.net.MalformedURLException; import java.net.URI; import java.net.URL; import java.security.InvalidAlgorithmParameterException; import java.security.KeyFactory; import java.security.KeyPair; import java.security.KeyPairGenerator; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.security.spec.ECGenParameterSpec; import java.security.spec.InvalidKeySpecException; import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.X509EncodedKeySpec; import java.util.Base64; import java.util.List; import java.util.TreeMap; import javax.crypto.SecretKey; import edu.umd.cs.findbugs.annotations.Nullable; import org.jose4j.json.JsonUtil; import org.jose4j.jwk.JsonWebKey; import org.jose4j.jwk.JsonWebKey.OutputControlLevel; import org.jose4j.keys.HmacKey; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Problem; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.connector.Connection; import org.shredzone.acme4j.connector.NetworkSettings; import org.shredzone.acme4j.provider.AcmeProvider; /** * Some utility methods for unit tests. */ public final class TestUtils { public static final String N = "pZsTKY41y_CwgJ0VX7BmmGs_7UprmXQMGPcnSbBeJAjZHA9SyyJKaWv4fNUdBIAX3Y2QoZixj50nQLyLv2ng3pvEoRL0sx9ZHgp5ndAjpIiVQ_8V01TTYCEDUc9ii7bjVkgFAb4ValZGFJZ54PcCnAHvXi5g0ELORzGcTuRqHVAUckMV2otr0g0u_5bWMm6EMAbBrGQCgUGjbZQHjava1Y-5tHXZkPBahJ2LvKRqMmJUlr0anKuJJtJUG03DJYAxABv8YAaXFBnGw6kKJRpUFAC55ry4sp4kGy0NrK2TVWmZW9kStniRv4RaJGI9aZGYwQy2kUykibBNmWEQUlIwIw"; public static final String E = "AQAB"; public static final String KTY = "RSA"; public static final String THUMBPRINT = "HnWjTDnyqlCrm6tZ-6wX-TrEXgRdeNu9G71gqxSO6o0"; public static final String D_N = "tP7p9wOe0NWocwLu7h233i1JqUPW1MeLeilyHY7oMKnXZFyf1l0saqLcrBtOj3EyaG6qVfpiLEWEIiuWclPYSR_QSt9lCi9xAoWbYq9-mqseehXPaejynlIMsP2UiCAenSHjJEer6Ug6nFelGVgav3mypwYFUdvc18wI00clKYhRAc4dZodilRzDTLy95V1S3RCxGf-lE0XYg7ieO_ovSMERtH_7NsjZnBiaE7mwm0YZzreCr8oSuHwhC63kgY27FnCgH0h63LICSPVVDJZPLcWAmSXv1k0qoVTsRzFutRN6RB_96wqTTBi8Qm98lyCpXcsxa3BH-4TCvLEaa2KkeQ"; public static final String D_E = "AQAB"; public static final String D_KTY = "RSA"; public static final String D_THUMBPRINT = "0VPbh7-I6swlkBu0TrNKSQp6d69bukzeQA0ksuX3FFs"; public static final String ACME_SERVER_URI = "https://example.com/acme"; public static final String ACCOUNT_URL = "https://example.com/acme/account/1"; public static final String DUMMY_NONCE = Base64.getUrlEncoder().withoutPadding().encodeToString("foo-nonce-foo".getBytes()); public static final String CERT_ISSUER = "Pebble Intermediate CA 645fc5"; public static final NetworkSettings DEFAULT_NETWORK_SETTINGS = new NetworkSettings(); private TestUtils() { // utility class without constructor } /** * Reads a resource as byte array. * * @param name * Resource name * @return Resource content as byte array. */ public static byte[] getResourceAsByteArray(String name) throws IOException { var buffer = new byte[2048]; try (var in = TestUtils.class.getResourceAsStream(name); var out = new ByteArrayOutputStream()) { int len; while ((len = in.read(buffer)) >= 0) { out.write(buffer, 0, len); } return out.toByteArray(); } } /** * Reads a JSON string from json test files and parses it. * * @param key * JSON resource * @return Parsed JSON resource */ public static JSON getJSON(String key) { try { return JSON.parse(TestUtils.class.getResourceAsStream("/json/" + key + ".json")); } catch (IOException ex) { throw new UncheckedIOException(ex); } } /** * Creates a {@link Session} instance. It uses {@link #ACME_SERVER_URI} as server URI. */ public static Session session() { return new Session(URI.create(ACME_SERVER_URI)); } /** * Creates a {@link Login} instance. It uses {@link #ACME_SERVER_URI} as server URI, * {@link #ACCOUNT_URL} as account URL, and a random key pair. */ public static Login login() { try { return session().login(URI.create(ACCOUNT_URL).toURL(), createKeyPair()); } catch (IOException ex) { throw new UncheckedIOException(ex); } } /** * Creates an {@link URL} from a String. Only throws a runtime exception if the URL is * malformed. * * @param url * URL to use * @return {@link URL} object */ public static URL url(String url) { try { return URI.create(url).toURL(); } catch (MalformedURLException ex) { throw new IllegalArgumentException(url, ex); } } /** * Creates a {@link Session} instance. It uses {@link #ACME_SERVER_URI} as server URI. * * @param provider * {@link AcmeProvider} to be used in this session */ public static Session session(final AcmeProvider provider) { return new Session(URI.create(ACME_SERVER_URI)) { @Override public AcmeProvider provider() { return provider; } @Override public Connection connect() { return provider.connect(getServerUri(), DEFAULT_NETWORK_SETTINGS, getHttpClient()); } }; } /** * Creates a standard account {@link KeyPair} for testing. The key pair is read from a * test resource and is guaranteed not to change between test runs. *

* The constants {@link #N}, {@link #E}, {@link #KTY} and {@link #THUMBPRINT} are * related to the returned key pair and can be used for asserting results. * * @return {@link KeyPair} for testing */ public static KeyPair createKeyPair() { try { var keyFactory = KeyFactory.getInstance(KTY); var publicKeySpec = new X509EncodedKeySpec(getResourceAsByteArray("/public.key")); var publicKey = keyFactory.generatePublic(publicKeySpec); var privateKeySpec = new PKCS8EncodedKeySpec(getResourceAsByteArray("/private.key")); var privateKey = keyFactory.generatePrivate(privateKeySpec); return new KeyPair(publicKey, privateKey); } catch (NoSuchAlgorithmException | InvalidKeySpecException | IOException ex) { throw new IllegalStateException(ex); } } /** * Creates a standard domain key pair for testing. This keypair is read from a test * resource and is guaranteed not to change between test runs. *

* The constants {@link #D_N}, {@link #D_E}, {@link #D_KTY} and {@link #D_THUMBPRINT} * are related to the returned key pair and can be used for asserting results. * * @return {@link KeyPair} for testing */ public static KeyPair createDomainKeyPair() throws IOException { try { var keyFactory = KeyFactory.getInstance(KTY); var publicKeySpec = new X509EncodedKeySpec(getResourceAsByteArray("/domain-public.key")); var publicKey = keyFactory.generatePublic(publicKeySpec); var privateKeySpec = new PKCS8EncodedKeySpec(getResourceAsByteArray("/domain-private.key")); var privateKey = keyFactory.generatePrivate(privateKeySpec); return new KeyPair(publicKey, privateKey); } catch (NoSuchAlgorithmException | InvalidKeySpecException ex) { throw new IOException(ex); } } /** * Creates a random ECC key pair with the given curve name. * * @param name * Curve name * @return {@link KeyPair} for testing */ public static KeyPair createECKeyPair(String name) throws IOException { try { var ecSpec = new ECGenParameterSpec(name); var keyGen = KeyPairGenerator.getInstance("EC"); keyGen.initialize(ecSpec, new SecureRandom()); return keyGen.generateKeyPair(); } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException ex) { throw new IOException(ex); } } /** * Creates a HMAC key using the given hash algorithm. * * @param algorithm * Name of the hash algorithm to be used * @return {@link SecretKey} for testing */ public static SecretKey createSecretKey(String algorithm) throws IOException { try { var md = MessageDigest.getInstance(algorithm); md.update("Turpentine".getBytes()); // A random password var macKey = md.digest(); return new HmacKey(macKey); } catch (NoSuchAlgorithmException ex) { throw new IOException(ex); } } /** * Creates a standard certificate chain for testing. This certificate is read from a * test resource and is guaranteed not to change between test runs. * * @param resource * Name of the resource * @return List of {@link X509Certificate} for testing */ public static List createCertificate(String resource) throws IOException { try (var in = TestUtils.class.getResourceAsStream(resource)) { var cf = CertificateFactory.getInstance("X.509"); return cf.generateCertificates(in).stream() .map(c -> (X509Certificate) c) .collect(toUnmodifiableList()); } catch (CertificateException ex) { throw new IOException(ex); } } /** * Creates a {@link Problem} with the given type and details. * * @param type * Problem type * @param detail * Problem details * @param instance * Instance, or {@code null} * @return Created {@link Problem} object */ public static Problem createProblem(URI type, String detail, @Nullable URL instance) { var jb = new JSONBuilder(); jb.put("type", type); jb.put("detail", detail); if (instance != null) { jb.put("instance", instance); } return new Problem(jb.toJSON(), url("https://example.com/acme/1")); } /** * Generates a new keypair for unit tests, and return its N, E, KTY and THUMBPRINT * parameters to be set in the {@link TestUtils} class. */ public static void main(String... args) throws Exception { var keyGen = KeyPairGenerator.getInstance("RSA"); keyGen.initialize(2048); var keyPair = keyGen.generateKeyPair(); try (var out = new FileOutputStream("public.key")) { out.write(keyPair.getPublic().getEncoded()); } try (var out = new FileOutputStream("private.key")) { out.write(keyPair.getPrivate().getEncoded()); } var jwk = JsonWebKey.Factory.newJwk(keyPair.getPublic()); var params = new TreeMap<>(jwk.toParams(OutputControlLevel.PUBLIC_ONLY)); var md = MessageDigest.getInstance("SHA-256"); md.update(JsonUtil.toJson(params).getBytes(UTF_8)); var thumbprint = md.digest(); System.out.println("N = " + params.get("n")); System.out.println("E = " + params.get("e")); System.out.println("KTY = " + params.get("kty")); System.out.println("THUMBPRINT = " + Base64.getUrlEncoder().withoutPadding().encodeToString(thumbprint)); } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/util/CSRBuilderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.util; import static org.assertj.core.api.Assertions.*; import static org.junit.jupiter.api.Assertions.assertThrows; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.StringReader; import java.io.StringWriter; import java.net.InetAddress; import java.net.UnknownHostException; import java.nio.charset.StandardCharsets; import java.security.KeyPair; import java.security.Security; import java.util.Arrays; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1IA5String; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x500.style.BCStyle; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.Extensions; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.openssl.PEMParser; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; /** * Unit tests for {@link CSRBuilder}. */ public class CSRBuilderTest { private static KeyPair testKey; private static KeyPair testEcKey; /** * Add provider, create some key pairs */ @BeforeAll public static void setup() { Security.addProvider(new BouncyCastleProvider()); testKey = KeyPairUtils.createKeyPair(512); testEcKey = KeyPairUtils.createECKeyPair("secp256r1"); } /** * Test if the generated CSR is plausible. */ @Test public void testGenerate() throws IOException { var builder = createBuilderWithValues(); builder.sign(testKey); var csr = builder.getCSR(); assertThat(csr).isNotNull(); assertThat(csr.getEncoded()).isEqualTo(builder.getEncoded()); csrTest(csr); writerTest(builder); } /** * Test if the generated CSR is plausible using a ECDSA key. */ @Test public void testECCGenerate() throws IOException { var builder = createBuilderWithValues(); builder.sign(testEcKey); var csr = builder.getCSR(); assertThat(csr).isNotNull(); assertThat(csr.getEncoded()).isEqualTo(builder.getEncoded()); csrTest(csr); writerTest(builder); } /** * Make sure an exception is thrown when no domain is set. */ @Test public void testNoDomain() { var ise = assertThrows(IllegalStateException.class, () -> { var builder = new CSRBuilder(); builder.sign(testKey); }); assertThat(ise.getMessage()) .isEqualTo("No domain or IP address was set"); } /** * Make sure an exception is thrown when an unknown identifier type is used. */ @Test public void testUnknownType() { var iae = assertThrows(IllegalArgumentException.class, () -> { var builder = new CSRBuilder(); builder.addIdentifier(new Identifier("UnKnOwN", "123")); }); assertThat(iae.getMessage()) .isEqualTo("Unknown identifier type: UnKnOwN"); } /** * Make sure all getters will fail if the CSR is not signed. */ @Test public void testNoSign() { var builder = new CSRBuilder(); assertThatIllegalStateException() .isThrownBy(builder::getCSR) .as("getCSR()") .withMessage("sign CSR first"); assertThatIllegalStateException() .isThrownBy(builder::getEncoded) .as("getCSR()") .withMessage("sign CSR first"); assertThatIllegalStateException() .isThrownBy(() -> { try (StringWriter w = new StringWriter()) { builder.write(w); } }) .as("builder.write()") .withMessage("sign CSR first"); } /** * Checks that addValue behaves correctly in dependence of the * attributes being added. If a common name is set, it should * be handled in the same way when it's added by using * addDomain */ @Test public void testAddAttrValues() { var builder = new CSRBuilder(); String invAttNameExMessage = assertThrows(IllegalArgumentException.class, () -> X500Name.getDefaultStyle().attrNameToOID("UNKNOWNATT")).getMessage(); assertThat(builder.toString()).isEqualTo(""); assertThatNullPointerException() .isThrownBy(() -> new CSRBuilder().addValue((String) null, "value")) .as("addValue(String, String)"); assertThatNullPointerException() .isThrownBy(() -> new CSRBuilder().addValue((ASN1ObjectIdentifier) null, "value")) .as("addValue(ASN1ObjectIdentifier, String)"); assertThatNullPointerException() .isThrownBy(() -> new CSRBuilder().addValue("C", null)) .as("addValue(String, null)"); assertThatIllegalArgumentException() .isThrownBy(() -> new CSRBuilder().addValue("UNKNOWNATT", "val")) .as("addValue(String, null)") .withMessage(invAttNameExMessage); assertThat(builder.toString()).isEqualTo(""); builder.addValue("C", "DE"); assertThat(builder.toString()).isEqualTo("C=DE"); builder.addValue("E", "contact@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com"); builder.addValue("CN", "firstcn.example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn.example.com,DNS=firstcn.example.com"); builder.addValue("CN", "scnd.example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn.example.com,DNS=firstcn.example.com,DNS=scnd.example.com"); builder = new CSRBuilder(); builder.addValue(BCStyle.C, "DE"); assertThat(builder.toString()).isEqualTo("C=DE"); builder.addValue(BCStyle.EmailAddress, "contact@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com"); builder.addValue(BCStyle.CN, "firstcn.example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn.example.com,DNS=firstcn.example.com"); builder.addValue(BCStyle.CN, "scnd.example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn.example.com,DNS=firstcn.example.com,DNS=scnd.example.com"); } private CSRBuilder createBuilderWithValues() throws UnknownHostException { var builder = new CSRBuilder(); builder.addDomain("abc.de"); builder.addDomain("fg.hi"); builder.addDomains("jklm.no", "pqr.st"); builder.addDomains(Arrays.asList("uv.wx", "y.z")); builder.addDomain("*.wild.card"); builder.addIP(InetAddress.getByName("192.0.2.1")); builder.addIP(InetAddress.getByName("192.0.2.2")); builder.addIPs(InetAddress.getByName("198.51.100.1"), InetAddress.getByName("198.51.100.2")); builder.addIPs(Arrays.asList(InetAddress.getByName("2001:db8::1"), InetAddress.getByName("2001:db8::2"))); builder.addIdentifier(Identifier.dns("ide1.nt")); builder.addIdentifier(Identifier.ip("203.0.113.5")); builder.addIdentifiers(Identifier.dns("ide2.nt"), Identifier.ip("203.0.113.6")); builder.addIdentifiers(Arrays.asList(Identifier.dns("ide3.nt"), Identifier.ip("203.0.113.7"))); builder.setCommonName("abc.de"); builder.setCountry("XX"); builder.setLocality("Testville"); builder.setOrganization("Testing Co"); builder.setOrganizationalUnit("Testunit"); builder.setState("ABC"); assertThat(builder.toString()).isEqualTo("CN=abc.de,C=XX,L=Testville,O=Testing Co," + "OU=Testunit,ST=ABC," + "DNS=abc.de,DNS=fg.hi,DNS=jklm.no,DNS=pqr.st,DNS=uv.wx,DNS=y.z,DNS=*.wild.card," + "DNS=ide1.nt,DNS=ide2.nt,DNS=ide3.nt," + "IP=192.0.2.1,IP=192.0.2.2,IP=198.51.100.1,IP=198.51.100.2," + "IP=2001:db8:0:0:0:0:0:1,IP=2001:db8:0:0:0:0:0:2," + "IP=203.0.113.5,IP=203.0.113.6,IP=203.0.113.7"); return builder; } /** * Checks if the CSR contains the right parameters. *

* This is not supposed to be a Bouncy Castle test. If the * {@link PKCS10CertificationRequest} contains the right parameters, we assume that * Bouncy Castle encodes it properly. */ private void csrTest(PKCS10CertificationRequest csr) { var name = csr.getSubject(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(name.getRDNs(BCStyle.CN)).as("CN") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("abc.de"); softly.assertThat(name.getRDNs(BCStyle.C)).as("C") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("XX"); softly.assertThat(name.getRDNs(BCStyle.L)).as("L") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("Testville"); softly.assertThat(name.getRDNs(BCStyle.O)).as("O") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("Testing Co"); softly.assertThat(name.getRDNs(BCStyle.OU)).as("OU") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("Testunit"); softly.assertThat(name.getRDNs(BCStyle.ST)).as("ST") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("ABC"); } var attr = csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest); assertThat(attr).hasSize(1); var extensions = attr[0].getAttrValues().toArray(); assertThat(extensions).hasSize(1); var names = GeneralNames.fromExtensions((Extensions) extensions[0], Extension.subjectAlternativeName); assertThat(names.getNames()) .filteredOn(gn -> gn.getTagNo() == GeneralName.dNSName) .extracting(gn -> ASN1IA5String.getInstance(gn.getName()).getString()) .containsExactlyInAnyOrder("abc.de", "fg.hi", "jklm.no", "pqr.st", "uv.wx", "y.z", "*.wild.card", "ide1.nt", "ide2.nt", "ide3.nt"); assertThat(names.getNames()) .filteredOn(gn -> gn.getTagNo() == GeneralName.iPAddress) .extracting(gn -> getIP(gn.getName()).getHostAddress()) .containsExactlyInAnyOrder("192.0.2.1", "192.0.2.2", "198.51.100.1", "198.51.100.2", "2001:db8:0:0:0:0:0:1", "2001:db8:0:0:0:0:0:2", "203.0.113.5", "203.0.113.6", "203.0.113.7"); } /** * Checks if the {@link CSRBuilder#write(java.io.Writer)} method generates a correct * CSR PEM file. */ private void writerTest(CSRBuilder builder) throws IOException { // Write CSR to PEM String pem; try (var out = new StringWriter()) { builder.write(out); pem = out.toString(); } // Make sure PEM file is properly formatted assertThat(pem).matches( "-----BEGIN CERTIFICATE REQUEST-----[\\r\\n]+" + "([a-zA-Z0-9/+=]+[\\r\\n]+)+" + "-----END CERTIFICATE REQUEST-----[\\r\\n]*"); // Read CSR from PEM PKCS10CertificationRequest readCsr; try (var parser = new PEMParser(new StringReader(pem))) { readCsr = (PKCS10CertificationRequest) parser.readObject(); } // Verify that both keypairs are the same assertThat(builder.getCSR()).isNotSameAs(readCsr); assertThat(builder.getEncoded()).isEqualTo(readCsr.getEncoded()); // OutputStream is identical? byte[] pemBytes; try (var baos = new ByteArrayOutputStream()) { builder.write(baos); pemBytes = baos.toByteArray(); } assertThat(new String(pemBytes, StandardCharsets.UTF_8)).isEqualTo(pem); } /** * Fetches the {@link InetAddress} from the given iPAddress record. * * @param name * Name to convert * @return {@link InetAddress} * @throws IllegalArgumentException * if the IP address could not be read */ private static InetAddress getIP(ASN1Encodable name) { try { return InetAddress.getByAddress(DEROctetString.getInstance(name).getOctets()); } catch (UnknownHostException ex) { throw new IllegalArgumentException(ex); } } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/util/CertificateUtilsTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.util; import static java.time.temporal.ChronoUnit.SECONDS; import static org.assertj.core.api.Assertions.assertThat; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.InputStream; import java.lang.reflect.Modifier; import java.net.InetAddress; import java.net.UnknownHostException; import java.security.KeyPair; import java.security.PrivateKey; import java.security.PublicKey; import java.security.cert.CertificateParsingException; import java.security.cert.X509Certificate; import java.time.Duration; import java.time.Instant; import java.util.Date; import java.util.HashSet; import java.util.Set; import org.bouncycastle.asn1.ASN1InputStream; import org.bouncycastle.asn1.BERTags; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.challenge.TlsAlpn01Challenge; import org.shredzone.acme4j.toolbox.AcmeUtils; /** * Unit tests for {@link CertificateUtils}. */ public class CertificateUtilsTest { /** * Test if {@link CertificateUtils#readCSR(InputStream)} reads an identical CSR. */ @Test public void testReadCSR() throws IOException { var keypair = KeyPairUtils.createKeyPair(2048); var builder = new CSRBuilder(); builder.addDomains("example.com", "example.org"); builder.sign(keypair); var original = builder.getCSR(); byte[] pemFile; try (var baos = new ByteArrayOutputStream()) { builder.write(baos); pemFile = baos.toByteArray(); } try (var bais = new ByteArrayInputStream(pemFile)) { var read = CertificateUtils.readCSR(bais); assertThat(original.getEncoded()).isEqualTo(read.getEncoded()); } } /** * Test that constructor is private. */ @Test public void testPrivateConstructor() throws Exception { var constructor = CertificateUtils.class.getDeclaredConstructor(); assertThat(Modifier.isPrivate(constructor.getModifiers())).isTrue(); constructor.setAccessible(true); constructor.newInstance(); } /** * Test if * {@link CertificateUtils#createTlsAlpn01Certificate(KeyPair, Identifier, byte[])} * with domain name creates a good certificate. */ @Test public void testCreateTlsAlpn01Certificate() throws Exception { var keypair = KeyPairUtils.createKeyPair(2048); var subject = "example.com"; var acmeValidationV1 = AcmeUtils.sha256hash("rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ"); var cert = CertificateUtils.createTlsAlpn01Certificate(keypair, Identifier.dns(subject), acmeValidationV1); var now = Instant.now(); var end = now.plus(Duration.ofDays(8)); assertThat(cert).isNotNull(); assertThat(cert.getNotAfter()).isAfter(Date.from(now)); assertThat(cert.getNotAfter()).isBefore(Date.from(end)); assertThat(cert.getNotBefore()).isBeforeOrEqualTo(Date.from(now)); assertThat(cert.getSubjectX500Principal().getName()).isEqualTo("CN=acme.invalid"); assertThat(getSANs(cert)).contains(subject); assertThat(cert.getCriticalExtensionOIDs()).contains(TlsAlpn01Challenge.ACME_VALIDATION_OID); var encodedExtensionValue = cert.getExtensionValue(TlsAlpn01Challenge.ACME_VALIDATION_OID); assertThat(encodedExtensionValue).isNotNull(); try (var asn = new ASN1InputStream(new ByteArrayInputStream(encodedExtensionValue))) { var derOctetString = (DEROctetString) asn.readObject(); var test = new byte[acmeValidationV1.length + 2]; test[0] = BERTags.OCTET_STRING; test[1] = (byte) acmeValidationV1.length; System.arraycopy(acmeValidationV1, 0, test, 2, acmeValidationV1.length); assertThat(derOctetString.getOctets()).isEqualTo(test); } cert.verify(keypair.getPublic()); } /** * Test if * {@link CertificateUtils#createTlsAlpn01Certificate(KeyPair, Identifier, byte[])} * with IP creates a good certificate. */ @Test public void testCreateTlsAlpn01CertificateWithIp() throws IOException, CertificateParsingException { var keypair = KeyPairUtils.createKeyPair(2048); var subject = InetAddress.getLocalHost(); var acmeValidationV1 = AcmeUtils.sha256hash("rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ"); var cert = CertificateUtils.createTlsAlpn01Certificate(keypair, Identifier.ip(subject), acmeValidationV1); assertThat(cert.getSubjectX500Principal().getName()).isEqualTo("CN=acme.invalid"); assertThat(getIpSANs(cert)).contains(subject); } /** * Test if {@link CertificateUtils#createTestRootCertificate(String, Instant, Instant, * KeyPair)} generates a valid root certificate. */ @Test public void testCreateTestRootCertificate() throws Exception { var keypair = KeyPairUtils.createKeyPair(2048); var subject = "CN=Test Root Certificate"; var notBefore = Instant.now().truncatedTo(SECONDS); var notAfter = notBefore.plus(Duration.ofDays(14)).truncatedTo(SECONDS); var cert = CertificateUtils.createTestRootCertificate(subject, notBefore, notAfter, keypair); assertThat(cert.getIssuerX500Principal().getName()).isEqualTo(subject); assertThat(cert.getSubjectX500Principal().getName()).isEqualTo(subject); assertThat(cert.getNotBefore().toInstant()).isEqualTo(notBefore); assertThat(cert.getNotAfter().toInstant()).isEqualTo(notAfter); assertThat(cert.getSerialNumber()).isNotNull(); assertThat(cert.getPublicKey()).isEqualTo(keypair.getPublic()); cert.verify(cert.getPublicKey()); // self-signed } /** * Test if {@link CertificateUtils#createTestIntermediateCertificate(String, Instant, * Instant, PublicKey, X509Certificate, PrivateKey)} generates a valid intermediate * certificate. */ @Test public void testCreateTestIntermediateCertificate() throws Exception { var rootKeypair = KeyPairUtils.createKeyPair(2048); var rootSubject = "CN=Test Root Certificate"; var rootNotBefore = Instant.now().minus(Duration.ofDays(1)).truncatedTo(SECONDS); var rootNotAfter = rootNotBefore.plus(Duration.ofDays(14)).truncatedTo(SECONDS); var rootCert = CertificateUtils.createTestRootCertificate(rootSubject, rootNotBefore, rootNotAfter, rootKeypair); var keypair = KeyPairUtils.createKeyPair(2048); var subject = "CN=Test Intermediate Certificate"; var notBefore = Instant.now().truncatedTo(SECONDS); var notAfter = notBefore.plus(Duration.ofDays(7)).truncatedTo(SECONDS); var cert = CertificateUtils.createTestIntermediateCertificate(subject, notBefore, notAfter, keypair.getPublic(), rootCert, rootKeypair.getPrivate()); assertThat(cert.getIssuerX500Principal().getName()).isEqualTo(rootSubject); assertThat(cert.getSubjectX500Principal().getName()).isEqualTo(subject); assertThat(cert.getNotBefore().toInstant()).isEqualTo(notBefore); assertThat(cert.getNotAfter().toInstant()).isEqualTo(notAfter); assertThat(cert.getSerialNumber()).isNotNull(); assertThat(cert.getSerialNumber()).isNotEqualTo(rootCert.getSerialNumber()); assertThat(cert.getPublicKey()).isEqualTo(keypair.getPublic()); cert.verify(rootKeypair.getPublic()); // signed by root } /** * Test if {@link CertificateUtils#createTestCertificate(PKCS10CertificationRequest, * Instant, Instant, X509Certificate, PrivateKey)} generates a valid certificate. */ @Test public void testCreateTestCertificate() throws Exception { var rootKeypair = KeyPairUtils.createKeyPair(2048); var rootSubject = "CN=Test Root Certificate"; var rootNotBefore = Instant.now().minus(Duration.ofDays(1)).truncatedTo(SECONDS); var rootNotAfter = rootNotBefore.plus(Duration.ofDays(14)).truncatedTo(SECONDS); var rootCert = CertificateUtils.createTestRootCertificate(rootSubject, rootNotBefore, rootNotAfter, rootKeypair); var keypair = KeyPairUtils.createKeyPair(2048); var notBefore = Instant.now().truncatedTo(SECONDS); var notAfter = notBefore.plus(Duration.ofDays(7)).truncatedTo(SECONDS); var builder = new CSRBuilder(); builder.addDomains("example.org", "www.example.org"); builder.addIP(InetAddress.getByName("192.0.2.1")); builder.sign(keypair); var csr = builder.getCSR(); var cert = CertificateUtils.createTestCertificate(csr, notBefore, notAfter, rootCert, rootKeypair.getPrivate()); assertThat(cert.getIssuerX500Principal().getName()).isEqualTo(rootSubject); assertThat(cert.getSubjectX500Principal().getName()).isEqualTo(""); assertThat(getSANs(cert)).contains("example.org", "www.example.org"); assertThat(getIpSANs(cert)).contains(InetAddress.getByName("192.0.2.1")); assertThat(cert.getNotBefore().toInstant()).isEqualTo(notBefore); assertThat(cert.getNotAfter().toInstant()).isEqualTo(notAfter); assertThat(cert.getSerialNumber()).isNotNull(); assertThat(cert.getSerialNumber()).isNotEqualTo(rootCert.getSerialNumber()); assertThat(cert.getPublicKey()).isEqualTo(keypair.getPublic()); cert.verify(rootKeypair.getPublic()); // signed by root } /** * Extracts all DNSName SANs from a certificate. * * @param cert * {@link X509Certificate} * @return Set of DNSName */ private Set getSANs(X509Certificate cert) throws CertificateParsingException { var result = new HashSet(); for (var list : cert.getSubjectAlternativeNames()) { if (((Number) list.get(0)).intValue() == GeneralName.dNSName) { result.add((String) list.get(1)); } } return result; } /** * Extracts all IPAddress SANs from a certificate. * * @param cert * {@link X509Certificate} * @return Set of IPAddresses */ private Set getIpSANs(X509Certificate cert) throws CertificateParsingException, UnknownHostException { var result = new HashSet(); for (var list : cert.getSubjectAlternativeNames()) { if (((Number) list.get(0)).intValue() == GeneralName.iPAddress) { result.add(InetAddress.getByName(list.get(1).toString())); } } return result; } } ================================================ FILE: acme4j-client/src/test/java/org/shredzone/acme4j/util/KeyPairUtilsTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.util; import static org.assertj.core.api.Assertions.assertThat; import java.io.IOException; import java.io.StringReader; import java.io.StringWriter; import java.lang.reflect.Modifier; import java.security.KeyPair; import java.security.Security; import java.security.interfaces.ECPublicKey; import java.security.interfaces.RSAPublicKey; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; /** * Unit tests for {@link KeyPairUtils}. */ public class KeyPairUtilsTest { private static final int KEY_SIZE = 2048; private static final String EC_CURVE = "secp256r1"; @BeforeAll public static void setup() { Security.addProvider(new BouncyCastleProvider()); } /** * Test that standard keypair generates a secure key pair. */ @Test public void testCreateStandardKeyPair() { var pair = KeyPairUtils.createKeyPair(); assertThat(pair).isNotNull(); assertThat(pair.getPublic()).isInstanceOf(ECPublicKey.class); var pk = (ECPublicKey) pair.getPublic(); assertThat(pk.getAlgorithm()).isEqualTo("ECDSA"); assertThat(pk.getParams().getCurve().getField().getFieldSize()).isEqualTo(384); } /** * Test that RSA keypairs of the correct size are generated. */ @Test public void testCreateKeyPair() { var pair = KeyPairUtils.createKeyPair(KEY_SIZE); assertThat(pair).isNotNull(); assertThat(pair.getPublic()).isInstanceOf(RSAPublicKey.class); var pub = (RSAPublicKey) pair.getPublic(); assertThat(pub.getModulus().bitLength()).isEqualTo(KEY_SIZE); } /** * Test that reading and writing keypairs work correctly. */ @Test public void testWriteAndRead() throws IOException { // Generate a test keypair var pair = KeyPairUtils.createKeyPair(KEY_SIZE); // Write keypair to PEM String pem; try (var out = new StringWriter()) { KeyPairUtils.writeKeyPair(pair, out); pem = out.toString(); } // Make sure PEM file is properly formatted assertThat(pem).matches( "-----BEGIN RSA PRIVATE KEY-----[\\r\\n]+" + "([a-zA-Z0-9/+=]+[\\r\\n]+)+" + "-----END RSA PRIVATE KEY-----[\\r\\n]*"); // Read keypair from PEM KeyPair readPair; try (var in = new StringReader(pem)) { readPair = KeyPairUtils.readKeyPair(in); } // Verify that both keypairs are the same assertThat(pair).isNotSameAs(readPair); assertThat(pair.getPublic().getEncoded()).isEqualTo(readPair.getPublic().getEncoded()); assertThat(pair.getPrivate().getEncoded()).isEqualTo(readPair.getPrivate().getEncoded()); } /** * Test that ECDSA keypairs are generated. */ @Test public void testCreateECCKeyPair() { var pair = KeyPairUtils.createECKeyPair(EC_CURVE); assertThat(pair).isNotNull(); assertThat(pair.getPublic()).isInstanceOf(ECPublicKey.class); } /** * Test that reading and writing ECDSA keypairs work correctly. */ @Test public void testWriteAndReadEC() throws IOException { // Generate a test keypair var pair = KeyPairUtils.createECKeyPair(EC_CURVE); // Write keypair to PEM String pem; try (var out = new StringWriter()) { KeyPairUtils.writeKeyPair(pair, out); pem = out.toString(); } // Make sure PEM file is properly formatted assertThat(pem).matches( "-----BEGIN EC PRIVATE KEY-----[\\r\\n]+" + "([a-zA-Z0-9/+=]+[\\r\\n]+)+" + "-----END EC PRIVATE KEY-----[\\r\\n]*"); // Read keypair from PEM KeyPair readPair; try (var in = new StringReader(pem)) { readPair = KeyPairUtils.readKeyPair(in); } // Verify that both keypairs are the same assertThat(pair).isNotSameAs(readPair); assertThat(pair.getPublic().getEncoded()).isEqualTo(readPair.getPublic().getEncoded()); assertThat(pair.getPrivate().getEncoded()).isEqualTo(readPair.getPrivate().getEncoded()); // Write Public Key String publicPem; try (var out = new StringWriter()) { KeyPairUtils.writePublicKey(pair.getPublic(), out); publicPem = out.toString(); } // Make sure PEM file is properly formatted assertThat(publicPem).matches( "-----BEGIN PUBLIC KEY-----[\\r\\n]+" + "([a-zA-Z0-9/+=]+[\\r\\n]+)+" + "-----END PUBLIC KEY-----[\\r\\n]*"); } /** * Test that constructor is private. */ @Test public void testPrivateConstructor() throws Exception { var constructor = KeyPairUtils.class.getDeclaredConstructor(); assertThat(Modifier.isPrivate(constructor.getModifiers())).isTrue(); constructor.setAccessible(true); constructor.newInstance(); } } ================================================ FILE: acme4j-client/src/test/resources/.gitignore ================================================ ================================================ FILE: acme4j-client/src/test/resources/META-INF/services/org.shredzone.acme4j.provider.AcmeProvider ================================================ # Testing org.shredzone.acme4j.connector.SessionProviderTest$Provider1 # Testing2 org.shredzone.acme4j.connector.SessionProviderTest$Provider2 ================================================ FILE: acme4j-client/src/test/resources/ari-example-cert.pem ================================================ -----BEGIN CERTIFICATE----- MIIBQzCB66ADAgECAgUAh2VDITAKBggqhkjOPQQDAjAVMRMwEQYDVQQDEwpFeGFt cGxlIENBMCIYDzAwMDEwMTAxMDAwMDAwWhgPMDAwMTAxMDEwMDAwMDBaMBYxFDAS BgNVBAMTC2V4YW1wbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeBZu 7cbpAYNXZLbbh8rNIzuOoqOOtmxA1v7cRm//AwyMwWxyHz4zfwmBhcSrf47NUAFf qzLQ2PPQxdTXREYEnKMjMCEwHwYDVR0jBBgwFoAUaYhba4dGQEHhs3uEe6CuLN4B yNQwCgYIKoZIzj0EAwIDRwAwRAIge09+S5TZAlw5tgtiVvuERV6cT4mfutXIlwTb +FYN/8oCIClDsqBklhB9KAelFiYt9+6FDj3z4KGVelYM5MdsO3pK -----END CERTIFICATE----- ================================================ FILE: acme4j-client/src/test/resources/cert.pem ================================================ -----BEGIN CERTIFICATE----- MIIDFzCCAf+gAwIBAgIIYZRPVr9ji5UwDQYJKoZIhvcNAQELBQAwKDEmMCQGA1UE AxMdUGViYmxlIEludGVybWVkaWF0ZSBDQSA2NDVmYzUwHhcNMTcwNDI2MTE0NDEz WhcNMjIwNDI2MTE0NDEzWjAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTCCASIwDQYJ KoZIhvcNAQEBBQADggEPADCCAQoCggEBANCRYYYLLZxJeoJKOcSwe+VpwUR/vehv x1dMy1fZoK3UX9sDcc5kRKxQJ7vog7q6XG4vA4fGcrGAfG6AeuwplWq3kb3UzYeq JeESeoRG0QhWVwCtIUPPVjHaPS19jP1xaE0vsfzCP3gD4l6W9ZhYlIqirFHEFgK8 aKtMxFsmEVR2cDOyH9S5Eoe7QAY43mcflSV6+BzULRwvtT6ds+0Upf0UMbzp0z8V dx017MoZdDMAumTaQt8MuIbwxcmRBrZp3pltF3mjGvtBMmuEUoqkiLWtCzhiH2pq 4T9LDBbilZmjgCWB9pLcqe+KxsdgmBSwPVB/3yhvDaAX0ZuvafjEF68CAwEAAaNX MFUwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD AjAMBgNVHRMBAf8EAjAAMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3 DQEBCwUAA4IBAQAtZKzESSFF9wVUQdjSe+2P+0OFR7vvfnABs0p1fRv3n17OEgwq iZEui8aUVkY/mzH90rnL25iIUt+7v4PUUIa7NgZ5adxNvnMvTpuQyFYSwfJODFHZ TZnJQJikvmxa0hIoH+zV0s3Pe3OctNeBEMAu2Tq4KsZZY4hF3c7G0Uwe7vmmffgH tixADkbOKwqZm1fBzRx6CUjz3u+rmGa4b30unRuF81YI4jqyeOJGNezSYsvLPdIn p+ISa9mbQvI09bZY/zis0uMGVFcNwKLX3X95xxMONdX7VUsEBq1rFz4ec7priCoi aEPAD7lAq7FFB1HHwVkPovtYQq7IKXS5VXr4 -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDFDCCAfygAwIBAgIIZF/FmWNLATcwDQYJKoZIhvcNAQELBQAwKDEmMCQGA1UE AxMdUGViYmxlIEludGVybWVkaWF0ZSBDQSA2NDVmYzUwHhcNMTcwNDI2MTE0MzE4 WhcNNDcwNDI2MTE0MzE4WjAoMSYwJAYDVQQDEx1QZWJibGUgSW50ZXJtZWRpYXRl IENBIDY0NWZjNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMKU292V U2wr0+8ZyFGZEEziJrqpNPyWPOZtPhjKQt2H8JeAuAnxBDSUjy8h88NKy/wakzIv v+sYWdfpdezg1Ba331KyN31HWX7AMij35cTBQEx+1rzi+9v2S7woGe2UCuSv6cdz nJaS0/NOvdDoPSGPctFwOBsCsgx6gr9m5ItanLXMCb8ToKVcUj6GOus0vpB3NNRb m8sial/o7Sd4cw52riov1mIkR7Pbi6iACGd/KhFxpKAXQ1UMPTd4tZYGU8pCfyiB 0rddSmwhh8eWU5ONShLzHi1aDjiu4NEpRxp8K4Tf0MealIJpyjQf5NV8Dz+QG7aX DSoH0n+1tGMdMI8CAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQWMBQG CCsGAQUFBwMBBggrBgEFBQcDAjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB CwUAA4IBAQBwOTlS9hOo1RhD2/DgBYZl+gYhqjuBedDJfPS3K34n4Z1FVVG+F6IL zP5CGTIABI3L3Ri1pfgUh2lU5nWfE95gUCnmJf8UA0dp0roJInQ25ux/nKFwcuA/ JL58QZ43TZ/T3BNm8aF/lPvkEut0HnCct1B5IYOzFhqmYS6+BtsiJ2qWxhjiP/yc CXq3U289glMeSo7mz6FaUEinx6CZL6qHe5Ins/hMo57Jjay32RHjOeFmx+IlCA0o 6kXvrZJy1QUpiUkkV7vbnt/PvQLvKo43YR/MsvuYEiOcPoyt7b7FmZ5VXtCnKBcf 6BcViMAeJ6QzC1qJI6HlWIoqzsO6SKuu -----END CERTIFICATE----- ================================================ FILE: acme4j-client/src/test/resources/certid-cert.pem ================================================ -----BEGIN CERTIFICATE----- MIIBQzCB66ADAgECAgUAh2VDITAKBggqhkjOPQQDAjAVMRMwEQYDVQQDEwpFeGFt cGxlIENBMCIYDzAwMDEwMTAxMDAwMDAwWhgPMDAwMTAxMDEwMDAwMDBaMBYxFDAS BgNVBAMTC2V4YW1wbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeBZu 7cbpAYNXZLbbh8rNIzuOoqOOtmxA1v7cRm//AwyMwWxyHz4zfwmBhcSrf47NUAFf qzLQ2PPQxdTXREYEnKMjMCEwHwYDVR0jBBgwFoAUaYhba4dGQEHhs3uEe6CuLN4B yNQwCgYIKoZIzj0EAwIDRwAwRAIge09+S5TZAlw5tgtiVvuERV6cT4mfutXIlwTb +FYN/8oCIClDsqBklhB9KAelFiYt9+6FDj3z4KGVelYM5MdsO3pK -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDSzCCAjOgAwIBAgIIOhNWtJ7Igr0wDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE AxMVbWluaWNhIHJvb3QgY2EgM2ExMzU2MCAXDTIyMDMxNzE3NTEwOVoYDzIxMjIw MzE3MTc1MTA5WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSAzYTEzNTYwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc3P6cxcCZ7FQOQrYuigReSa8T IOPNKmlmX9OrTkPwjThiMNEETYKO1ea99yXPK36LUHC6OLmZ9jVQW2Ny1qwQCOy6 TrquhnwKgtkBMDAZBLySSEXYdKL3r0jA4sflW130/OLwhstU/yv0J8+pj7eSVOR3 zJBnYd1AqnXHRSwQm299KXgqema7uwsa8cgjrXsBzAhrwrvYlVhpWFSv3lQRDFQg c5Z/ZDV9i26qiaJsCCmdisJZWN7N2luUgxdRqzZ4Cr2Xoilg3T+hkb2y/d6ttsPA kaSA+pq3q6Qa7/qfGdT5WuUkcHpvKNRWqnwT9rCYlmG00r3hGgc42D/z1VvfAgMB AAGjgYYwgYMwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr BgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQ4zzDRUaXHVKql STWkULGU4zGZpTAfBgNVHSMEGDAWgBQ4zzDRUaXHVKqlSTWkULGU4zGZpTANBgkq hkiG9w0BAQsFAAOCAQEArbDHhEjGedjb/YjU80aFTPWOMRjgyfQaPPgyxwX6Dsid 1i2H1x4ud4ntz3sTZZxdQIrOqtlIWTWVCjpStwGxaC+38SdreiTTwy/nikXGa/6W ZyQRppR3agh/pl5LHVO6GsJz3YHa7wQhEhj3xsRwa9VrRXgHbLGbPOFVRTHPjaPg Gtsv2PN3f67DsPHF47ASqyOIRpLZPQmZIw6D3isJwfl+8CzvlB1veO0Q3uh08IJc fspYQXvFBzYa64uKxNAJMi4Pby8cf4r36Wnb7cL4ho3fOHgAltxdW8jgibRzqZpQ QKyxn2jX7kxeUDt0hFDJE8lOrhP73m66eBNzxe//FQ== -----END CERTIFICATE----- ================================================ FILE: acme4j-client/src/test/resources/json/authorizationChallenges.json ================================================ { "challenges": [ { "type": "http-01", "url": "https://example.com/authz/asdf/0", "token": "IlirfxKKXAsHtmzK29Pj8A" }, { "type": "dns-01", "url": "https://example.com/authz/asdf/1", "token": "DGyRejmCefe7v4NfDGDKfA" }, { "type": "tls-alpn-01", "url": "https://example.com/authz/asdf/1", "token": "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA" }, { "type": "duplicate-01", "url": "https://example.com/authz/asdf/3" }, { "type": "duplicate-01", "url": "https://example.com/authz/asdf/4" } ] } ================================================ FILE: acme4j-client/src/test/resources/json/canceledOrderResponse.json ================================================ { "status": "canceled" } ================================================ FILE: acme4j-client/src/test/resources/json/datatypes.json ================================================ { "text": "lorem ipsum", "number": 123, "boolean": true, "uri": "mailto:foo@example.com", "url": "http://example.com", "date": "2016-01-08T00:00:00Z", "array": ["foo", 987, [1, 2, 3], {"test": "ok"}], "collect": ["foo", "bar", "barfoo"], "status": "VALID", "binary": "Q2hhaW5zYXc", "duration": 86400, "problem": { "type": "urn:ietf:params:acme:error:rateLimited", "detail": "too many requests", "instance": "/documents/errors.html" }, "encoded": "eyJrZXkiOiJ2YWx1ZSJ9" } ================================================ FILE: acme4j-client/src/test/resources/json/deactivateAccountResponse.json ================================================ { "status": "deactivated" } ================================================ FILE: acme4j-client/src/test/resources/json/directory.json ================================================ { "newNonce": "https://example.com/acme/new-nonce", "newAccount": "https://example.com/acme/new-account", "newOrder": "https://example.com/acme/new-order", "newAuthz": "https://example.com/acme/new-authz", "renewalInfo": "https://example.com/acme/renewal-info", "meta": { "termsOfService": "https://example.com/acme/terms", "website": "https://www.example.com/", "caaIdentities": [ "example.com" ], "auto-renewal": { "min-lifetime": 86400, "max-duration": 31536000, "allow-certificate-get": true }, "externalAccountRequired": true, "subdomainAuthAllowed": true, "xTestString": "foobar", "xTestUri": "https://www.example.org", "xTestArray": [ "foo", "bar", "barfoo" ], "profiles": { "classic": "The profile you're accustomed to", "custom": "Some other profile" } } } ================================================ FILE: acme4j-client/src/test/resources/json/directoryNoMeta.json ================================================ { "newAccount": "https://example.com/acme/new-account", "newAuthz": "https://example.com/acme/new-authz", "newOrder": "https://example.com/acme/new-order" } ================================================ FILE: acme4j-client/src/test/resources/json/dns01Challenge.json ================================================ { "type": "dns-01", "url": "https://example.com/acme/authz/0", "status": "pending", "token": "pNvmJivs0WCko2suV7fhe-59oFqyYx_yB7tx6kIMAyE" } ================================================ FILE: acme4j-client/src/test/resources/json/dnsAccount01Challenge.json ================================================ { "type": "dns-account-01", "url": "https://example.com/acme/chall/i00MGYwLWIx", "status": "pending", "token": "ODE4OWY4NTktYjhmYS00YmY1LTk5MDgtZTFjYTZmNjZlYTUx" } ================================================ FILE: acme4j-client/src/test/resources/json/dnsPersist01Challenge.json ================================================ { "type": "dns-persist-01", "url": "https://ca.example/acme/authz/1234/0", "status": "pending", "accounturi": "https://example.com/acme/account/1", "issuer-domain-names": ["authority.example", "ca.example.net"] } ================================================ FILE: acme4j-client/src/test/resources/json/finalizeAutoRenewResponse.json ================================================ { "status": "valid", "expires": "2015-03-01T14:09:00Z", "identifiers": [ { "type": "dns", "value": "example.com" }, { "type": "dns", "value": "www.example.com" } ], "auto-renewal": { "start-date": "2018-01-01T00:00:00Z", "end-date": "2019-01-01T00:00:00Z", "lifetime": 604800, "lifetime-adjust": 518400, "allow-certificate-get": true }, "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize", "star-certificate": "https://example.com/acme/cert/1234" } ================================================ FILE: acme4j-client/src/test/resources/json/finalizeRequest.json ================================================ { "csr": "MIIChDCCAWwCAQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPemmumcNGR0hsPo-2N6nkJ0FcEMdb0_MlucHR0dNeHEvn8vmcQHlYRjkDVX0aypnfKQI3tvhTBKLdlNvbVIW1TQ_Wbqh9TQlC8G3Hog8nRQ2vAzO4sH6nhvdrAFUmq6hkATpU3iQuDvtYu03ExaYHKsItLocl1OndaQizBn5udBv1baOW3Kd790k6lEWGrD-TXo6uwuMha2k_YBGNKd4S4UuPmbPV9SUVW8JSylBSgDhvY3BHv-dfdIMhVwRMZDFaa0mHDIYUiwcEaU5x4P6Q5bGP2wxcUPCLwFsbAK5K6B2T2P3A2fNjGBAlHwEkg6VMvi7jax8MD-oRnku2M2JLAgMBAAGgKTAnBgkqhkiG9w0BCQ4xGjAYMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQACnMZdjE1jVqnkHkEeGrMXujWuwuiKLZVa4YZ9fL0UIGOqqf4b9-3JmtEiLB9ycQO5N9rW4V-6_DBMeoeRBLu-wranHnxU4ds6GzNzBxKfI86_8t5pdQK4Cglv7yfseseZRdQtvcR2ejkW0F3SL1DF5Sk3T46aRYiUXxeoNC4Uh3zoIHOv8YGUa-DuZQ6OnHMhPrdsfU09L7KVAMTq1bodjGWmgoIJm4x5JSm19GbhYAm9Q9XWnN56YHqgS3FtS9n3wDxz7Dvo24whto1tUU5hnjrp31rTvyxG3kydoEZf2Ciq_82bQDb40kwnoO6RytPYJVMRIBsP2mCfaFtIt9Eb" } ================================================ FILE: acme4j-client/src/test/resources/json/finalizeResponse.json ================================================ { "status": "valid", "expires": "2015-03-01T14:09:00Z", "identifiers": [ { "type": "dns", "value": "example.com" }, { "type": "dns", "value": "www.example.com" } ], "notBefore": "2016-01-01T00:00:00Z", "notAfter": "2016-01-08T00:00:00Z", "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize", "certificate": "https://example.com/acme/cert/1234" } ================================================ FILE: acme4j-client/src/test/resources/json/genericChallenge.json ================================================ { "type": "generic-01", "status": "invalid", "url": "http://example.com/challenge/123", "validated": "2015-12-12T17:19:36.336785823Z", "error": { "type": "urn:ietf:params:acme:error:incorrectResponse", "detail": "bad token", "instance": "/documents/faq.html" } } ================================================ FILE: acme4j-client/src/test/resources/json/httpChallenge.json ================================================ { "type": "http-01", "url": "https://example.com/acme/authz/0", "status": "pending", "token": "rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ" } ================================================ FILE: acme4j-client/src/test/resources/json/httpNoTokenChallenge.json ================================================ { "type": "http-01", "url": "https://example.com/acme/authz/0", "status": "pending" } ================================================ FILE: acme4j-client/src/test/resources/json/modifyAccount.json ================================================ { "contact": [ "mailto:foo@example.com", "mailto:foo2@example.com", "mailto:foo3@example.com" ] } ================================================ FILE: acme4j-client/src/test/resources/json/modifyAccountResponse.json ================================================ { "termsOfServiceAgreed": true, "contact": [ "mailto:foo@example.com", "mailto:foo2@example.com", "mailto:foo3@example.com" ] } ================================================ FILE: acme4j-client/src/test/resources/json/newAccount.json ================================================ { "termsOfServiceAgreed": true, "contact": [ "mailto:foo@example.com" ] } ================================================ FILE: acme4j-client/src/test/resources/json/newAccountOnlyExisting.json ================================================ { "onlyReturnExisting": true } ================================================ FILE: acme4j-client/src/test/resources/json/newAccountResponse.json ================================================ { "status": "valid", "termsOfServiceAgreed": true, "contact": [ "mailto:foo@example.com" ], "orders": "https://example.com/acme/orders/rzGoeA" } ================================================ FILE: acme4j-client/src/test/resources/json/newAuthorizationRequest.json ================================================ { "identifier": { "type": "dns", "value": "example.org" } } ================================================ FILE: acme4j-client/src/test/resources/json/newAuthorizationRequestSub.json ================================================ { "identifier": { "type": "dns", "value": "example.org", "subdomainAuthAllowed": true } } ================================================ FILE: acme4j-client/src/test/resources/json/newAuthorizationResponse.json ================================================ { "status": "pending", "identifier": { "type": "dns", "value": "example.org" }, "challenges": [ { "type": "http-01", "status": "pending", "url": "https://example.com/authz/asdf/0", "token": "IlirfxKKXAsHtmzK29Pj8A" }, { "type": "dns-01", "status": "pending", "url": "https://example.com/authz/asdf/1", "token": "DGyRejmCefe7v4NfDGDKfA" } ] } ================================================ FILE: acme4j-client/src/test/resources/json/newAuthorizationResponseSub.json ================================================ { "status": "pending", "identifier": { "type": "dns", "value": "example.org" }, "challenges": [ { "type": "dns-01", "status": "pending", "url": "https://example.com/authz/asdf/1", "token": "DGyRejmCefe7v4NfDGDKfA" } ], "subdomainAuthAllowed": true } ================================================ FILE: acme4j-client/src/test/resources/json/problem.json ================================================ { "type": "urn:ietf:params:acme:error:malformed", "title": "Some of the identifiers requested were rejected", "detail": "Identifier \"abc12_\" is malformed", "instance": "/documents/error.html", "subproblems": [ { "type": "urn:ietf:params:acme:error:malformed", "detail": "Invalid underscore in DNS name \"_example.com\"", "identifier": { "type": "dns", "value": "_example.com" } }, { "type": "urn:ietf:params:acme:error:rejectedIdentifier", "detail": "This CA will not issue for \"example.net\"", "identifier": { "type": "dns", "value": "example.net" } } ] } ================================================ FILE: acme4j-client/src/test/resources/json/renewalInfo.json ================================================ { "suggestedWindow": { "start": "2021-01-03T00:00:00Z", "end": "2021-01-07T00:00:00Z" }, "explanationURL": "https://example.com/docs/example-mass-reissuance-event" } ================================================ FILE: acme4j-client/src/test/resources/json/replacedCertificateRequest.json ================================================ { "certID": "MFswCwYJYIZIAWUDBAIBBCCeWLRusNLb--vmWOkxm34qDjTMWkc3utIhOMoMwKDqbgQg2iiKWySZrD-6c88HMZ6vhIHZPamChLlzGHeZ7pTS8jYCCD6jRWhlRB8c", "replaced": true } ================================================ FILE: acme4j-client/src/test/resources/json/requestAutoRenewOrderRequest.json ================================================ { "identifiers": [ { "type": "dns", "value": "example.org" } ], "auto-renewal": { "start-date": "2018-01-01T00:00:00Z", "end-date": "2019-01-01T00:00:00Z", "lifetime": 604800, "lifetime-adjust": 518400, "allow-certificate-get": true } } ================================================ FILE: acme4j-client/src/test/resources/json/requestAutoRenewOrderResponse.json ================================================ { "status": "pending", "expires": "2016-01-10T00:00:00Z", "identifiers": [ { "type": "dns", "value": "example.org" } ], "auto-renewal": { "start-date": "2018-01-01T00:00:00Z", "end-date": "2019-01-01T00:00:00Z", "lifetime": 604800, "lifetime-adjust": 518400, "allow-certificate-get": true }, "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize" } ================================================ FILE: acme4j-client/src/test/resources/json/requestCertificateRequest.json ================================================ { "csr": "MIIChDCCAWwCAQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPemmumcNGR0hsPo-2N6nkJ0FcEMdb0_MlucHR0dNeHEvn8vmcQHlYRjkDVX0aypnfKQI3tvhTBKLdlNvbVIW1TQ_Wbqh9TQlC8G3Hog8nRQ2vAzO4sH6nhvdrAFUmq6hkATpU3iQuDvtYu03ExaYHKsItLocl1OndaQizBn5udBv1baOW3Kd790k6lEWGrD-TXo6uwuMha2k_YBGNKd4S4UuPmbPV9SUVW8JSylBSgDhvY3BHv-dfdIMhVwRMZDFaa0mHDIYUiwcEaU5x4P6Q5bGP2wxcUPCLwFsbAK5K6B2T2P3A2fNjGBAlHwEkg6VMvi7jax8MD-oRnku2M2JLAgMBAAGgKTAnBgkqhkiG9w0BCQ4xGjAYMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQACnMZdjE1jVqnkHkEeGrMXujWuwuiKLZVa4YZ9fL0UIGOqqf4b9-3JmtEiLB9ycQO5N9rW4V-6_DBMeoeRBLu-wranHnxU4ds6GzNzBxKfI86_8t5pdQK4Cglv7yfseseZRdQtvcR2ejkW0F3SL1DF5Sk3T46aRYiUXxeoNC4Uh3zoIHOv8YGUa-DuZQ6OnHMhPrdsfU09L7KVAMTq1bodjGWmgoIJm4x5JSm19GbhYAm9Q9XWnN56YHqgS3FtS9n3wDxz7Dvo24whto1tUU5hnjrp31rTvyxG3kydoEZf2Ciq_82bQDb40kwnoO6RytPYJVMRIBsP2mCfaFtIt9Eb" } ================================================ FILE: acme4j-client/src/test/resources/json/requestCertificateRequestWithDate.json ================================================ { "csr": "MIIChDCCAWwCAQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCPemmumcNGR0hsPo-2N6nkJ0FcEMdb0_MlucHR0dNeHEvn8vmcQHlYRjkDVX0aypnfKQI3tvhTBKLdlNvbVIW1TQ_Wbqh9TQlC8G3Hog8nRQ2vAzO4sH6nhvdrAFUmq6hkATpU3iQuDvtYu03ExaYHKsItLocl1OndaQizBn5udBv1baOW3Kd790k6lEWGrD-TXo6uwuMha2k_YBGNKd4S4UuPmbPV9SUVW8JSylBSgDhvY3BHv-dfdIMhVwRMZDFaa0mHDIYUiwcEaU5x4P6Q5bGP2wxcUPCLwFsbAK5K6B2T2P3A2fNjGBAlHwEkg6VMvi7jax8MD-oRnku2M2JLAgMBAAGgKTAnBgkqhkiG9w0BCQ4xGjAYMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQACnMZdjE1jVqnkHkEeGrMXujWuwuiKLZVa4YZ9fL0UIGOqqf4b9-3JmtEiLB9ycQO5N9rW4V-6_DBMeoeRBLu-wranHnxU4ds6GzNzBxKfI86_8t5pdQK4Cglv7yfseseZRdQtvcR2ejkW0F3SL1DF5Sk3T46aRYiUXxeoNC4Uh3zoIHOv8YGUa-DuZQ6OnHMhPrdsfU09L7KVAMTq1bodjGWmgoIJm4x5JSm19GbhYAm9Q9XWnN56YHqgS3FtS9n3wDxz7Dvo24whto1tUU5hnjrp31rTvyxG3kydoEZf2Ciq_82bQDb40kwnoO6RytPYJVMRIBsP2mCfaFtIt9Eb", "notBefore": "2016-01-01T00:00:00Z", "notAfter": "2016-01-08T00:00:00Z" } ================================================ FILE: acme4j-client/src/test/resources/json/requestOrderRequest.json ================================================ { "identifiers": [ { "type": "dns", "value": "example.com" }, { "type": "dns", "value": "www.example.com" }, { "type": "dns", "value": "example.org" }, { "type": "dns", "value": "m.example.com" }, { "type": "dns", "value": "m.example.org" }, { "type": "dns", "value": "d.example.com" }, { "type": "dns", "value": "d2.example.com" }, { "type": "ip", "value": "192.0.2.2" } ], "notBefore": "2016-01-01T00:00:00Z", "notAfter": "2016-01-08T00:00:00Z" } ================================================ FILE: acme4j-client/src/test/resources/json/requestOrderRequestSub.json ================================================ { "identifiers": [ { "type": "dns", "value": "foo.bar.example.com", "ancestorDomain": "example.com" }, ], "notBefore": "2016-01-01T00:00:00Z", "notAfter": "2016-01-08T00:00:00Z" } ================================================ FILE: acme4j-client/src/test/resources/json/requestOrderResponse.json ================================================ { "status": "pending", "expires": "2016-01-10T00:00:00Z", "identifiers": [ { "type": "dns", "value": "example.com" }, { "type": "dns", "value": "www.example.com" }, { "type": "dns", "value": "example.org" }, { "type": "dns", "value": "m.example.com" }, { "type": "dns", "value": "m.example.org" }, { "type": "dns", "value": "d.example.com" }, { "type": "dns", "value": "d2.example.com" }, { "type": "ip", "value": "192.0.2.2" } ], "notBefore": "2016-01-01T00:10:00Z", "notAfter": "2016-01-08T00:10:00Z", "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize" } ================================================ FILE: acme4j-client/src/test/resources/json/requestOrderResponseSub.json ================================================ { "status": "pending", "expires": "2016-01-10T00:00:00Z", "identifiers": [ { "type": "dns", "value": "foo.bar.example.com" } ], "notBefore": "2016-01-01T00:10:00Z", "notAfter": "2016-01-08T00:10:00Z", "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize" } ================================================ FILE: acme4j-client/src/test/resources/json/requestProfileOrderRequest.json ================================================ { "identifiers": [ { "type": "dns", "value": "example.org" } ], "profile": "classic" } ================================================ FILE: acme4j-client/src/test/resources/json/requestProfileOrderResponse.json ================================================ { "status": "pending", "expires": "2016-01-10T00:00:00Z", "identifiers": [ { "type": "dns", "value": "example.org" } ], "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize", "profile": "classic" } ================================================ FILE: acme4j-client/src/test/resources/json/requestReplacesRequest.json ================================================ { "identifiers": [ { "type": "dns", "value": "example.org" } ], "replaces": "aYhba4dGQEHhs3uEe6CuLN4ByNQ.AIdlQyE" } ================================================ FILE: acme4j-client/src/test/resources/json/requestReplacesResponse.json ================================================ { "status": "pending", "expires": "2016-01-10T00:00:00Z", "identifiers": [ { "type": "dns", "value": "example.org" } ], "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize" } ================================================ FILE: acme4j-client/src/test/resources/json/revokeCertificateRequest.json ================================================ { "certificate": "MIIDFzCCAf-gAwIBAgIIYZRPVr9ji5UwDQYJKoZIhvcNAQELBQAwKDEmMCQGA1UEAxMdUGViYmxlIEludGVybWVkaWF0ZSBDQSA2NDVmYzUwHhcNMTcwNDI2MTE0NDEzWhcNMjIwNDI2MTE0NDEzWjAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANCRYYYLLZxJeoJKOcSwe-VpwUR_vehvx1dMy1fZoK3UX9sDcc5kRKxQJ7vog7q6XG4vA4fGcrGAfG6AeuwplWq3kb3UzYeqJeESeoRG0QhWVwCtIUPPVjHaPS19jP1xaE0vsfzCP3gD4l6W9ZhYlIqirFHEFgK8aKtMxFsmEVR2cDOyH9S5Eoe7QAY43mcflSV6-BzULRwvtT6ds-0Upf0UMbzp0z8Vdx017MoZdDMAumTaQt8MuIbwxcmRBrZp3pltF3mjGvtBMmuEUoqkiLWtCzhiH2pq4T9LDBbilZmjgCWB9pLcqe-KxsdgmBSwPVB_3yhvDaAX0ZuvafjEF68CAwEAAaNXMFUwDgYDVR0PAQH_BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAtZKzESSFF9wVUQdjSe-2P-0OFR7vvfnABs0p1fRv3n17OEgwqiZEui8aUVkY_mzH90rnL25iIUt-7v4PUUIa7NgZ5adxNvnMvTpuQyFYSwfJODFHZTZnJQJikvmxa0hIoH-zV0s3Pe3OctNeBEMAu2Tq4KsZZY4hF3c7G0Uwe7vmmffgHtixADkbOKwqZm1fBzRx6CUjz3u-rmGa4b30unRuF81YI4jqyeOJGNezSYsvLPdInp-ISa9mbQvI09bZY_zis0uMGVFcNwKLX3X95xxMONdX7VUsEBq1rFz4ec7priCoiaEPAD7lAq7FFB1HHwVkPovtYQq7IKXS5VXr4" } ================================================ FILE: acme4j-client/src/test/resources/json/revokeCertificateWithReasonRequest.json ================================================ { "certificate": "MIIDFzCCAf-gAwIBAgIIYZRPVr9ji5UwDQYJKoZIhvcNAQELBQAwKDEmMCQGA1UEAxMdUGViYmxlIEludGVybWVkaWF0ZSBDQSA2NDVmYzUwHhcNMTcwNDI2MTE0NDEzWhcNMjIwNDI2MTE0NDEzWjAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANCRYYYLLZxJeoJKOcSwe-VpwUR_vehvx1dMy1fZoK3UX9sDcc5kRKxQJ7vog7q6XG4vA4fGcrGAfG6AeuwplWq3kb3UzYeqJeESeoRG0QhWVwCtIUPPVjHaPS19jP1xaE0vsfzCP3gD4l6W9ZhYlIqirFHEFgK8aKtMxFsmEVR2cDOyH9S5Eoe7QAY43mcflSV6-BzULRwvtT6ds-0Upf0UMbzp0z8Vdx017MoZdDMAumTaQt8MuIbwxcmRBrZp3pltF3mjGvtBMmuEUoqkiLWtCzhiH2pq4T9LDBbilZmjgCWB9pLcqe-KxsdgmBSwPVB_3yhvDaAX0ZuvafjEF68CAwEAAaNXMFUwDgYDVR0PAQH_BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAtZKzESSFF9wVUQdjSe-2P-0OFR7vvfnABs0p1fRv3n17OEgwqiZEui8aUVkY_mzH90rnL25iIUt-7v4PUUIa7NgZ5adxNvnMvTpuQyFYSwfJODFHZTZnJQJikvmxa0hIoH-zV0s3Pe3OctNeBEMAu2Tq4KsZZY4hF3c7G0Uwe7vmmffgHtixADkbOKwqZm1fBzRx6CUjz3u-rmGa4b30unRuF81YI4jqyeOJGNezSYsvLPdInp-ISa9mbQvI09bZY_zis0uMGVFcNwKLX3X95xxMONdX7VUsEBq1rFz4ec7priCoiaEPAD7lAq7FFB1HHwVkPovtYQq7IKXS5VXr4", "reason": 1 } ================================================ FILE: acme4j-client/src/test/resources/json/tlsAlpnChallenge.json ================================================ { "type": "tls-alpn-01", "url": "https://example.com/acme/authz/0", "status": "pending", "token": "rSoI9JpyvFi-ltdnBW0W1DjKstzG7cHixjzcOjwzAEQ" } ================================================ FILE: acme4j-client/src/test/resources/json/triggerHttpChallenge.json ================================================ { "type": "http-01", "status": "pending", "url": "https://example.com/acme/some-location", "token": "IlirfxKKXAsHtmzK29Pj8A" } ================================================ FILE: acme4j-client/src/test/resources/json/triggerHttpChallengeRequest.json ================================================ { } ================================================ FILE: acme4j-client/src/test/resources/json/triggerHttpChallengeResponse.json ================================================ { "type": "http-01", "status": "pending", "url": "https://example.com/acme/some-location", "token": "IlirfxKKXAsHtmzK29Pj8A" } ================================================ FILE: acme4j-client/src/test/resources/json/updateAccount.json ================================================ {} ================================================ FILE: acme4j-client/src/test/resources/json/updateAccountResponse.json ================================================ { "status": "valid", "contact": [ "mailto:foo2@example.com" ], "termsOfServiceAgreed": true, "orders": "https://example.com/acme/acct/1/orders", "externalAccountBinding": { "protected": "eyJ1cmwiOiJodHRwOi8vZXhhbXBsZS5jb20vYWNtZS9yZXNvdXJjZSIsImtpZCI6Ik5DQy0xNzAxIiwiYWxnIjoiSFMyNTYifQ", "payload": "eyJrdHkiOiJSU0EiLCJuIjoicFpzVEtZNDF5X0N3Z0owVlg3Qm1tR3NfN1Vwcm1YUU1HUGNuU2JCZUpBalpIQTlTeXlKS2FXdjRmTlVkQklBWDNZMlFvWml4ajUwblFMeUx2Mm5nM3B2RW9STDBzeDlaSGdwNW5kQWpwSWlWUV84VjAxVFRZQ0VEVWM5aWk3YmpWa2dGQWI0VmFsWkdGSlo1NFBjQ25BSHZYaTVnMEVMT1J6R2NUdVJxSFZBVWNrTVYyb3RyMGcwdV81YldNbTZFTUFiQnJHUUNnVUdqYlpRSGphdmExWS01dEhYWmtQQmFoSjJMdktScU1tSlVscjBhbkt1Skp0SlVHMDNESllBeEFCdjhZQWFYRkJuR3c2a0tKUnBVRkFDNTVyeTRzcDRrR3kwTnJLMlRWV21aVzlrU3RuaVJ2NFJhSkdJOWFaR1l3UXkya1V5a2liQk5tV0VRVWxJd0l3IiwiZSI6IkFRQUIifQ", "signature": "skPdpjTgx8zIGsNRtvv4zNlfp-uidFDgCMY3Z3ONLgw" } } ================================================ FILE: acme4j-client/src/test/resources/json/updateAuthorizationResponse.json ================================================ { "status": "valid", "expires": "2016-01-02T17:12:40Z", "identifier": { "type": "dns", "value": "example.org" }, "challenges": [ { "type": "http-01", "status": "pending", "url": "https://example.com/authz/asdf/0", "token": "IlirfxKKXAsHtmzK29Pj8A" }, { "type": "dns-01", "status": "pending", "url": "https://example.com/authz/asdf/1", "token": "DGyRejmCefe7v4NfDGDKfA" }, { "type": "tls-alpn-01", "status": "pending", "url": "https://example.com/authz/asdf/2", "token": "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA" } ] } ================================================ FILE: acme4j-client/src/test/resources/json/updateAuthorizationWildcardResponse.json ================================================ { "status": "valid", "expires": "2016-01-02T17:12:40Z", "wildcard": true, "identifier": { "type": "dns", "value": "example.org" }, "challenges": [ { "type": "dns-01", "status": "pending", "url": "https://example.com/authz/asdf/1", "token": "DGyRejmCefe7v4NfDGDKfA" } ] } ================================================ FILE: acme4j-client/src/test/resources/json/updateAutoRenewOrderResponse.json ================================================ { "status": "valid", "auto-renewal": { "start-date": "2016-01-01T00:00:00Z", "end-date": "2017-01-01T00:00:00Z", "lifetime": 604800, "lifetime-adjust": 518400, "allow-certificate-get": true } } ================================================ FILE: acme4j-client/src/test/resources/json/updateHttpChallengeResponse.json ================================================ { "type": "http-01", "url": "https://example.com/acme/some-location", "status": "valid", "token": "IlirfxKKXAsHtmzK29Pj8A", "keyAuthorization": "XbmEGDDc2AMDArHLt5x7GxZfIRv0aScknUKlyf5S4KU.KMH_h8aGAKlY3VQqBUczm1cfo9kaovivy59rSY1xZ0E" } ================================================ FILE: acme4j-client/src/test/resources/json/updateOrderResponse.json ================================================ { "status": "pending", "expires": "2015-03-01T14:09:00Z", "identifiers": [ { "type": "dns", "value": "example.com" }, { "type": "dns", "value": "www.example.com" } ], "notBefore": "2016-01-01T00:00:00Z", "notAfter": "2016-01-08T00:00:00Z", "authorizations": [ "https://example.com/acme/authz/1234", "https://example.com/acme/authz/2345" ], "finalize": "https://example.com/acme/acct/1/order/1/finalize", "certificate": "https://example.com/acme/cert/1234", "error": { "type": "urn:ietf:params:acme:error:connection", "detail": "connection refused" } } ================================================ FILE: acme4j-client/src/test/resources/simplelogger.properties ================================================ org.slf4j.simpleLogger.log.org.shredzone.acme4j = debug ================================================ FILE: acme4j-example/.gitignore ================================================ *.key *.crt *.csr ================================================ FILE: acme4j-example/pom.xml ================================================ 4.0.0 org.shredzone.acme4j acme4j 5.1.1-SNAPSHOT acme4j-example acme4j Example Example for using acme4j true org.codehaus.mojo exec-maven-plugin 3.0.0 java org.shredzone.acme4j.example.ClientTest org.shredzone.acme4j acme4j-client ${project.version} org.slf4j slf4j-simple ${slf4j.version} runtime ================================================ FILE: acme4j-example/src/main/java/.gitignore ================================================ ================================================ FILE: acme4j-example/src/main/java/module-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ module org.shredzone.acme4j.example { requires org.shredzone.acme4j; requires java.desktop; requires org.bouncycastle.provider; requires org.slf4j; } ================================================ FILE: acme4j-example/src/main/java/org/shredzone/acme4j/example/ClientTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2015 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.example; import java.io.File; import java.io.FileReader; import java.io.FileWriter; import java.io.IOException; import java.net.URI; import java.net.URL; import java.security.KeyPair; import java.security.Security; import java.time.Duration; import java.util.Arrays; import java.util.Collection; import java.util.Optional; import java.util.function.Supplier; import javax.swing.JOptionPane; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.shredzone.acme4j.Account; import org.shredzone.acme4j.AccountBuilder; import org.shredzone.acme4j.Authorization; import org.shredzone.acme4j.Certificate; import org.shredzone.acme4j.Order; import org.shredzone.acme4j.Problem; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.util.KeyPairUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * A simple client test tool. *

* First check the configuration constants at the top of the class. Then run the class, * and pass in the names of the domains as parameters. *

* The tool won't run as-is. You MUST change the {@link #CA_URI} constant and set the * connection URI of your target CA there. *

* If your CA requires External Account Binding (EAB), you MUST also fill the * {@link #EAB_KID} and {@link #EAB_HMAC} constants with the values provided by your CA. *

* If your CA requires an email field to be set in your account, you also need to set * {@link #ACCOUNT_EMAIL}. *

* All other fields are optional and should work with the default values, unless your CA * has special requirements (e.g. to the key type). * * @see This example, fully * explained in the documentation. */ public class ClientTest { // Set the Connection URI of your CA here. For testing purposes, use a staging // server if possible. Example: "acme://letsencrypt.org/staging" for the Let's // Encrypt staging server. private static final String CA_URI = "acme://example.com/staging"; // E-Mail address to be associated with the account. Optional, null if not used. private static final String ACCOUNT_EMAIL = null; // If the CA requires External Account Binding (EAB), set the provided KID and HMAC here. private static final String EAB_KID = null; private static final String EAB_HMAC = null; // A supplier for a new account KeyPair. The default creates a new EC key pair. private static final Supplier ACCOUNT_KEY_SUPPLIER = KeyPairUtils::createKeyPair; // A supplier for a new domain KeyPair. The default creates a RSA key pair. private static final Supplier DOMAIN_KEY_SUPPLIER = () -> KeyPairUtils.createKeyPair(4096); // File name of the User Key Pair private static final File USER_KEY_FILE = new File("user.key"); // File name of the Domain Key Pair private static final File DOMAIN_KEY_FILE = new File("domain.key"); // File name of the signed certificate private static final File DOMAIN_CHAIN_FILE = new File("domain-chain.crt"); //Challenge type to be used private static final ChallengeType CHALLENGE_TYPE = ChallengeType.HTTP; // Maximum time to wait until VALID/INVALID is expected private static final Duration TIMEOUT = Duration.ofSeconds(60L); private static final Logger LOG = LoggerFactory.getLogger(ClientTest.class); private enum ChallengeType {HTTP, DNS} /** * Generates a certificate for the given domains. Also takes care for the registration * process. * * @param domains * Domains to get a common certificate for */ public void fetchCertificate(Collection domains) throws IOException, AcmeException, InterruptedException { // Load the user key file. If there is no key file, create a new one. KeyPair userKeyPair = loadOrCreateUserKeyPair(); // Create a session. Session session = new Session(CA_URI); // Get the Account. // If there is no account yet, create a new one. Account acct = findOrRegisterAccount(session, userKeyPair); // Load or create a key pair for the domains. This should not be the userKeyPair! KeyPair domainKeyPair = loadOrCreateDomainKeyPair(); // Order the certificate Order order = acct.newOrder().domains(domains).create(); // Perform all required authorizations for (Authorization auth : order.getAuthorizations()) { authorize(auth); } // Wait for the order to become READY order.waitUntilReady(TIMEOUT); // Order the certificate order.execute(domainKeyPair); // Wait for the order to complete Status status = order.waitForCompletion(TIMEOUT); if (status != Status.VALID) { LOG.error("Order has failed, reason: {}", order.getError() .map(Problem::toString) .orElse("unknown")); throw new AcmeException("Order failed... Giving up."); } // Get the certificate Certificate certificate = order.getCertificate(); LOG.info("Success! The certificate for domains {} has been generated!", domains); LOG.info("Certificate URL: {}", certificate.getLocation()); // Write a combined file containing the certificate and chain. try (FileWriter fw = new FileWriter(DOMAIN_CHAIN_FILE)) { certificate.writeCertificate(fw); } // That's all! Configure your web server to use the DOMAIN_KEY_FILE and // DOMAIN_CHAIN_FILE for the requested domains. } /** * Loads a user key pair from {@link #USER_KEY_FILE}. If the file does not exist, a * new key pair is generated and saved. *

* Keep this key pair in a safe place! In a production environment, you will not be * able to access your account again if you should lose the key pair. * * @return User's {@link KeyPair}. */ private KeyPair loadOrCreateUserKeyPair() throws IOException { if (USER_KEY_FILE.exists()) { // If there is a key file, read it try (FileReader fr = new FileReader(USER_KEY_FILE)) { return KeyPairUtils.readKeyPair(fr); } } else { // If there is none, create a new key pair and save it KeyPair userKeyPair = ACCOUNT_KEY_SUPPLIER.get(); try (FileWriter fw = new FileWriter(USER_KEY_FILE)) { KeyPairUtils.writeKeyPair(userKeyPair, fw); } return userKeyPair; } } /** * Loads a domain key pair from {@link #DOMAIN_KEY_FILE}. If the file does not exist, * a new key pair is generated and saved. * * @return Domain {@link KeyPair}. */ private KeyPair loadOrCreateDomainKeyPair() throws IOException { if (DOMAIN_KEY_FILE.exists()) { try (FileReader fr = new FileReader(DOMAIN_KEY_FILE)) { return KeyPairUtils.readKeyPair(fr); } } else { KeyPair domainKeyPair = DOMAIN_KEY_SUPPLIER.get(); try (FileWriter fw = new FileWriter(DOMAIN_KEY_FILE)) { KeyPairUtils.writeKeyPair(domainKeyPair, fw); } return domainKeyPair; } } /** * Finds your {@link Account} at the ACME server. It will be found by your user's * public key. If your key is not known to the server yet, a new account will be * created. *

* This is a simple way of finding your {@link Account}. A better way is to get the * URL of your new account with {@link Account#getLocation()} and store it somewhere. * If you need to get access to your account later, reconnect to it via {@link * Session#login(URL, KeyPair)} by using the stored location. * * @param session * {@link Session} to bind with * @return {@link Account} */ private Account findOrRegisterAccount(Session session, KeyPair accountKey) throws AcmeException { // Ask the user to accept the TOS, if server provides us with a link. Optional tos = session.getMetadata().getTermsOfService(); if (tos.isPresent()) { acceptAgreement(tos.get()); } AccountBuilder accountBuilder = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(accountKey); // Set your email (if available) if (ACCOUNT_EMAIL != null) { accountBuilder.addEmail(ACCOUNT_EMAIL); } // Use the KID and HMAC if the CA uses External Account Binding if (EAB_KID != null && EAB_HMAC != null) { accountBuilder.withKeyIdentifier(EAB_KID, EAB_HMAC); } Account account = accountBuilder.create(session); LOG.info("Registered a new user, URL: {}", account.getLocation()); return account; } /** * Authorize a domain. It will be associated with your account, so you will be able to * retrieve a signed certificate for the domain later. * * @param auth * {@link Authorization} to perform */ private void authorize(Authorization auth) throws AcmeException, InterruptedException { LOG.info("Authorization for domain {}", auth.getIdentifier().getDomain()); // The authorization is already valid. No need to process a challenge. if (auth.getStatus() == Status.VALID) { return; } // Find the desired challenge and prepare it. Challenge challenge = switch (CHALLENGE_TYPE) { case HTTP -> httpChallenge(auth); case DNS -> dnsChallenge(auth); }; if (challenge == null) { throw new AcmeException("No challenge found"); } // If the challenge is already verified, there's no need to execute it again. if (challenge.getStatus() == Status.VALID) { return; } // Now trigger the challenge. challenge.trigger(); // Poll for the challenge to complete. Status status = challenge.waitForCompletion(TIMEOUT); if (status != Status.VALID) { LOG.error("Challenge has failed, reason: {}", challenge.getError() .map(Problem::toString) .orElse("unknown")); throw new AcmeException("Challenge failed... Giving up."); } LOG.info("Challenge has been completed. Remember to remove the validation resource."); completeChallenge("Challenge has been completed.\nYou can remove the resource again now."); } /** * Prepares a HTTP challenge. *

* The verification of this challenge expects a file with a certain content to be * reachable at a given path under the domain to be tested. *

* This example outputs instructions that need to be executed manually. In a * production environment, you would rather generate this file automatically, or maybe * use a servlet that returns {@link Http01Challenge#getAuthorization()}. * * @param auth * {@link Authorization} to find the challenge in * @return {@link Challenge} to verify */ public Challenge httpChallenge(Authorization auth) throws AcmeException { // Find a single http-01 challenge Http01Challenge challenge = auth.findChallenge(Http01Challenge.class) .orElseThrow(() -> new AcmeException("Found no " + Http01Challenge.TYPE + " challenge, don't know what to do...")); // Output the challenge, wait for acknowledge... LOG.info("Please create a file in your web server's base directory."); LOG.info("It must be reachable at: http://{}/.well-known/acme-challenge/{}", auth.getIdentifier().getDomain(), challenge.getToken()); LOG.info("File name: {}", challenge.getToken()); LOG.info("Content: {}", challenge.getAuthorization()); LOG.info("The file must not contain any leading or trailing whitespaces or line breaks!"); LOG.info("If you're ready, dismiss the dialog..."); StringBuilder message = new StringBuilder(); message.append("Please create a file in your web server's base directory.\n\n"); message.append("http://") .append(auth.getIdentifier().getDomain()) .append("/.well-known/acme-challenge/") .append(challenge.getToken()) .append("\n\n"); message.append("Content:\n\n"); message.append(challenge.getAuthorization()); acceptChallenge(message.toString()); return challenge; } /** * Prepares a DNS challenge. *

* The verification of this challenge expects a TXT record with a certain content. *

* This example outputs instructions that need to be executed manually. In a * production environment, you would rather configure your DNS automatically. * * @param auth * {@link Authorization} to find the challenge in * @return {@link Challenge} to verify */ public Challenge dnsChallenge(Authorization auth) throws AcmeException { // Find a single dns-01 challenge Dns01Challenge challenge = auth.findChallenge(Dns01Challenge.TYPE) .map(Dns01Challenge.class::cast) .orElseThrow(() -> new AcmeException("Found no " + Dns01Challenge.TYPE + " challenge, don't know what to do...")); // Output the challenge, wait for acknowledge... LOG.info("Please create a TXT record:"); LOG.info("{} IN TXT {}", challenge.getRRName(auth.getIdentifier()), challenge.getDigest()); LOG.info("If you're ready, dismiss the dialog..."); StringBuilder message = new StringBuilder(); message.append("Please create a TXT record:\n\n"); message.append(challenge.getRRName(auth.getIdentifier())) .append(" IN TXT ") .append(challenge.getDigest()); acceptChallenge(message.toString()); return challenge; } /** * Presents the instructions for preparing the challenge validation, and waits for * dismissal. If the user cancelled the dialog, an exception is thrown. * * @param message * Instructions to be shown in the dialog */ public void acceptChallenge(String message) throws AcmeException { int option = JOptionPane.showConfirmDialog(null, message, "Prepare Challenge", JOptionPane.OK_CANCEL_OPTION); if (option == JOptionPane.CANCEL_OPTION) { throw new AcmeException("User cancelled the challenge"); } } /** * Presents the instructions for removing the challenge validation, and waits for * dismissal. * * @param message * Instructions to be shown in the dialog */ public void completeChallenge(String message) { JOptionPane.showMessageDialog(null, message, "Complete Challenge", JOptionPane.INFORMATION_MESSAGE); } /** * Presents the user a link to the Terms of Service, and asks for confirmation. If the * user denies confirmation, an exception is thrown. * * @param agreement * {@link URI} of the Terms of Service */ public void acceptAgreement(URI agreement) throws AcmeException { int option = JOptionPane.showConfirmDialog(null, "Do you accept the Terms of Service?\n\n" + agreement, "Accept ToS", JOptionPane.YES_NO_OPTION); if (option == JOptionPane.NO_OPTION) { throw new AcmeException("User did not accept Terms of Service"); } } /** * Invokes this example. * * @param args * Domains to get a certificate for */ public static void main(String... args) { if (args.length == 0) { System.err.println("Usage: ClientTest ..."); System.exit(1); } LOG.info("Starting up..."); Security.addProvider(new BouncyCastleProvider()); Collection domains = Arrays.asList(args); try { ClientTest ct = new ClientTest(); ct.fetchCertificate(domains); } catch (Exception ex) { LOG.error("Failed to get a certificate for domains " + domains, ex); } } } ================================================ FILE: acme4j-example/src/main/resources/.gitignore ================================================ ================================================ FILE: acme4j-example/src/main/resources/simplelogger.properties ================================================ org.slf4j.simpleLogger.log.org.shredzone.acme4j = debug ================================================ FILE: acme4j-example/src/test/java/.gitignore ================================================ ================================================ FILE: acme4j-example/src/test/resources/.gitignore ================================================ ================================================ FILE: acme4j-it/pom.xml ================================================ 4.0.0 org.shredzone.acme4j acme4j 5.1.1-SNAPSHOT acme4j-it acme4j IT acme4j Integration Tests latest true ci false org.apache.maven.plugins maven-failsafe-plugin org/shredzone/acme4j/it/boulder/** io.fabric8 docker-maven-plugin start pre-integration-test build start stop post-integration-test stop boulder false org.apache.maven.plugins maven-failsafe-plugin org/shredzone/acme4j/it/pebble/** io.fabric8 docker-maven-plugin 0.48.0 true true true %a pebble ghcr.io/letsencrypt/pebble:latest 14000:14000 15000:15000 bammbamm -strict -dnsserver bammbamm:8053 -config /test/config/pebble-config.json Listening 1 bammbamm acme4j/challtestsrv:${project.version} challtestsrv.dockerfile bammbamm 8055:8055 Starting management server org.shredzone.acme4j acme4j-client ${project.version} org.apache.httpcomponents httpclient ${httpclient.version} org.slf4j slf4j-api ${slf4j.version} org.slf4j slf4j-simple ${slf4j.version} ================================================ FILE: acme4j-it/src/main/docker/challtestsrv.dockerfile ================================================ FROM ghcr.io/letsencrypt/pebble-challtestsrv:latest FROM alpine COPY --from=0 /app /app COPY challtestsrv.sh / ENTRYPOINT [ "/challtestsrv.sh" ] ================================================ FILE: acme4j-it/src/main/docker/challtestsrv.sh ================================================ #!/bin/sh BAMMBAMM_IP=$(hostname -i) echo "My IP is: $BAMMBAMM_IP" /app -defaultIPv6 "" -defaultIPv4 "$BAMMBAMM_IP" ================================================ FILE: acme4j-it/src/main/java/module-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ module org.shredzone.acme4j.it { requires org.shredzone.acme4j; requires com.github.spotbugs.annotations; requires org.apache.httpcomponents.httpclient; requires org.apache.httpcomponents.httpcore; exports org.shredzone.acme4j.it; } ================================================ FILE: acme4j-it/src/main/java/org/shredzone/acme4j/it/BammBammClient.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it; import java.io.IOException; import java.util.Collections; import java.util.Objects; import org.apache.http.HttpStatus; import org.apache.http.client.ClientProtocolException; import org.apache.http.client.HttpClient; import org.apache.http.client.methods.HttpPost; import org.apache.http.entity.ContentType; import org.apache.http.entity.StringEntity; import org.apache.http.impl.client.HttpClients; import org.apache.http.util.EntityUtils; import org.shredzone.acme4j.toolbox.JSONBuilder; /** * The BammBamm client connects to the pebble-challtestsrv. */ public class BammBammClient { private static final HttpClient CLIENT = HttpClients.createDefault(); private final String baseUrl; /** * Creates a new BammBamm client. * * @param baseUrl * Base URL of the pebble-challtestsrv server to connect to. */ public BammBammClient(String baseUrl) { this.baseUrl = Objects.requireNonNull(baseUrl) + '/'; } /** * Adds a HTTP token. * * @param token * Token to add * @param challenge * Challenge to respond with */ public void httpAddToken(String token, String challenge) throws IOException { var jb = new JSONBuilder(); jb.put("token", token); jb.put("content", challenge); sendRequest("add-http01", jb.toString()); } /** * Removes a HTTP token. * * @param token * Token to remove */ public void httpRemoveToken(String token) throws IOException { var jb = new JSONBuilder(); jb.put("token", token); sendRequest("del-http01", jb.toString()); } /** * Adds an A Record to the DNS. Only one A Record is supported per domain. If another * A Record is set, it will replace the existing one. * * @param domain * Domain of the A Record * @param ip * IP address or domain name. If a domain name is used, it will be resolved * and the IP will be used. */ public void dnsAddARecord(String domain, String ip) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); jb.array("addresses", Collections.singletonList(ip)); sendRequest("add-a", jb.toString()); } /** * Removes an A Record from the DNS. * * @param domain * Domain to remove the A Record from */ public void dnsRemoveARecord(String domain) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); sendRequest("clear-a", jb.toString()); } /** * Adds a TXT Record to the DNS. Only one TXT Record is supported per domain. If * another TXT Record is set, it will replace the existing one. * * @param domain * Domain name to add the TXT Record to * @param txt * TXT record to add */ public void dnsAddTxtRecord(String domain, String txt) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); jb.put("value", txt); sendRequest("set-txt", jb.toString()); } /** * Removes a TXT Record from the DNS. * * @param domain * Domain to remove the TXT Record from */ public void dnsRemoveTxtRecord(String domain) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); sendRequest("clear-txt", jb.toString()); } /** * Adds a CNAME Record to the DNS. Only one CNAME Record is supported per domain. If * another CNAME Record is set, it will replace the existing one. * * @param domain * Domain to add the CNAME Record to * @param cname * CNAME Record to add * @since 2.9 */ public void dnsAddCnameRecord(String domain, String cname) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); jb.put("target", cname); sendRequest("set-cname", jb.toString()); } /** * Removes a CNAME Record from the DNS. * * @param domain * Domain to remove the CNAME Record from * @since 2.9 */ public void dnsRemoveCnameRecord(String domain) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); sendRequest("clear-cname", jb.toString()); } /** * Simulates a SERVFAIL for the given domain. * * @param domain * Domain that will give a SERVFAIL response * @since 2.9 */ public void dnsAddServFailRecord(String domain) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); sendRequest("set-servfail", jb.toString()); } /** * Removes a SERVFAIL Record from the DNS. * * @param domain * Domain to remove the SEVFAIL Record from * @since 2.9 */ public void dnsRemoveServFailRecord(String domain) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); sendRequest("clear-servfail", jb.toString()); } /** * Adds a certificate for TLS-ALPN tests. * * @param domain * Certificate domain to be added * @param keyauth * Key authorization to be used for validation */ public void tlsAlpnAddCertificate(String domain, String keyauth) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); jb.put("content", keyauth); sendRequest("add-tlsalpn01", jb.toString()); } /** * Removes a certificate. * * @param domain * Certificate domain to be removed */ public void tlsAlpnRemoveCertificate(String domain) throws IOException { var jb = new JSONBuilder(); jb.put("host", domain); sendRequest("del-tlsalpn01", jb.toString()); } /** * Sends a request to the pebble-challtestsrv. * * @param call * Endpoint to be called * @param body * JSON body */ private void sendRequest(String call, String body) throws IOException { try { var httppost = new HttpPost(baseUrl + call); httppost.setEntity(new StringEntity(body, ContentType.APPLICATION_JSON)); var response = CLIENT.execute(httppost); EntityUtils.consume(response.getEntity()); if (response.getStatusLine().getStatusCode() != HttpStatus.SC_OK) { throw new IOException(response.getStatusLine().getReasonPhrase()); } } catch (ClientProtocolException ex) { throw new IOException(ex); } } } ================================================ FILE: acme4j-it/src/main/java/org/shredzone/acme4j/it/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2020 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.it; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-it/src/main/resources/.gitignore ================================================ ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/ProviderIT.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2024 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatNoException; import java.net.MalformedURLException; import java.net.URI; import java.time.Duration; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; /** * A very simple test to check if all provider URIs are still pointing to a directory * resource. *

* If one of these tests fails, it could be an indicator that the corresponding directory * URL has been changed on CA side, or that EAR or auto-renewal features have been * changed. *

* These integration tests require a network connection. */ public class ProviderIT { /** * Test Actalis */ @Test public void testActalis() throws AcmeException, MalformedURLException { var session = new Session("acme://actalis.com"); assertThat(session.getMetadata().getWebsite()).hasValue(URI.create("https://www.actalis.com").toURL()); assertThatNoException().isThrownBy(() -> session.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(session.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(session.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(session.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); } /** * Test Google CA */ @Test public void testGoogle() throws AcmeException, MalformedURLException { var session = new Session("acme://pki.goog"); assertThat(session.getMetadata().getWebsite()).hasValue(URI.create("https://pki.goog").toURL()); assertThatNoException().isThrownBy(() -> session.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(session.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(session.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(session.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); var sessionStage = new Session("acme://pki.goog/staging"); assertThat(sessionStage.getMetadata().getWebsite()).hasValue(URI.create("https://pki.goog").toURL()); assertThatNoException().isThrownBy(() -> sessionStage.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(sessionStage.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(sessionStage.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(sessionStage.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); } /** * Test Let's Encrypt */ @Test public void testLetsEncrypt() throws AcmeException, MalformedURLException { var session = new Session("acme://letsencrypt.org"); assertThat(session.getMetadata().getWebsite()).hasValue(URI.create("https://letsencrypt.org").toURL()); assertThatNoException().isThrownBy(() -> session.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(session.getMetadata().isExternalAccountRequired()).isFalse(); assertThat(session.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(session.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); var sessionStage = new Session("acme://letsencrypt.org/staging"); assertThat(sessionStage.getMetadata().getWebsite()).hasValue(URI.create("https://letsencrypt.org/docs/staging-environment/").toURL()); assertThatNoException().isThrownBy(() -> sessionStage.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(sessionStage.getMetadata().isExternalAccountRequired()).isFalse(); assertThat(sessionStage.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(sessionStage.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); } /** * Test Pebble */ @Test public void testPebble() throws AcmeException, MalformedURLException { var pebbleHost = System.getProperty("pebbleHost", "localhost"); var pebblePort = System.getProperty("pebblePort", "14000"); var session = new Session("acme://pebble/" + pebbleHost + ":" + pebblePort); assertThat(session.getMetadata().getWebsite()).isEmpty(); assertThatNoException().isThrownBy(() -> session.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(session.getMetadata().isExternalAccountRequired()).isFalse(); assertThat(session.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(session.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); } /** * Test ssl.com, production */ @Test public void testSslCom() throws AcmeException, MalformedURLException { var sessionEcc = new Session("acme://ssl.com/ecc"); assertThat(sessionEcc.getMetadata().getWebsite()).hasValue(URI.create("https://www.ssl.com").toURL()); assertThatNoException().isThrownBy(() -> sessionEcc.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(sessionEcc.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(sessionEcc.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(sessionEcc.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); var sessionRsa = new Session("acme://ssl.com/rsa"); assertThat(sessionRsa.getMetadata().getWebsite()).hasValue(URI.create("https://www.ssl.com").toURL()); assertThatNoException().isThrownBy(() -> sessionRsa.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(sessionRsa.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(sessionRsa.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(sessionRsa.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); // If this test fails, the metadata has been fixed on server side. Then remove // the patch at ZeroSSLAcmeProvider, and update the documentation. var sessionEABCheck = new Session("https://acme.ssl.com/sslcom-dv-ecc"); assertThat(sessionEABCheck.getMetadata().isExternalAccountRequired()).isFalse(); } /** * Test ssl.com, staging server */ @Test @SoftFail("Frequent certificate expiration of acme-try.ssl.com") public void testSslComStaging() throws AcmeException, MalformedURLException { var sessionEccStage = new Session("acme://ssl.com/staging/ecc"); assertThat(sessionEccStage.getMetadata().getWebsite()).hasValue(URI.create("https://www.ssl.com").toURL()); assertThatNoException().isThrownBy(() -> sessionEccStage.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(sessionEccStage.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(sessionEccStage.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(sessionEccStage.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); var sessionRsaStage = new Session("acme://ssl.com/staging/rsa"); assertThat(sessionRsaStage.getMetadata().getWebsite()).hasValue(URI.create("https://www.ssl.com").toURL()); assertThatNoException().isThrownBy(() -> sessionRsaStage.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(sessionRsaStage.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(sessionRsaStage.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(sessionRsaStage.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); // If this test fails, the metadata has been fixed on server side. Then remove // the patch at ZeroSSLAcmeProvider, and update the documentation. var sessionEABCheckStage = new Session("https://acme-try.ssl.com/sslcom-dv-ecc"); assertThat(sessionEABCheckStage.getMetadata().isExternalAccountRequired()).isFalse(); } /** * Test ZeroSSL */ @Test @SoftFail("Frequent network timeouts or HTTP errors") public void testZeroSsl() throws AcmeException, MalformedURLException { var session = new Session("acme://zerossl.com"); session.networkSettings().setTimeout(Duration.ofSeconds(120L)); assertThat(session.getMetadata().getWebsite()).hasValue(URI.create("https://zerossl.com").toURL()); assertThatNoException().isThrownBy(() -> session.resourceUrl(Resource.NEW_ACCOUNT)); assertThat(session.getMetadata().isExternalAccountRequired()).isTrue(); assertThat(session.getMetadata().isAutoRenewalEnabled()).isFalse(); assertThat(session.resourceUrlOptional(Resource.RENEWAL_INFO)).isNotEmpty(); // ZeroSSL has no documented staging server (as of February 2024) } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/SoftFail.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it; import static java.lang.annotation.ElementType.METHOD; import static java.lang.annotation.RetentionPolicy.RUNTIME; import java.lang.annotation.Retention; import java.lang.annotation.Target; import org.junit.jupiter.api.extension.ExtendWith; import org.shredzone.acme4j.exception.AcmeException; /** * Marks a test to fail softly if an {@link AcmeException} is thrown. These are usually * integration tests that fail frequently because the external server has stability * issues. */ @Retention(RUNTIME) @Target(METHOD) @ExtendWith(SoftFailExtension.class) public @interface SoftFail { /** * A human-readable reason why this test is marked as soft fail. */ String value(); } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/SoftFailExtension.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2025 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it; import org.junit.jupiter.api.extension.ExtensionContext; import org.junit.jupiter.api.extension.TestExecutionExceptionHandler; import org.opentest4j.TestAbortedException; import org.shredzone.acme4j.exception.AcmeException; /** * Aborts a @{@link SoftFail} annotated test when an {@link AcmeException} is thrown. */ public class SoftFailExtension implements TestExecutionExceptionHandler { @Override public void handleTestExecutionException(ExtensionContext ctx, Throwable ex) throws Throwable { if (ex instanceof AcmeException) { throw new TestAbortedException("SOFT FAIL: " + ctx.getDisplayName() + " - " + ex.getMessage(), ex); } throw ex; } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/boulder/OrderHttpIT.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it.boulder; import static org.assertj.core.api.Assertions.assertThat; import java.net.URI; import java.security.KeyPair; import java.time.Duration; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.AccountBuilder; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.it.BammBammClient; import org.shredzone.acme4j.util.KeyPairUtils; /** * Tests a complete certificate order with different challenges. */ public class OrderHttpIT { private static final String TEST_DOMAIN = "example.com"; private static final Duration TIMEOUT = Duration.ofSeconds(30L); private final String bammbammUrl = System.getProperty("bammbammUrl", "http://localhost:14001"); private final BammBammClient client = new BammBammClient(bammbammUrl); /** * Test if a certificate can be ordered via http-01 challenge. */ @Test public void testHttpValidation() throws Exception { var session = new Session(boulderURI()); var keyPair = createKeyPair(); var account = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var domainKeyPair = createKeyPair(); var order = account.newOrder().domain(TEST_DOMAIN).create(); for (var auth : order.getAuthorizations()) { var challenge = auth.findChallenge(Http01Challenge.class).orElseThrow(); client.httpAddToken(challenge.getToken(), challenge.getAuthorization()); challenge.trigger(); challenge.waitForCompletion(TIMEOUT); assertThat(challenge.getStatus()).isEqualTo(Status.VALID); assertThat(auth.getStatus()).isEqualTo(Status.VALID); client.httpRemoveToken(challenge.getToken()); } order.waitUntilReady(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.READY); order.execute(domainKeyPair); order.waitForCompletion(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.VALID); var cert = order.getCertificate().getCertificate(); assertThat(cert.getNotAfter()).isNotNull(); assertThat(cert.getNotBefore()).isNotNull(); assertThat(cert.getSubjectX500Principal().getName()).contains("CN=" + TEST_DOMAIN); } /** * @return The {@link URI} of the Boulder server to test against. */ protected URI boulderURI() { return URI.create("http://localhost:4001/directory"); } /** * Creates a fresh key pair. * * @return Created new {@link KeyPair} */ protected KeyPair createKeyPair() { return KeyPairUtils.createKeyPair(2048); } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/pebble/AccountIT.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it.pebble; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import java.net.URI; import java.security.KeyPair; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Account; import org.shredzone.acme4j.AccountBuilder; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeServerException; import org.shredzone.acme4j.exception.AcmeUnauthorizedException; /** * Account related integration tests. */ public class AccountIT extends PebbleITBase { /** * Create a new account, then bind it to a second session. */ @Test public void testCreate() throws AcmeException { var keyPair = createKeyPair(); var session = new Session(pebbleURI()); // Register a new user var login = new AccountBuilder() .addContact("mailto:acme@example.com") .agreeToTermsOfService() .useKeyPair(keyPair) .createLogin(session); var location = login.getAccount().getLocation(); assertIsPebbleUrl(location); // Check registered data var acct = login.getAccount(); assertThat(acct.getLocation()).isEqualTo(location); assertThat(acct.getContacts()).contains(URI.create("mailto:acme@example.com")); assertThat(acct.getStatus()).isEqualTo(Status.VALID); // Bind another Account object var session2 = new Session(pebbleURI()); var login2 = new Login(location, keyPair, session2); var acct2 = login2.getAccount(); assertThat(acct2.getLocation()).isEqualTo(location); assertThat(acct2.getContacts()).contains(URI.create("mailto:acme@example.com")); assertThat(acct2.getStatus()).isEqualTo(Status.VALID); } /** * Register the same key pair twice. */ @Test public void testReCreate() throws AcmeException { var keyPair = createKeyPair(); // Register a new user var session1 = new Session(pebbleURI()); var login1 = new AccountBuilder() .addContact("mailto:acme@example.com") .agreeToTermsOfService() .useKeyPair(keyPair) .createLogin(session1); var location1 = login1.getAccount().getLocation(); assertIsPebbleUrl(location1); // Try to register the same account again var session2 = new Session(pebbleURI()); var login2 = new AccountBuilder() .addContact("mailto:acme@example.com") .agreeToTermsOfService() .useKeyPair(keyPair) .createLogin(session2); var location2 = login2.getAccount().getLocation(); assertIsPebbleUrl(location2); assertThat(location1).isEqualTo(location2); } /** * Create a new account. Locate it via onlyExisting. */ @Test public void testCreateOnlyExisting() throws AcmeException { var keyPair = createKeyPair(); var session1 = new Session(pebbleURI()); var login1 = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .createLogin(session1); var location1 = login1.getAccount().getLocation(); assertIsPebbleUrl(location1); var session2 = new Session(pebbleURI()); var login2 = new AccountBuilder() .onlyExisting() .useKeyPair(keyPair) .createLogin(session2); var location2 = login2.getAccount().getLocation(); assertIsPebbleUrl(location2); assertThat(location1).isEqualTo(location2); } /** * Locate a non-existing account via onlyExisting. Make sure an accountDoesNotExist * error is returned. */ @Test public void testNotExisting() { var ex = assertThrows(AcmeServerException.class, () -> { KeyPair keyPair = createKeyPair(); Session session = new Session(pebbleURI()); new AccountBuilder().onlyExisting().useKeyPair(keyPair).create(session); }); assertThat(ex.getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:accountDoesNotExist")); } /** * Modify the contacts of an account. */ @Test public void testModify() throws AcmeException { var keyPair = createKeyPair(); var session = new Session(pebbleURI()); var acct = new AccountBuilder() .addContact("mailto:acme@example.com") .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var location = acct.getLocation(); assertIsPebbleUrl(location); acct.modify().addContact("mailto:acme2@example.com").commit(); assertThat(acct.getContacts()).contains( URI.create("mailto:acme@example.com"), URI.create("mailto:acme2@example.com")); // Still the same after updating acct.fetch(); assertThat(acct.getContacts()).contains( URI.create("mailto:acme@example.com"), URI.create("mailto:acme2@example.com")); } /** * Change the account key. */ @Test public void testKeyChange() throws AcmeException { var keyPair = createKeyPair(); var session = new Session(pebbleURI()); var acct = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var location = acct.getLocation(); var newKeyPair = createKeyPair(); acct.changeKey(newKeyPair); assertThrows(AcmeServerException.class, () -> { Session sessionOldKey = new Session(pebbleURI()); Account oldAccount = sessionOldKey.login(location, keyPair).getAccount(); oldAccount.fetch(); }, "Old account key is still accessible"); var sessionNewKey = new Session(pebbleURI()); var newAccount = sessionNewKey.login(location, newKeyPair).getAccount(); assertThat(newAccount.getStatus()).isEqualTo(Status.VALID); } /** * Deactivate an account. */ @Test public void testDeactivate() throws AcmeException { var keyPair = createKeyPair(); var session = new Session(pebbleURI()); var acct = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var location = acct.getLocation(); acct.deactivate(); // Make sure it is deactivated now... assertThat(acct.getStatus()).isEqualTo(Status.DEACTIVATED); // Make sure account cannot be accessed any more... var ex = assertThrows(AcmeUnauthorizedException.class, () -> { Session session2 = new Session(pebbleURI()); Account acct2 = session2.login(location, keyPair).getAccount(); acct2.fetch(); }, "Account can still be accessed"); assertThat(ex.getMessage()).isEqualTo("Account has been deactivated"); } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/pebble/OrderIT.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it.pebble; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import java.net.URI; import java.security.KeyPair; import java.security.cert.X509Certificate; import java.time.Duration; import java.time.Instant; import java.time.temporal.ChronoUnit; import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.NullSource; import org.junit.jupiter.params.provider.ValueSource; import org.shredzone.acme4j.AccountBuilder; import org.shredzone.acme4j.Authorization; import org.shredzone.acme4j.Certificate; import org.shredzone.acme4j.RevocationReason; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.DnsAccount01Challenge; import org.shredzone.acme4j.challenge.DnsPersist01Challenge; import org.shredzone.acme4j.challenge.Http01Challenge; import org.shredzone.acme4j.challenge.TlsAlpn01Challenge; import org.shredzone.acme4j.exception.AcmeServerException; /** * Tests a complete certificate order with different challenges. */ public class OrderIT extends PebbleITBase { private static final String TEST_DOMAIN = "example.com"; private static final Duration TIMEOUT = Duration.ofSeconds(30L); /** * Test if a certificate can be ordered via http-01 challenge. */ @ParameterizedTest @NullSource @ValueSource(strings = {"default", "shortlived"}) public void testHttpValidation(String profile) throws Exception { orderCertificate(TEST_DOMAIN, auth -> { var client = getBammBammClient(); var challenge = auth.findChallenge(Http01Challenge.class).orElseThrow(); client.httpAddToken(challenge.getToken(), challenge.getAuthorization()); cleanup(() -> client.httpRemoveToken(challenge.getToken())); return challenge; }, OrderIT::standardRevoker, profile); } /** * Test if a certificate can be ordered via dns-01 challenge. */ @ParameterizedTest @NullSource @ValueSource(strings = {"default", "shortlived"}) public void testDnsValidation(String profile) throws Exception { orderCertificate(TEST_DOMAIN, auth -> { var client = getBammBammClient(); var challenge = auth.findChallenge(Dns01Challenge.class).orElseThrow(); var challengeDomainName = challenge.getRRName(auth.getIdentifier()); client.dnsAddTxtRecord(challengeDomainName, challenge.getDigest()); cleanup(() -> client.dnsRemoveTxtRecord(challengeDomainName)); return challenge; }, OrderIT::standardRevoker, profile); } /** * Test if a certificate can be ordered via dns-account-01 challenge. */ @ParameterizedTest @NullSource @ValueSource(strings = {"default", "shortlived"}) public void testDnsAccountValidation(String profile) throws Exception { orderCertificate(TEST_DOMAIN, auth -> { var client = getBammBammClient(); var challenge = auth.findChallenge(DnsAccount01Challenge.class).orElseThrow(); var challengeDomainName = challenge.getRRName(auth.getIdentifier()); client.dnsAddTxtRecord(challengeDomainName, challenge.getDigest()); cleanup(() -> client.dnsRemoveTxtRecord(challengeDomainName)); return challenge; }, OrderIT::standardRevoker, profile); } /** * Test if a certificate can be ordered via dns-persist-01 challenge. */ @ParameterizedTest @NullSource @ValueSource(strings = {"default", "shortlived"}) public void testDnsPersistValidation(String profile) throws Exception { orderCertificate(TEST_DOMAIN, auth -> { var client = getBammBammClient(); var challenge = auth.findChallenge(DnsPersist01Challenge.class).orElseThrow(); var challengeDomainName = challenge.getRRName(auth.getIdentifier()); // Needs to be noQuotes() because of bammbamm client.dnsAddTxtRecord(challengeDomainName, challenge.buildRData().noQuotes().build()); cleanup(() -> client.dnsRemoveTxtRecord(challengeDomainName)); return challenge; }, OrderIT::standardRevoker, profile); } /** * Test if a certificate can be ordered via tns-alpn-01 challenge. */ @ParameterizedTest @NullSource @ValueSource(strings = {"default", "shortlived"}) public void testTlsAlpnValidation(String profile) throws Exception { orderCertificate(TEST_DOMAIN, auth -> { var client = getBammBammClient(); var challenge = auth.findChallenge(TlsAlpn01Challenge.class).orElseThrow(); client.tlsAlpnAddCertificate( auth.getIdentifier().getDomain(), challenge.getAuthorization()); cleanup(() -> client.tlsAlpnRemoveCertificate(auth.getIdentifier().getDomain())); return challenge; }, OrderIT::standardRevoker, profile); } /** * Test if a certificate can be revoked by its domain key. */ @Test public void testDomainKeyRevocation() throws Exception { orderCertificate(TEST_DOMAIN, auth -> { var client = getBammBammClient(); var challenge = auth.findChallenge(Http01Challenge.class).orElseThrow(); client.httpAddToken(challenge.getToken(), challenge.getAuthorization()); cleanup(() -> client.httpRemoveToken(challenge.getToken())); return challenge; }, OrderIT::domainKeyRevoker, null); } /** * Runs the complete process of ordering a certificate. * * @param domain * Name of the domain to order a certificate for * @param validator * {@link Validator} that finds and prepares a {@link Challenge} for domain * validation * @param revoker * {@link Revoker} that finally revokes the certificate * @param profile * Profile to be used, or {@code null} for no profile selection. */ private void orderCertificate(String domain, Validator validator, Revoker revoker, String profile) throws Exception { var keyPair = createKeyPair(); var session = new Session(pebbleURI()); var account = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var domainKeyPair = createKeyPair(); var notBefore = Instant.now().truncatedTo(ChronoUnit.SECONDS); var notAfter = notBefore.plus(Duration.ofDays(20L)); var orderBuilder = account.newOrder() .domain(domain) .notBefore(notBefore) .notAfter(notAfter); if (profile != null) { orderBuilder.profile(profile); } var order = orderBuilder.create(); assertThat(order.getNotBefore().orElseThrow()).isEqualTo(notBefore); assertThat(order.getNotAfter().orElseThrow()).isEqualTo(notAfter); assertThat(order.getStatus()).isEqualTo(Status.PENDING); if (profile != null) { assertThat(order.getProfile()).contains(profile); } else { // FIXME: Pebble falls back to different values here, cannot be tested properly } for (var auth : order.getAuthorizations()) { assertThat(auth.getIdentifier().getDomain()).isEqualTo(domain); assertThat(auth.getStatus()).isEqualTo(Status.PENDING); if (auth.getStatus() == Status.VALID) { continue; } var challenge = validator.prepare(auth); challenge.trigger(); challenge.waitForCompletion(TIMEOUT); assertThat(challenge.getStatus()).isEqualTo(Status.VALID); auth.fetch(); assertThat(auth.getStatus()).isEqualTo(Status.VALID); } order.waitUntilReady(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.READY); order.execute(domainKeyPair); order.waitForCompletion(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.VALID); var certificate = order.getCertificate(); var cert = certificate.getCertificate(); assertThat(cert).isNotNull(); assertThat(cert.getNotBefore().toInstant()).isEqualTo(notBefore); assertThat(cert.getNotAfter().toInstant()).isEqualTo(notAfter); for (var auth : order.getAuthorizations()) { assertThat(auth.getStatus()).isEqualTo(Status.VALID); auth.deactivate(); assertThat(auth.getStatus()).isEqualTo(Status.DEACTIVATED); } revoker.revoke(session, certificate, keyPair, domainKeyPair); var ex2 = assertThrows(AcmeServerException.class, certificate::revoke, "Could revoke again"); assertThat(ex2.getProblem().getType()).isEqualTo(URI.create("urn:ietf:params:acme:error:alreadyRevoked")); } /** * Revokes a certificate by calling {@link Certificate#revoke(RevocationReason)}. * This is the standard way to revoke a certificate. */ private static void standardRevoker(Session session, Certificate certificate, KeyPair keyPair, KeyPair domainKeyPair) throws Exception { certificate.revoke(RevocationReason.KEY_COMPROMISE); } /** * Revokes a certificate by calling * {@link Certificate#revoke(Session, KeyPair, X509Certificate, RevocationReason)}. * This way can be used when the account key was lost. */ private static void domainKeyRevoker(Session session, Certificate certificate, KeyPair keyPair, KeyPair domainKeyPair) throws Exception { Certificate.revoke(session, domainKeyPair, certificate.getCertificate(), RevocationReason.KEY_COMPROMISE); } @FunctionalInterface private interface Validator { Challenge prepare(Authorization auth) throws Exception; } @FunctionalInterface private interface Revoker { void revoke(Session session, Certificate certificate, KeyPair keyPair, KeyPair domainKeyPair) throws Exception; } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/pebble/OrderWildcardIT.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it.pebble; import static java.util.stream.Collectors.toList; import static org.assertj.core.api.Assertions.assertThat; import java.time.Duration; import java.time.Instant; import java.time.temporal.ChronoUnit; import org.bouncycastle.asn1.x509.GeneralName; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.AccountBuilder; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.challenge.Dns01Challenge; import org.shredzone.acme4j.challenge.DnsPersist01Challenge; /** * Tests a complete wildcard certificate order. Wildcard certificates currently only * support dns-01 challenge. */ public class OrderWildcardIT extends PebbleITBase { private static final String TEST_DOMAIN = "example.com"; private static final String TEST_WILDCARD_DOMAIN = "*.example.com"; private static final Duration TIMEOUT = Duration.ofSeconds(30L); /** * Test if a wildcard certificate can be ordered via dns-01 challenge. */ @Test public void testDnsValidation() throws Exception { var client = getBammBammClient(); var keyPair = createKeyPair(); var session = new Session(pebbleURI()); var account = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var domainKeyPair = createKeyPair(); var notBefore = Instant.now().truncatedTo(ChronoUnit.MILLIS); var notAfter = notBefore.plus(Duration.ofDays(20L)); var order = account.newOrder() .domain(TEST_WILDCARD_DOMAIN) .domain(TEST_DOMAIN) .notBefore(notBefore) .notAfter(notAfter) .create(); assertThat(order.getNotBefore().orElseThrow()).isEqualTo(notBefore); assertThat(order.getNotAfter().orElseThrow()).isEqualTo(notAfter); assertThat(order.getStatus()).isEqualTo(Status.PENDING); for (var auth : order.getAuthorizations()) { assertThat(auth.getIdentifier().getDomain()).isEqualTo(TEST_DOMAIN); if (auth.getStatus() == Status.VALID) { continue; } var challenge = auth.findChallenge(Dns01Challenge.class).orElseThrow(); var challengeDomainName = challenge.getRRName(TEST_DOMAIN); client.dnsAddTxtRecord(challengeDomainName, challenge.getDigest()); try { challenge.trigger(); challenge.waitForCompletion(TIMEOUT); assertThat(challenge.getStatus()).isEqualTo(Status.VALID); } finally { performCleanup(); } auth.fetch(); assertThat(auth.getStatus()).isEqualTo(Status.VALID); } order.waitUntilReady(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.READY); order.execute(domainKeyPair); order.waitForCompletion(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.VALID); var cert = order.getCertificate().getCertificate(); assertThat(cert).isNotNull(); assertThat(cert.getNotAfter()).isNotEqualTo(notBefore); assertThat(cert.getNotBefore()).isNotEqualTo(notAfter); var san = cert.getSubjectAlternativeNames().stream() .filter(it -> ((Number) it.get(0)).intValue() == GeneralName.dNSName) .map(it -> (String) it.get(1)) .collect(toList()); assertThat(san).contains(TEST_DOMAIN, TEST_WILDCARD_DOMAIN); } /** * Test if a wildcard certificate can be ordered via dns-persist-01 challenge. */ @Test public void testDnsPersistValidation() throws Exception { var client = getBammBammClient(); var keyPair = createKeyPair(); var session = new Session(pebbleURI()); var account = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); var domainKeyPair = createKeyPair(); var notBefore = Instant.now().truncatedTo(ChronoUnit.MILLIS); var notAfter = notBefore.plus(Duration.ofDays(20L)); var order = account.newOrder() .domain(TEST_WILDCARD_DOMAIN) .domain(TEST_DOMAIN) .notBefore(notBefore) .notAfter(notAfter) .create(); assertThat(order.getNotBefore().orElseThrow()).isEqualTo(notBefore); assertThat(order.getNotAfter().orElseThrow()).isEqualTo(notAfter); assertThat(order.getStatus()).isEqualTo(Status.PENDING); for (var auth : order.getAuthorizations()) { assertThat(auth.getIdentifier().getDomain()).isEqualTo(TEST_DOMAIN); if (auth.getStatus() == Status.VALID) { continue; } var challenge = auth.findChallenge(DnsPersist01Challenge.class).orElseThrow(); var challengeDomainName = challenge.getRRName(TEST_DOMAIN); client.dnsAddTxtRecord(challengeDomainName, challenge.buildRData().wildcard().noQuotes().build()); try { challenge.trigger(); challenge.waitForCompletion(TIMEOUT); assertThat(challenge.getStatus()).isEqualTo(Status.VALID); } finally { performCleanup(); } auth.fetch(); assertThat(auth.getStatus()).isEqualTo(Status.VALID); } order.waitUntilReady(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.READY); order.execute(domainKeyPair); order.waitForCompletion(TIMEOUT); assertThat(order.getStatus()).isEqualTo(Status.VALID); var cert = order.getCertificate().getCertificate(); assertThat(cert).isNotNull(); assertThat(cert.getNotAfter()).isNotEqualTo(notBefore); assertThat(cert.getNotBefore()).isNotEqualTo(notAfter); var san = cert.getSubjectAlternativeNames().stream() .filter(it -> ((Number) it.get(0)).intValue() == GeneralName.dNSName) .map(it -> (String) it.get(1)) .collect(toList()); assertThat(san).contains(TEST_DOMAIN, TEST_WILDCARD_DOMAIN); } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/pebble/PebbleITBase.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it.pebble; import static org.assertj.core.api.Assertions.assertThat; import java.net.URI; import java.net.URL; import java.security.KeyPair; import java.util.ArrayList; import java.util.List; import org.junit.jupiter.api.AfterEach; import org.shredzone.acme4j.Authorization; import org.shredzone.acme4j.Order; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.exception.AcmeLazyLoadingException; import org.shredzone.acme4j.it.BammBammClient; import org.shredzone.acme4j.util.KeyPairUtils; /** * Superclass for all Pebble related integration tests. *

* These tests require a running * Pebble ACME test server at * localhost port 14000. The host and port can be changed via the system property * {@code pebbleHost} and {@code pebblePort} respectively. *

* Also, a running pebble-challtestsrv is required to listen on localhost port 8055. The * server's base URL can be changed via the system property {@code bammbammUrl}. */ public abstract class PebbleITBase { private final String pebbleHost = System.getProperty("pebbleHost", "localhost"); private final int pebblePort = Integer.parseInt(System.getProperty("pebblePort", "14000")); private final String bammbammUrl = System.getProperty("bammbammUrl", "http://localhost:8055"); private BammBammClient bammBammClient; private final List cleanup = new ArrayList<>(); @AfterEach public void performCleanup() throws Exception { for (var callback : cleanup) { callback.cleanup(); } cleanup.clear(); } protected void cleanup(CleanupCallback callback) { cleanup.add(callback); } /** * @return The {@link URI} of the pebble server to test against. */ protected URI pebbleURI() { return URI.create("acme://pebble/" + pebbleHost + ":" + pebblePort); } /** * @return {@link BammBammClient} singleton instance. */ protected BammBammClient getBammBammClient() { if (bammBammClient == null) { bammBammClient = new BammBammClient(bammbammUrl); } return bammBammClient; } /** * Creates a fresh key pair. * * @return Created {@link KeyPair}, guaranteed to be unknown to the Pebble server */ protected KeyPair createKeyPair() { return KeyPairUtils.createKeyPair(2048); } /** * Asserts that the given {@link URL} is not {@code null} and refers to the Pebble * server. * * @param url * {@link URL} to assert */ protected void assertIsPebbleUrl(URL url) { assertThat(url).isNotNull(); assertThat(url.getProtocol()).isEqualTo("https"); assertThat(url.getHost()).isEqualTo(pebbleHost); assertThat(url.getPort()).isEqualTo(pebblePort); assertThat(url.getPath()).isNotEmpty(); } /** * Safely updates the authorization, catching checked exceptions. * * @param auth * {@link Authorization} to update */ protected void updateAuth(Authorization auth) { try { auth.fetch(); } catch (AcmeException ex) { throw new AcmeLazyLoadingException(auth, ex); } } /** * Safely updates the order, catching checked exceptions. * * @param order * {@link Order} to update */ protected void updateOrder(Order order) { try { order.fetch(); } catch (AcmeException ex) { throw new AcmeLazyLoadingException(order, ex); } } @FunctionalInterface public interface CleanupCallback { void cleanup() throws Exception; } } ================================================ FILE: acme4j-it/src/test/java/org/shredzone/acme4j/it/pebble/SessionIT.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2017 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.it.pebble; import static net.javacrumbs.jsonunit.assertj.JsonAssertions.assertThatJson; import static org.assertj.core.api.Assertions.assertThat; import java.net.URI; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Session; import org.shredzone.acme4j.connector.Resource; import org.shredzone.acme4j.exception.AcmeException; import org.shredzone.acme4j.toolbox.JSON; /** * Session related integration tests. */ public class SessionIT extends PebbleITBase { @Test public void testResources() throws AcmeException { var session = new Session(pebbleURI()); assertIsPebbleUrl(session.resourceUrl(Resource.NEW_ACCOUNT)); assertIsPebbleUrl(session.resourceUrl(Resource.NEW_NONCE)); assertIsPebbleUrl(session.resourceUrl(Resource.NEW_ORDER)); } @Test public void testMetadata() throws AcmeException { var session = new Session(pebbleURI()); var meta = session.getMetadata(); assertThat(meta).isNotNull(); assertThat(meta.getTermsOfService().orElseThrow()) .isEqualTo(URI.create("data:text/plain,Do%20what%20thou%20wilt")); assertThat(meta.getWebsite()).isEmpty(); assertThat(meta.getCaaIdentities()).contains("pebble.letsencrypt.org"); assertThat(meta.isExternalAccountRequired()).isFalse(); assertThat(meta.getProfiles()).contains("default", "shortlived"); assertThat(meta.getProfileDescription("default")).contains("The profile you know and love"); assertThat(meta.getProfileDescription("shortlived")).contains("A short-lived cert profile, without actual enforcement"); assertThat(meta.getProfileDescription("paid")).isEmpty(); assertThatJson(meta.getJSON().toString()).isEqualTo(JSON.parse(""" { "caaIdentities": [ "pebble.letsencrypt.org" ], "externalAccountRequired": false, "profiles": { "default": "The profile you know and love", "shortlived": "A short-lived cert profile, without actual enforcement" }, "termsOfService": "data:text/plain,Do%20what%20thou%20wilt" } """).toString()); } } ================================================ FILE: acme4j-it/src/test/resources/simplelogger.properties ================================================ org.slf4j.simpleLogger.log.org.shredzone.acme4j = debug ================================================ FILE: acme4j-smime/.gitattributes ================================================ *.eml text eol=crlf ================================================ FILE: acme4j-smime/pom.xml ================================================ 4.0.0 org.shredzone.acme4j acme4j 5.1.1-SNAPSHOT acme4j-smime acme4j S/MIME acme4j S/MIME extension org.shredzone.acme4j acme4j-client ${project.version} org.bouncycastle bcprov-jdk18on ${bouncycastle.version} org.bouncycastle bcpkix-jdk18on ${bouncycastle.version} org.bouncycastle bcjmail-jdk18on ${bouncycastle.version} org.slf4j slf4j-api ${slf4j.version} org.eclipse.angus jakarta.mail ${jakarta.mail.version} ================================================ FILE: acme4j-smime/src/main/java/.gitignore ================================================ ================================================ FILE: acme4j-smime/src/main/java/module-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This module is an add-on that provides S/MIME certificate features. */ module org.shredzone.acme4j.smime { requires org.shredzone.acme4j; requires transitive jakarta.mail; requires static com.github.spotbugs.annotations; requires org.bouncycastle.mail; requires org.bouncycastle.pkix; requires org.bouncycastle.provider; exports org.shredzone.acme4j.smime; exports org.shredzone.acme4j.smime.challenge; exports org.shredzone.acme4j.smime.csr; exports org.shredzone.acme4j.smime.email; exports org.shredzone.acme4j.smime.exception; provides org.shredzone.acme4j.provider.ChallengeProvider with org.shredzone.acme4j.smime.challenge.EmailReply00ChallengeProvider; } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/EmailIdentifier.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime; import java.io.Serial; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.exception.AcmeProtocolException; /** * Represents an e-mail identifier. * * @since 2.12 */ public class EmailIdentifier extends Identifier { @Serial private static final long serialVersionUID = -1473014167038845395L; /** * Type constant for E-Mail identifiers. * * @see RFC 8823 */ public static final String TYPE_EMAIL = "email"; /** * Creates a new {@link EmailIdentifier}. * * @param value * e-mail address */ private EmailIdentifier(String value) { super(TYPE_EMAIL, value); } /** * Creates a new email identifier for the given address. * * @param email * Email address. Must only be the address itself (without personal name). * @return New {@link EmailIdentifier} */ public static EmailIdentifier email(String email) { return new EmailIdentifier(email); } /** * Creates a new email identifier for the given address. * * @param email * Email address. Only the address itself is used. The personal name will be * ignored. * @return New {@link EmailIdentifier} */ public static EmailIdentifier email(InternetAddress email) { return email(email.getAddress()); } /** * Returns the email address. * * @return {@link InternetAddress} * @throws AcmeProtocolException * if this is not a valid email identifier. */ public InternetAddress getEmailAddress() { try { return new InternetAddress(getValue()); } catch (AddressException ex) { throw new AcmeProtocolException("bad email address", ex); } } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/challenge/EmailReply00Challenge.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.challenge; import static org.shredzone.acme4j.toolbox.AcmeUtils.base64UrlEncode; import static org.shredzone.acme4j.toolbox.AcmeUtils.sha256hash; import java.io.Serial; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.challenge.TokenChallenge; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.toolbox.JSON; /** * Implements the {@value TYPE} challenge. * * @see RFC 8823 * @since 2.12 */ public class EmailReply00Challenge extends TokenChallenge { @Serial private static final long serialVersionUID = 2502329538019544794L; /** * Challenge type name: {@value} */ public static final String TYPE = "email-reply-00"; private static final String KEY_FROM = "from"; /** * Creates a new generic {@link EmailReply00Challenge} object. * * @param login * {@link Login} the resource is bound with * @param data * {@link JSON} challenge data */ public EmailReply00Challenge(Login login, JSON data) { super(login, data); } /** * Returns the email address in the "from" field of the challenge. * * @return The "from" email address, as String. */ public String getFrom() { return getJSON().get(KEY_FROM).asString(); } /** * Returns the email address of the expected sender of the "challenge" mail. *

* This is the same value that is returned by {@link #getFrom()}, but as {@link * InternetAddress} instance. * * @return Expected sender of the challenge email. */ public InternetAddress getExpectedSender() { try { return new InternetAddress(getFrom()); } catch (AddressException ex) { throw new AcmeProtocolException("bad email address " + getFrom(), ex); } } /** * Returns the token, which is a concatenation of the part 1 that is sent by email, * and part 2 that is passed into this callenge via {@link #getTokenPart2()}; * * @param part1 * Part 1 of the token, which can be found in the subject of the corresponding * challenge email. * @return Concatenated token */ public String getToken(String part1) { return part1.concat(getTokenPart2()); } /** * Returns the part 2 of the token to be used for this challenge. Part 2 is sent via * this challenge. */ public String getTokenPart2() { return super.getToken(); } /** * This method is not implemented. Use {@link #getAuthorization(String)} instead. */ @Override public String getAuthorization() { throw new UnsupportedOperationException("use getAuthorization(String)"); } /** * Returns the authorization string. * * @param part1 * Part 1 of the token, which can be found in the subject of the corresponding * challenge email. */ public String getAuthorization(String part1) { var keyAuth = keyAuthorizationFor(getToken(part1)); return base64UrlEncode(sha256hash(keyAuth)); } @Override protected boolean acceptable(String type) { return TYPE.equals(type); } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/challenge/EmailReply00ChallengeProvider.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.challenge; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.challenge.Challenge; import org.shredzone.acme4j.provider.ChallengeProvider; import org.shredzone.acme4j.provider.ChallengeType; import org.shredzone.acme4j.toolbox.JSON; /** * A provider that generates {@link EmailReply00Challenge}. It is registered as Java * service. * * @since 2.12 */ @ChallengeType(EmailReply00Challenge.TYPE) public class EmailReply00ChallengeProvider implements ChallengeProvider { @Override public Challenge create(Login login, JSON data) { return new EmailReply00Challenge(login, data); } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/challenge/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains the * {@link org.shredzone.acme4j.smime.challenge.EmailReply00Challenge#TYPE} related acme4j * {@link org.shredzone.acme4j.challenge.Challenge} implementation. *

* The {@link org.shredzone.acme4j.smime.challenge.EmailReply00ChallengeProvider} is * registered as Java service, so acme4j is able to automatically generate * {@link org.shredzone.acme4j.smime.challenge.EmailReply00Challenge} instances. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.smime.challenge; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/csr/KeyUsageType.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.csr; import org.bouncycastle.asn1.x509.KeyUsage; /** * An enumeration of key usage types for S/MIME certificates. * * @since 2.12 */ public enum KeyUsageType { /** * S/MIME certificate can be used only for signing. */ SIGNING_ONLY(KeyUsage.digitalSignature), /** * S/MIME certificate can be used only for encryption. */ ENCRYPTION_ONLY(KeyUsage.keyEncipherment), /** * S/MIME certificate can be used for both signing and encryption. */ SIGNING_AND_ENCRYPTION(KeyUsage.digitalSignature | KeyUsage.keyEncipherment); private final int keyUsage; KeyUsageType(int keyUsage) { this.keyUsage = keyUsage; } /** * Returns the key usage bits to be used in the key usage extension of a CSR. */ public int getKeyUsageBits() { return keyUsage; } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/csr/SMIMECSRBuilder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.csr; import static java.nio.charset.StandardCharsets.UTF_8; import static java.util.Objects.requireNonNull; import static java.util.stream.Collectors.joining; import java.io.IOException; import java.io.OutputStream; import java.io.OutputStreamWriter; import java.io.Writer; import java.security.KeyPair; import java.security.interfaces.ECKey; import java.util.ArrayList; import java.util.Arrays; import java.util.Collection; import java.util.List; import edu.umd.cs.findbugs.annotations.Nullable; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x500.X500NameBuilder; import org.bouncycastle.asn1.x500.style.BCStyle; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.ExtensionsGenerator; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.asn1.x509.KeyUsage; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder; import org.bouncycastle.util.io.pem.PemObject; import org.bouncycastle.util.io.pem.PemWriter; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.smime.EmailIdentifier; /** * Generator for an S/MIME CSR (Certificate Signing Request) suitable for ACME servers. *

* Requires {@code Bouncy Castle}. The {@link org.bouncycastle.jce.provider.BouncyCastleProvider} * must also be added as security provider. *

* A {@code jakarta.mail} implementation must be present in the classpath. * * @since 2.12 */ public class SMIMECSRBuilder { private static final String SIGNATURE_ALG = "SHA256withRSA"; private static final String EC_SIGNATURE_ALG = "SHA256withECDSA"; private final X500NameBuilder namebuilder = new X500NameBuilder(X500Name.getDefaultStyle()); private final List emaillist = new ArrayList<>(); private @Nullable PKCS10CertificationRequest csr = null; private KeyUsageType keyUsageType = KeyUsageType.SIGNING_AND_ENCRYPTION; /** * Adds an {@link InternetAddress}. The first address is also used as CN. * * @param email * {@link InternetAddress} to add */ public void addEmail(InternetAddress email) { if (emaillist.isEmpty()) { namebuilder.addRDN(BCStyle.CN, email.getAddress()); } emaillist.add(email); } /** * Adds multiple {@link InternetAddress}. * * @param emails * Collection of {@link InternetAddress} to add */ public void addEmails(Collection emails) { emails.forEach(this::addEmail); } /** * Adds multiple {@link InternetAddress}. * * @param emails * {@link InternetAddress} to add */ public void addEmails(InternetAddress... emails) { Arrays.stream(emails).forEach(this::addEmail); } /** * Adds an email {@link Identifier}. * * @param id * {@link Identifier} to add */ public void addIdentifier(Identifier id) { requireNonNull(id); if (!EmailIdentifier.TYPE_EMAIL.equals(id.getType())) { throw new AcmeProtocolException("Expected type email, but got " + id.getType()); } try { addEmail(new InternetAddress(id.getValue())); } catch (AddressException ex) { throw new AcmeProtocolException("bad email address", ex); } } /** * Adds a {@link Collection} of email {@link Identifier}. * * @param ids * Collection of Identifier to add */ public void addIdentifiers(Collection ids) { ids.forEach(this::addIdentifier); } /** * Adds multiple email {@link Identifier}. * * @param ids * Identifier to add */ public void addIdentifiers(Identifier... ids) { Arrays.stream(ids).forEach(this::addIdentifier); } /** * Sets an entry of the subject used for the CSR. *

* This method is meant as "expert mode" for setting attributes that are not covered * by the other methods. It is at the discretion of the ACME server to accept this * parameter. * * @param attName * The BCStyle attribute name * @param value * The value * @throws AddressException * if a common name is added, but the value is not a valid email address. * @since 2.14 */ public void addValue(String attName, String value) throws AddressException { var oid = X500Name.getDefaultStyle().attrNameToOID(requireNonNull(attName, "attribute name must not be null")); addValue(oid, value); } /** * Sets an entry of the subject used for the CSR *

* This method is meant as "expert mode" for setting attributes that are not covered * by the other methods. It is at the discretion of the ACME server to accept this * parameter. * * @param oid * The OID of the attribute to be added * @param value * The value * @throws AddressException * if a common name is added, but the value is not a valid email address. * @since 2.14 */ public void addValue(ASN1ObjectIdentifier oid, String value) throws AddressException { if (requireNonNull(oid, "OID must not be null").equals(BCStyle.CN)) { addEmail(new InternetAddress(value)); return; } namebuilder.addRDN(oid, requireNonNull(value, "attribute value must not be null")); } /** * Sets the organization. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setOrganization(String o) { namebuilder.addRDN(BCStyle.O, requireNonNull(o)); } /** * Sets the organizational unit. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setOrganizationalUnit(String ou) { namebuilder.addRDN(BCStyle.OU, requireNonNull(ou)); } /** * Sets the city or locality. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setLocality(String l) { namebuilder.addRDN(BCStyle.L, requireNonNull(l)); } /** * Sets the state or province. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setState(String st) { namebuilder.addRDN(BCStyle.ST, requireNonNull(st)); } /** * Sets the country. *

* Note that it is at the discretion of the ACME server to accept this parameter. */ public void setCountry(String c) { namebuilder.addRDN(BCStyle.C, requireNonNull(c)); } /** * Sets the key usage type for S/MIME certificates. *

* By default, the S/MIME certificate will be suitable for both signing and * encryption. */ public void setKeyUsageType(KeyUsageType keyUsageType) { requireNonNull(keyUsageType, "keyUsageType"); this.keyUsageType = keyUsageType; } /** * Signs the completed S/MIME CSR. * * @param keypair * {@link KeyPair} to sign the CSR with */ public void sign(KeyPair keypair) throws IOException { requireNonNull(keypair, "keypair"); if (emaillist.isEmpty()) { throw new IllegalStateException("No email address was set"); } try { var ix = 0; var gns = new GeneralName[emaillist.size()]; for (var email : emaillist) { gns[ix++] = new GeneralName(GeneralName.rfc822Name, email.getAddress()); } var subjectAltName = new GeneralNames(gns); var p10Builder = new JcaPKCS10CertificationRequestBuilder(namebuilder.build(), keypair.getPublic()); var extensionsGenerator = new ExtensionsGenerator(); extensionsGenerator.addExtension(Extension.subjectAlternativeName, false, subjectAltName); var keyUsage = new KeyUsage(keyUsageType.getKeyUsageBits()); extensionsGenerator.addExtension(Extension.keyUsage, true, keyUsage); p10Builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extensionsGenerator.generate()); var pk = keypair.getPrivate(); var csBuilder = new JcaContentSignerBuilder(pk instanceof ECKey ? EC_SIGNATURE_ALG : SIGNATURE_ALG); var signer = csBuilder.build(pk); csr = p10Builder.build(signer); } catch (OperatorCreationException ex) { throw new IOException("Could not generate CSR", ex); } } /** * Gets the PKCS#10 certification request. */ public PKCS10CertificationRequest getCSR() { if (csr == null) { throw new IllegalStateException("sign CSR first"); } return csr; } /** * Gets an encoded PKCS#10 certification request. */ public byte[] getEncoded() throws IOException { return getCSR().getEncoded(); } /** * Writes the signed certificate request to a {@link Writer}. * * @param w * {@link Writer} to write the PEM file to. The {@link Writer} is closed * after use. */ public void write(Writer w) throws IOException { if (csr == null) { throw new IllegalStateException("sign CSR first"); } try (var pw = new PemWriter(w)) { pw.writeObject(new PemObject("CERTIFICATE REQUEST", getEncoded())); } } /** * Writes the signed certificate request to an {@link OutputStream}. * * @param out * {@link OutputStream} to write the PEM file to. The {@link OutputStream} * is closed after use. */ public void write(OutputStream out) throws IOException { write(new OutputStreamWriter(out, UTF_8)); } @Override public String toString() { var sb = new StringBuilder(); sb.append(namebuilder.build()); if (!emaillist.isEmpty()) { sb.append(emaillist.stream() .map(InternetAddress::getAddress) .collect(joining(",EMAIL=", ",EMAIL=", ""))); } sb.append(",TYPE=").append(keyUsageType); return sb.toString(); } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/csr/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains S/MIME CSR related utility classes. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.smime.csr; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/email/EmailProcessor.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.email; import static java.util.Collections.unmodifiableCollection; import static java.util.Objects.requireNonNull; import java.net.URL; import java.security.InvalidAlgorithmParameterException; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.cert.PKIXParameters; import java.security.cert.X509Certificate; import java.util.Collection; import java.util.Optional; import java.util.concurrent.atomic.AtomicReference; import java.util.regex.Pattern; import edu.umd.cs.findbugs.annotations.Nullable; import jakarta.mail.Message; import jakarta.mail.MessagingException; import jakarta.mail.Session; import jakarta.mail.internet.InternetAddress; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.smime.challenge.EmailReply00Challenge; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; import org.shredzone.acme4j.smime.wrapper.Mail; import org.shredzone.acme4j.smime.wrapper.SignedMailBuilder; import org.shredzone.acme4j.smime.wrapper.SimpleMail; /** * A processor for incoming "Challenge" emails. * * @see RFC 8823 * @since 2.12 */ public final class EmailProcessor { private static final Pattern SUBJECT_PATTERN = Pattern.compile("ACME:\\s+([0-9A-Za-z_\\s-]+=?)\\s*"); private final InternetAddress sender; private final InternetAddress recipient; private final @Nullable String messageId; private final Collection replyTo; private final String token1; private final AtomicReference challengeRef = new AtomicReference<>(); /** * Processes the given plain e-mail message. *

* Note that according to RFC-8823, the challenge message must be signed using either * DKIM or S/MIME. This method does not do any DKIM or S/MIME validation, and assumes * that this has already been done in a previous stage. * * @param message * E-mail that was received from the CA. The inbound MTA has already taken * care of DKIM and/or S/MIME validation. * @return EmailProcessor for this e-mail * @throws AcmeInvalidMessageException * if a validation failed, and the message must be rejected. * @since 2.15 */ public static EmailProcessor plainMessage(Message message) throws AcmeInvalidMessageException { return builder().skipVerification().build(message); } /** * Processes the given signed e-mail message. *

* This method expects an S/MIME signed message. The signature must use a certificate * that can be validated using Java's cacert truststore. Strict validation rules are * applied. *

* Use the {@link #builder()} method if you need to configure the validation process. * * @param message * S/MIME signed e-mail that was received from the CA. * @return EmailProcessor for this e-mail * @throws AcmeInvalidMessageException * if a validation failed, and the message must be rejected. * @since 2.16 */ public static EmailProcessor signedMessage(Message message) throws AcmeInvalidMessageException { return builder().build(message); } /** * Creates a {@link Builder} for building an {@link EmailProcessor} with individual * configuration. * * @since 2.16 */ public static Builder builder() { return new Builder(); } /** * Creates a new {@link EmailProcessor} for the incoming "Challenge" message. *

* The incoming message is validated against the requirements of RFC-8823. * * @param message * "Challenge" message as it was sent by the CA. * @throws AcmeInvalidMessageException * if a validation failed, and the message must be rejected. */ private EmailProcessor(Mail message) throws AcmeInvalidMessageException { if (!message.isAutoSubmitted()) { throw new AcmeInvalidMessageException("Message is not auto-generated"); } var subject = message.getSubject(); var m = SUBJECT_PATTERN.matcher(subject); if (!m.matches()) { throw new AcmeProtocolException("Invalid subject: " + subject); } // white spaces within the token part must be ignored this.token1 = m.group(1).replaceAll("\\s+", ""); this.sender = message.getFrom(); this.recipient = message.getTo(); this.messageId = message.getMessageId().orElse(null); this.replyTo = message.getReplyTo(); } /** * The expected sender of the "challenge" email. *

* The sender is usually checked when the {@link EmailReply00Challenge} is passed into * the processor, but you can also manually check the sender here. * * @param expectedSender * The expected sender of the "challenge" email. * @return itself * @throws AcmeProtocolException * if the expected sender does not match */ public EmailProcessor expectedFrom(InternetAddress expectedSender) { requireNonNull(expectedSender, "expectedSender"); if (!sender.equals(expectedSender)) { throw new AcmeProtocolException("Message is not sent by the expected sender"); } return this; } /** * The expected recipient of the "challenge" email. *

* This must be the email address of the entity that requested the S/MIME certificate. * The check is not performed by the processor, but should be performed by * the client. * * @param expectedRecipient * The expected recipient of the "challenge" email. * @return itself * @throws AcmeProtocolException * if the expected recipient does not match */ public EmailProcessor expectedTo(InternetAddress expectedRecipient) { requireNonNull(expectedRecipient, "expectedRecipient"); if (!recipient.equals(expectedRecipient)) { throw new AcmeProtocolException("Message is not addressed to expected recipient"); } return this; } /** * The expected identifier. *

* This must be the email address of the entity that requested the S/MIME certificate. * The check is not performed by the processor, but should be performed by * the client. * * @param expectedIdentifier * The expected identifier for the S/MIME certificate. Usually this is an * {@link org.shredzone.acme4j.smime.EmailIdentifier} instance. * @return itself * @throws AcmeProtocolException * if the expected identifier is not an email identifier, or does not match */ public EmailProcessor expectedIdentifier(Identifier expectedIdentifier) { requireNonNull(expectedIdentifier, "expectedIdentifier"); if (!"email".equals(expectedIdentifier.getType())) { throw new AcmeProtocolException("Wrong identifier type: " + expectedIdentifier.getType()); } try { expectedTo(new InternetAddress(expectedIdentifier.getValue())); } catch (MessagingException ex) { throw new AcmeProtocolException("Invalid email address", ex); } return this; } /** * Returns the sender of the "challenge" email. */ public InternetAddress getSender() { return (InternetAddress) sender.clone(); } /** * Returns the recipient of the "challenge" email. */ public InternetAddress getRecipient() { return (InternetAddress) recipient.clone(); } /** * Returns all "reply-to" email addresses found in the "challenge" email. *

* Empty if there was no reply-to header, but never {@code null}. */ public Collection getReplyTo() { return unmodifiableCollection(replyTo); } /** * Returns the message-id of the "challenge" email. *

* Empty if the challenge email has no message-id. */ public Optional getMessageId() { return Optional.ofNullable(messageId); } /** * Returns the "token 1" found in the subject of the "challenge" email. */ public String getToken1() { return token1; } /** * Sets the corresponding {@link EmailReply00Challenge} that was received from the CA * for validation. * * @param challenge * {@link EmailReply00Challenge} that corresponds to this email * @return itself * @throws AcmeProtocolException * if the challenge does not match this "challenge" email. */ public EmailProcessor withChallenge(EmailReply00Challenge challenge) { requireNonNull(challenge, "challenge"); expectedFrom(challenge.getExpectedSender()); if (challengeRef.get() != null) { throw new IllegalStateException("A challenge has already been set"); } challengeRef.set(challenge); return this; } /** * Sets the corresponding {@link EmailReply00Challenge} that was received from the CA * for validation. *

* This is a convenience call in case that only the challenge location URL is * available. * * @param login * A valid {@link Login} * @param challengeLocation * The location URL of the corresponding challenge. * @return itself * @throws AcmeProtocolException * if the challenge does not match this "challenge" email. */ public EmailProcessor withChallenge(Login login, URL challengeLocation) { return withChallenge(login.bindChallenge(challengeLocation, EmailReply00Challenge.class)); } /** * Returns the full token of this challenge. *

* The corresponding email-reply-00 challenge must be set before. */ public String getToken() { checkChallengePresent(); return challengeRef.get().getToken(getToken1()); } /** * Returns the key-authorization of this challenge. This is the response to be used in * the response email. *

* The corresponding email-reply-00 challenge must be set before. */ public String getAuthorization() { checkChallengePresent(); return challengeRef.get().getAuthorization(getToken1()); } /** * Returns a {@link ResponseGenerator} for generating a response email. *

* The corresponding email-reply-00 challenge must be set before. */ public ResponseGenerator respond() { checkChallengePresent(); return new ResponseGenerator(this); } /** * Checks if a challenge has been set. Throws an exception if not. */ private void checkChallengePresent() { if (challengeRef.get() == null) { throw new IllegalStateException("No challenge has been set yet"); } } /** * A builder for {@link EmailProcessor}. *

* Use {@link EmailProcessor#builder()} to generate an instance. * * @since 2.16 */ public static class Builder { private boolean unsigned = false; private final SignedMailBuilder builder = new SignedMailBuilder(); private Builder() { // Private constructor } /** * Skips signature and header verification. Use only if the message has already * been verified in a previous stage (e.g. by the MTA) or for testing purposes. */ public Builder skipVerification() { this.unsigned = true; return this; } /** * Uses the standard cacerts truststore for signature verification. This is the * default. */ public Builder caCerts() { builder.withCaCertsTrustStore(); return this; } /** * Uses the given truststore for signature verification. *

* This is for self-signed certificates. No revocation checks will take place. * * @param trustStore * {@link KeyStore} of the truststore to be used. */ public Builder trustStore(KeyStore trustStore) { try { builder.withTrustStore(trustStore); } catch (KeyStoreException | InvalidAlgorithmParameterException ex) { throw new IllegalArgumentException("Cannot use trustStore", ex); } return this; } /** * Uses the given certificate for signature verification. *

* This is for self-signed certificates. No revocation checks will take place. * * @param certificate * {@link X509Certificate} of the CA */ public Builder certificate(X509Certificate certificate) { builder.withSignCert(certificate); return this; } /** * Uses the given {@link PKIXParameters}. * * @param param * {@link PKIXParameters} to be used for signature verification. */ public Builder pkixParameters(PKIXParameters param) { builder.withPKIXParameters(param); return this; } /** * Uses the given mail {@link Session} for accessing the signed message body. A * simple default session is used otherwise, which is usually sufficient. * * @param session * {@link Session} to be used for accessing the message body. */ public Builder mailSession(Session session) { builder.withMailSession(session); return this; } /** * Performs strict checks. Secured headers must exactly match their unsecured * counterparts. This is the default. */ public Builder strict() { builder.relaxed(false); return this; } /** * Performs relaxed checks. Secured headers might differ in whitespaces or case of * the field names. Use this if your MTA has mangled the envelope header. */ public Builder relaxed() { builder.relaxed(true); return this; } /** * Builds an {@link EmailProcessor} for the given {@link Message} using the * current configuration. * * @param message * {@link Message} to create an {@link EmailProcessor} for. * @return The generated {@link EmailProcessor} * @throws AcmeInvalidMessageException * if the message fails to be verified. If this exception is thrown, the * message MUST be rejected, and MUST NOT be used for certification. */ public EmailProcessor build(Message message) throws AcmeInvalidMessageException { if (unsigned) { return new EmailProcessor(new SimpleMail(message)); } else { return new EmailProcessor(builder.build(message)); } } } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/email/ResponseBodyGenerator.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.email; import jakarta.mail.Message; import jakarta.mail.MessagingException; /** * A generator for the response body to be set to the {@link Message}. *

* This generator can be used to design the body of the outgoing response email. However, * note that the response email is evaluated by a machine and usually not read by humans, * so the design should be kept simple, and must be conformous to RFC-8823. *

* The {@code responseBody} must be a part of the response email body, otherwise the * validation will fail. *

* A minimal implementation is: * 

 * response.setContent(responseBody, RESPONSE_BODY_TYPE);
 *
* * @see RFC 8823 * @since 2.12 */ @FunctionalInterface public interface ResponseBodyGenerator { /** * The content-type of the response body: {@value #RESPONSE_BODY_TYPE} */ String RESPONSE_BODY_TYPE = "text/plain"; /** * Sets the content of the {@link Message}. * * @param response * {@link Message} to set the body content. * @param responseBody * The response body that must be part of the email response, and * must use {@value #RESPONSE_BODY_TYPE} content type. */ void setContent(Message response, String responseBody) throws MessagingException; } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/email/ResponseGenerator.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.email; import static java.util.Objects.requireNonNull; import static jakarta.mail.Message.RecipientType.TO; import static org.shredzone.acme4j.smime.email.ResponseBodyGenerator.RESPONSE_BODY_TYPE; import java.util.Properties; import edu.umd.cs.findbugs.annotations.Nullable; import jakarta.mail.Address; import jakarta.mail.Message; import jakarta.mail.MessagingException; import jakarta.mail.Session; import jakarta.mail.internet.MimeMessage; /** * A helper for creating an email response to the "challenge" email. *

* According to RFC-8823, the response email must be DKIM signed. This is * not done by the response generator, but must be done by the outbound MTA. * * @see RFC 8823 * @since 2.12 */ public class ResponseGenerator { private static final int LINE_LENGTH = 72; private static final String CRLF = "\r\n"; private final EmailProcessor processor; private ResponseBodyGenerator generator = this::defaultBodyGenerator; private @Nullable String header; private @Nullable String footer; /** * Creates a new {@link ResponseGenerator}. * * @param processor * {@link EmailProcessor} of the challenge email. */ public ResponseGenerator(EmailProcessor processor) { this.processor = requireNonNull(processor, "processor"); } /** * Adds a custom header to the response mail body. *

* There is no need to set a header, since the response email is usually not read by * humans. If a header is set, it must contain ASCII encoded plain text. * * @param header * Header text to be used, or {@code null} if no header is to be used. * @return itself */ public ResponseGenerator withHeader(@Nullable String header) { if (header != null && !header.endsWith(CRLF)) { this.header = header.concat(CRLF); } else { this.header = header; } return this; } /** * Adds a custom footer to the response mail body. *

* There is no need to set a footer, since the response email is usually not read by * humans. If a footer is set, it must contain ASCII encoded plain text. * * @param footer * Footer text to be used, or {@code null} if no footer is to be used. * @return itself */ public ResponseGenerator withFooter(@Nullable String footer) { this.footer = footer; return this; } /** * Sets a {@link ResponseBodyGenerator} that is used for generating a response body. *

* Use this generator to individually style the email body, for example to use a * multipart body. However, be aware that the response mail is evaluated by a machine, * and usually not read by humans, so the body should be designed as simple as * possible. *

* The default body generator will just concatenate the header, the armored key * authorization body, and the footer. * * @param generator * {@link ResponseBodyGenerator} to be used, or {@code null} to use the * default one. * @return itself */ public ResponseGenerator withGenerator(@Nullable ResponseBodyGenerator generator) { this.generator = generator != null ? generator : this::defaultBodyGenerator; return this; } /** * Generates the response email. *

* A simple default mail session is used for generation. * * @return Generated {@link Message}. * @since 2.16 */ public Message generateResponse() throws MessagingException { return generateResponse(Session.getDefaultInstance(new Properties())); } /** * Generates the response email. *

* Note that according to RFC-8823, this message must have a valid DKIM or S/MIME * signature. This is not done here, but usually performed by the outbound * MTA. * * @param session * {@code jakarta.mail} {@link Session} to be used for this mail. * @return Generated {@link Message}. */ public Message generateResponse(Session session) throws MessagingException { var response = new MimeMessage(requireNonNull(session, "session")); response.setSubject("Re: ACME: " + processor.getToken1()); response.setFrom(processor.getRecipient()); if (!processor.getReplyTo().isEmpty()) { for (var rto : processor.getReplyTo()) { response.addRecipient(TO, rto); } } else { response.addRecipients(TO, new Address[] {processor.getSender()}); } if (processor.getMessageId().isPresent()) { response.setHeader("In-Reply-To", processor.getMessageId().get()); } var wrappedAuth = processor.getAuthorization() .replaceAll("(.{" + LINE_LENGTH + "})", "$1" + CRLF); var responseBody = new StringBuilder(); responseBody.append("-----BEGIN ACME RESPONSE-----").append(CRLF); responseBody.append(wrappedAuth); if (!wrappedAuth.endsWith(CRLF)) { responseBody.append(CRLF); } responseBody.append("-----END ACME RESPONSE-----").append(CRLF); generator.setContent(response, responseBody.toString()); return response; } /** * The default body generator. It just sets the response body, optionally framed by * the given header and footer. * * @param response * response {@link Message} to fill. * @param responseBody * Response body that must be added to the message. */ private void defaultBodyGenerator(Message response, String responseBody) throws MessagingException { var body = new StringBuilder(); if (header != null) { body.append(header); } body.append(responseBody); if (footer != null) { body.append(footer); } response.setContent(body.toString(), RESPONSE_BODY_TYPE); } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/email/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * This package contains classes for processing incoming validation emails, and for * generating outgoing response emails. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.smime.email; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/exception/AcmeInvalidMessageException.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2022 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.exception; import static java.util.Collections.unmodifiableList; import java.io.Serial; import java.util.ArrayList; import java.util.Collections; import java.util.List; import java.util.Optional; import org.bouncycastle.i18n.ErrorBundle; import org.bouncycastle.i18n.LocalizedException; import org.shredzone.acme4j.exception.AcmeException; /** * This exception is thrown when the challenge email message is invalid. *

* If this exception is thrown, the challenge message does not match the actual challenge * or has other issues. It must be rejected. *

* Reasons may be (for example): *

    *
  • Unexpected sender address
    • *
  • Bad S/MIME signature
    • *
* * @since 2.15 */ public class AcmeInvalidMessageException extends AcmeException { @Serial private static final long serialVersionUID = 5607857024718309330L; private final List errors; /** * Creates a new {@link AcmeInvalidMessageException}. * * @param msg * Reason of the exception */ public AcmeInvalidMessageException(String msg) { super(msg); this.errors = Collections.emptyList(); } /** * Creates a new {@link AcmeInvalidMessageException}. * * @param msg * Reason of the exception * @param errors * List of {@link ErrorBundle} with further details * @since 2.16 */ public AcmeInvalidMessageException(String msg, List errors) { super(msg); this.errors = unmodifiableList(errors); } /** * Creates a new {@link AcmeInvalidMessageException}. * * @param msg * Reason of the exception * @param cause * Cause */ public AcmeInvalidMessageException(String msg, Throwable cause) { super(msg, cause); var errors = new ArrayList(1); Optional.ofNullable(cause) .filter(LocalizedException.class::isInstance) .map(LocalizedException.class::cast) .map(LocalizedException::getErrorMessage) .ifPresent(errors::add); this.errors = unmodifiableList(errors); } /** * Returns a list with further error details, if available. The list may be empty, but * is never {@code null}. * * @since 2.16 */ public List getErrors() { return errors; } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/exception/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2022 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * Exceptions that are related to S/MIME signatures. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.smime.exception; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * An acme4j extension that provides S/MIME certificate features. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.smime; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/wrapper/Mail.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.wrapper; import java.util.Collection; import java.util.Optional; import jakarta.mail.internet.InternetAddress; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; /** * Provide access to all required fields of an email. The underlying implementation * has to take care about parsing, validation, and verification of security features. * * @since 2.16 */ public interface Mail { /** * Returns the sender address. * * @throws AcmeInvalidMessageException * if there is not exactly one "From" header, or if the sender address is * invalid. */ InternetAddress getFrom() throws AcmeInvalidMessageException; /** * Returns the recipient address. * * @throws AcmeInvalidMessageException * if there is not exactly one "To" header, or if the recipient address is * invalid. */ InternetAddress getTo() throws AcmeInvalidMessageException; /** * Returns the subject. * * @throws AcmeInvalidMessageException if there is no "Subject" header. */ String getSubject() throws AcmeInvalidMessageException; /** * Returns a collection of the reply-to addresses. Reply-to addresses that are not * {@link InternetAddress} type are ignored. * * @return Collection of reply-to addresses. May be empty, but is never {@code null}. * @throws AcmeInvalidMessageException * if the "Reply-To" header could not be parsed */ Collection getReplyTo() throws AcmeInvalidMessageException; /** * Returns the message ID. * * @return Message ID, or empty if there is no message ID header. * @throws AcmeInvalidMessageException * if the "Message-ID" header could not be parsed */ Optional getMessageId() throws AcmeInvalidMessageException; /** * Checks if the mail was flagged as auto-generated. * * @return {@code true} if there is an "Auto-Submitted" header containing the string * "auto-generated", {@code false} otherwise. * @throws AcmeInvalidMessageException * if the "Auto-Submitted" header could not be parsed. */ boolean isAutoSubmitted() throws AcmeInvalidMessageException; } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/wrapper/SignedMail.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.wrapper; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; import java.util.Enumeration; import java.util.List; import java.util.Locale; import java.util.Optional; import java.util.Set; import java.util.TreeSet; import java.util.stream.Collectors; import edu.umd.cs.findbugs.annotations.Nullable; import jakarta.mail.Header; import jakarta.mail.Message; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import org.bouncycastle.asn1.ASN1Enumerated; import org.bouncycastle.asn1.ASN1Integer; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.ASN1Sequence; import org.bouncycastle.asn1.ASN1Set; import org.bouncycastle.asn1.ASN1String; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; import org.bouncycastle.cms.SignerInformation; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; /** * Represents a signed {@link Message}. *

* This class is generated by {@link SignedMailBuilder}, which also takes care for * signature verification and validation. * * @see RFC 7508 * @since 2.16 */ public class SignedMail implements Mail { private static final ASN1ObjectIdentifier SECURE_HEADER_FIELDS_ID = PKCSObjectIdentifiers.pkcs_9.branch("16.2.55"); private static final Set IGNORE_HEADERS = Set.of("CONTENT-TYPE", "MIME-VERSION", "RECEIVED"); private static final Set REQUIRED_HEADERS = Set.of("FROM", "TO", "SUBJECT"); private final List headers = new ArrayList<>(); /** * This class is to be constructed only by {@link SignedMailBuilder}. */ SignedMail() { // package protected constructor } /** * Imports untrusted headers from the envelope message. *

* All previously imported headers are cleaned before that. */ public void importUntrustedHeaders(Enumeration

en) { headers.clear(); while (en.hasMoreElements()) { var h = en.nextElement(); var name = h.getName(); if (IGNORE_HEADERS.contains(name.toUpperCase(Locale.ENGLISH))) { continue; } headers.add(new MailHeader(name, h.getValue())); } } /** * Imports secured headers from the signed, inner message. *

* The import is strict. If a secured header is also present in the envelope message, * it must match exactly. * * @throws AcmeInvalidMessageException * if the secured header was found in the envelope message, but did not match. */ public void importTrustedHeaders(Enumeration

en) throws AcmeInvalidMessageException { while (en.hasMoreElements()) { var h = en.nextElement(); var name = h.getName(); if (IGNORE_HEADERS.contains(name.toUpperCase(Locale.ENGLISH))) { continue; } var value = h.getValue(); var count = headers.stream() .filter(mh -> mh.nameEquals(name, false) && mh.valueEquals(value, false)) .peek(MailHeader::setTrusted) .count(); if (count == 0) { throw new AcmeInvalidMessageException("Secured header '" + name + "' does not match envelope header"); } } } /** * Imports secured headers from the signed, inner message. *

* The import is relaxed. If the secured header is also found in the envelope message * header, it will replace the envelope header. */ public void importTrustedHeadersRelaxed(Enumeration

en) { while (en.hasMoreElements()) { var h = en.nextElement(); var name = h.getName(); if (IGNORE_HEADERS.contains(name.toUpperCase(Locale.ENGLISH))) { continue; } headers.removeIf(mh -> mh.nameEquals(name, true) && !mh.trusted); headers.add(new MailHeader(name, h.getValue()).setTrusted()); } } /** * Imports secured headers from the signature. *

* Depending on the signature, the envelope header is either checked, deleted, or * modified. * * @throws AcmeInvalidMessageException * if the signature header conflicts with the envelope header. */ public void importSignatureHeaders(SignerInformation si) throws AcmeInvalidMessageException { var attr = si.getSignedAttributes().get(SECURE_HEADER_FIELDS_ID); if (attr == null) { return; } var relaxed = false; for (var element : (ASN1Set) attr.getAttributeValues()[0]) { if (element instanceof ASN1Enumerated asn1element) { var algorithm = asn1element.intValueExact(); relaxed = switch (algorithm) { case 0 -> false; case 1 -> true; default -> throw new AcmeInvalidMessageException("Unknown algorithm: " + algorithm); }; } } for (var element : (ASN1Set) attr.getAttributeValues()[0]) { if (element instanceof ASN1Sequence asn1sequence) { for (var sequenceElement : asn1sequence) { var headerField = (ASN1Sequence) sequenceElement; var fieldName = ((ASN1String) headerField.getObjectAt(0)).getString(); var fieldValue = ((ASN1String) headerField.getObjectAt(1)).getString(); var fieldStatus = 0; if (headerField.size() >= 3) { fieldStatus = ((ASN1Integer) headerField.getObjectAt(2)).intValueExact(); } switch (fieldStatus) { case 0: checkDuplicatedField(fieldName, fieldValue, relaxed); break; case 1: deleteField(fieldName, fieldValue, relaxed); break; case 2: modifyField(fieldName, fieldValue, relaxed); break; default: throw new AcmeInvalidMessageException("Unknown field status " + fieldStatus); } } } } } @Override public InternetAddress getFrom() throws AcmeInvalidMessageException { try { return new InternetAddress(fetchTrustedHeader("FROM")); } catch (AddressException ex) { throw new AcmeInvalidMessageException("Invalid 'FROM' address", ex); } } @Override public InternetAddress getTo() throws AcmeInvalidMessageException { try { return new InternetAddress(fetchTrustedHeader("TO")); } catch (AddressException ex) { throw new AcmeInvalidMessageException("Invalid 'TO' address", ex); } } @Override public String getSubject() throws AcmeInvalidMessageException { return fetchTrustedHeader("SUBJECT"); } @Override public Optional getMessageId() { return headers.stream() .filter(mh -> "MESSAGE-ID".equalsIgnoreCase(mh.name)) .map(mh -> mh.value) .map(String::trim) .findFirst(); } @Override public Collection getReplyTo() throws AcmeInvalidMessageException { var replyToList = headers.stream() .filter(mh -> "REPLY-TO".equalsIgnoreCase(mh.name)) .map(mh -> mh.value) .map(String::trim) .collect(Collectors.toList()); if (replyToList.isEmpty()) { return Collections.emptyList(); } try { var result = new ArrayList(replyToList.size()); for (var replyTo : replyToList) { result.add(new InternetAddress(replyTo)); } return Collections.unmodifiableList(result); } catch (AddressException ex) { throw new AcmeInvalidMessageException("Invalid 'REPLY-TO' address", ex); } } @Override public boolean isAutoSubmitted() { return headers.stream() .filter(mh -> "AUTO-SUBMITTED".equalsIgnoreCase(mh.name)) .map(mh -> mh.value) .map(String::trim) .map(mh -> mh.toLowerCase(Locale.ENGLISH)) .anyMatch(h -> h.equals("auto-generated") || h.startsWith("auto-generated;")); } /** * Returns a set of missing, but required secured headers. This list is supposed to * be empty on valid messages with secured headers. If there is at least one element, * the message must be refused. */ public Set getMissingSecuredHeaders() { var missing = new TreeSet<>(REQUIRED_HEADERS); headers.stream() .filter(mh -> mh.trusted) .map(mh -> mh.name) .map(mh -> mh.toUpperCase(Locale.ENGLISH)) .forEach(missing::remove); return missing; } /** * Processes a "duplicated" header field status. The signature header must be found * with the same value in the envelope message header. * * @param header * Header name * @param value * Expected header value * @param relaxed * {@code false}: simple, {@code true}: relaxed algorithm * @throws AcmeInvalidMessageException * if a header with the same value was not found */ protected void checkDuplicatedField(String header, String value, boolean relaxed) throws AcmeInvalidMessageException { var count = headers.stream() .filter(mh -> mh.nameEquals(header, relaxed) && mh.valueEquals(value, relaxed)) .peek(MailHeader::setTrusted) .count(); if (count == 0) { throw new AcmeInvalidMessageException("Secured header '" + header + "' was not found in envelope header"); } } /** * Processes a "deleted" header field status. The signature header must be found * with the same value in the envelope message header, and is then removed from the * header. * * @param header * Header name * @param value * Expected header value * @param relaxed * {@code false}: simple, {@code true}: relaxed algorithm * @throws AcmeInvalidMessageException * if a header with the same value was not found */ protected void deleteField(String header, String value, boolean relaxed) throws AcmeInvalidMessageException { if (!headers.removeIf(mh -> mh.nameEquals(header, relaxed) && mh.valueEquals(value, relaxed))) { throw new AcmeInvalidMessageException("Secured header '" + header + "' was not found in envelope header for deletion"); } } /** * Processes a "modified" header field status. The signature header must be found in * the envelope message header, and is then replaced with the given value. * * @param header * Header name * @param value * New header value * @param relaxed * {@code false}: simple, {@code true}: relaxed algorithm * @throws AcmeInvalidMessageException * if the header was not found */ protected void modifyField(String header, String value, boolean relaxed) throws AcmeInvalidMessageException { if (!headers.removeIf(mh -> mh.nameEquals(header, relaxed))) { throw new AcmeInvalidMessageException("Secured header '" + header + "' was not found in envelope header for modification"); } headers.add(new MailHeader(header, value).setTrusted()); } /** * Fetches a trusted header. The header must be present exactly once, and must be * marked as trusted, i.e. it was either found in the signed inner message, or was * set by the signature headers. * * @param name * Name of the header, case-insensitive * @return Header value * @throws AcmeInvalidMessageException * if the header was not found, was found more than once, or is not marked as * trusted */ private String fetchTrustedHeader(String name) throws AcmeInvalidMessageException { var candidates = headers.stream() .filter(mh -> name.equalsIgnoreCase(mh.name)) .filter(mh -> mh.trusted) .map(mh -> mh.value) .map(String::trim) .collect(Collectors.toList()); if (candidates.isEmpty()) { throw new AcmeInvalidMessageException("Protected '" + name + "' header is required, but missing"); } if (candidates.size() > 1) { throw new AcmeInvalidMessageException("Expecting exactly one protected '" + name + "' header, but found " + candidates.size()); } return candidates.get(0); } @Override public String toString() { var sb = new StringBuilder(); for (var mh : headers) { sb.append(mh.toString()).append('\n'); } return sb.toString(); } /** * A single mail header. */ private static class MailHeader { public final String name; public final String value; public boolean trusted; /** * Creates a new mail header. * * @param name Header name * @param value Header value */ public MailHeader(String name, String value) { this.name = name; this.value = value; } /** * Marks this header as trusted. * * @return itself */ public MailHeader setTrusted() { trusted = true; return this; } /** * Checks if the header name equals the expected value. * * @param expected * Expected name * @param relaxed * {@code false}: names must match exactly, {@code true}: case-insensitive * match * @return {@code true} if equal */ public boolean nameEquals(@Nullable String expected, boolean relaxed) { if (!relaxed) { return name.equals(expected); } if (expected == null) { return false; } return name.equalsIgnoreCase(expected); } /** * Checks if the header value equals the expected value. * * @param expected * Expected value, may be {@code null} * @param relaxed * {@code false}: value must match exactly, {@code true}: differences in * whitespaces are ignored * @return {@code true} if equal */ public boolean valueEquals(@Nullable String expected, boolean relaxed) { if (!relaxed) { return value.equals(expected); } if (expected == null) { return false; } var normalizedValue = value.replaceAll("\\s+", " ").trim(); var normalizedExpected = expected.replaceAll("\\s+", " ").trim(); return normalizedValue.equals(normalizedExpected); } @Override public String toString() { return (trusted ? "* " : " ") + name + ": " + value; } } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/wrapper/SignedMailBuilder.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.wrapper; import static java.util.Objects.requireNonNull; import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.security.InvalidAlgorithmParameterException; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.security.cert.CertificateException; import java.security.cert.PKIXParameters; import java.security.cert.X509Certificate; import java.util.Collection; import java.util.Properties; import java.util.Set; import java.util.concurrent.atomic.AtomicReference; import edu.umd.cs.findbugs.annotations.Nullable; import jakarta.mail.Message; import jakarta.mail.MessagingException; import jakarta.mail.Session; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import jakarta.mail.internet.MimeMessage; import jakarta.mail.internet.MimeMultipart; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cms.CMSException; import org.bouncycastle.cms.SignerInformation; import org.bouncycastle.mail.smime.SMIMESigned; import org.bouncycastle.mail.smime.validator.SignedMailValidator; import org.bouncycastle.mail.smime.validator.SignedMailValidatorException; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; /** * Creates a {@link SignedMail} instance from a signed message. * * @since 2.16 */ public class SignedMailBuilder { private static final AtomicReference CACERTS_TRUSTSTORE = new AtomicReference<>(); private Session mailSession = Session.getDefaultInstance(new Properties()); private volatile boolean relaxed = false; @Nullable private PKIXParameters pkixParameters = null; /** * Uses the standard cacerts truststore. This is the default. */ public SignedMailBuilder withCaCertsTrustStore() { pkixParameters = null; return this; } /** * Uses the given {@link X509Certificate} for certificate validation. *

* This is for self-signed certificates. No revocation checks will take place. * * @param signCert {@link X509Certificate} to use. * @return itself */ public SignedMailBuilder withSignCert(X509Certificate signCert) { requireNonNull(signCert, "signCert"); try { KeyStore ks = KeyStore.getInstance("JKS"); ks.load(null, null); ks.setCertificateEntry("cert", signCert); return withTrustStore(ks); } catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException | InvalidAlgorithmParameterException ex) { throw new IllegalArgumentException("Invalid certificate", ex); } } /** * Uses the given truststore for certificate validation. *

* This is for self-signed certificates. No revocation checks will take place. * * @param trustStore {@link KeyStore} to use. * @return itself */ public SignedMailBuilder withTrustStore(KeyStore trustStore) throws KeyStoreException, InvalidAlgorithmParameterException { requireNonNull(trustStore, "trustStore"); PKIXParameters param = new PKIXParameters(trustStore); param.setRevocationEnabled(false); return withPKIXParameters(param); } /** * Uses the given {@link PKIXParameters} for certificate validation. * * @param param {@link PKIXParameters} to use. * @return itself */ public SignedMailBuilder withPKIXParameters(PKIXParameters param) { this.pkixParameters = requireNonNull(param, "param"); return this; } /** * Sets a different mail {@link Session} that is used for accessing the signed * email body. * * @param mailSession {@link Session} to use. * @return itself */ public SignedMailBuilder withMailSession(Session mailSession) { this.mailSession = requireNonNull(mailSession, "mailSession"); return this; } /** * Changes relaxed validation. If enabled, headers of the signed message body are * preferred if present, but do not need to match the appropriate headers of the * envelope message. *

* By default, relaxed validation is disabled. * * @param relaxed sets relaxed validation mode * @return itself */ public SignedMailBuilder relaxed(boolean relaxed) { this.relaxed = relaxed; return this; } /** * Validates the message signature and message headers. If validation passes, a * {@link SignedMail} instance is returned that gives access to the trusted mail * headers. * * @param message {@link Message}, must be a {@link MimeMessage}. * @return SignedMail containing the trusted headers. * @throws AcmeInvalidMessageException * if the given message is invalid, its signature is invalid, or the secured * headers are invalid. If this exception is thrown, the message MUST be * rejected. */ public SignedMail build(Message message) throws AcmeInvalidMessageException { requireNonNull(message, "message"); try { // Check all parameters if (!(message instanceof MimeMessage mimeMessage)) { throw new IllegalArgumentException("Message must be a MimeMessage"); } if (!(mimeMessage.getContent() instanceof MimeMultipart contentMultipart)) { throw new AcmeProtocolException("S/MIME signed message must contain MimeMultipart"); } if (pkixParameters == null) { pkixParameters = new PKIXParameters(getCaCertsTrustStore()); } // Get the signed message SMIMESigned signed = new SMIMESigned(contentMultipart); // Validate the signature SignerInformation si = validateSignature(mimeMessage, pkixParameters); // Collect the headers SignedMail result = new SignedMail(); // First import all untrusted headers from the envelope message result.importUntrustedHeaders(mimeMessage.getAllHeaders()); // If there is an inner, signed message, import all signed headers MimeMessage content = signed.getContentAsMimeMessage(mailSession); if (content != null && content.isMimeType("message/rfc822")) { MimeMessage protectedBody = new MimeMessage(mailSession, content.getInputStream()); if (relaxed) { result.importTrustedHeadersRelaxed(protectedBody.getAllHeaders()); } else { result.importTrustedHeaders(protectedBody.getAllHeaders()); } } // Import secured headers from the signature, if present result.importSignatureHeaders(si); // Check if all mandatory headers are trusted Set missing = result.getMissingSecuredHeaders(); if (!missing.isEmpty()) { throw new AcmeInvalidMessageException("Secured headers expected, but missing: " + String.join(", ", missing)); } // Check if the signer matches the mail sender InternetAddress signerAddress = validateSigatureSender(signed, si); if (!result.getFrom().equals(signerAddress)) { throw new AcmeInvalidMessageException("Message is not signed by the expected sender"); } return result; } catch (IOException | MessagingException | CMSException | KeyStoreException | InvalidAlgorithmParameterException ex) { throw new AcmeInvalidMessageException("Could not validate message signature", ex); } } /** * Validates the signature of the signed message. * * @return The {@link SignerInformation} of the valid signature. * @throws AcmeInvalidMessageException * if the signature is invalid, or if the message was signed with more than * one signature. */ @SuppressWarnings("unchecked") private SignerInformation validateSignature(MimeMessage message, PKIXParameters pkixParameters) throws AcmeInvalidMessageException { try { var smv = new SignedMailValidator(message, pkixParameters); var store = smv.getSignerInformationStore(); if (store.size() != 1) { throw new AcmeInvalidMessageException("Expected exactly one signer, but found " + store.size()); } var si = store.getSigners().iterator().next(); var vr = smv.getValidationResult(si); if (!vr.isValidSignature()) { throw new AcmeInvalidMessageException("Invalid signature", vr.getErrors()); } return si; } catch (SignedMailValidatorException ex) { throw new AcmeInvalidMessageException("Cannot validate signature", ex); } } /** * Validates the signature of the sender. It MUST contain a subjectAltName extension * with a rfc822Name that matches the sender. * * @param signed * {@link SMIMESigned} of the signed message * @param si * {@link SignerInformation} of the message signer * @return The {@link InternetAddress} of the rfc822Name found in the subjectAltName * @throws AcmeInvalidMessageException * if no signature was found, or if the signature has no subjectAltName * extension with rfc822Name. */ @SuppressWarnings("unchecked") private InternetAddress validateSigatureSender(SMIMESigned signed, SignerInformation si) throws AcmeInvalidMessageException { Collection certCollection = signed.getCertificates().getMatches(si.getSID()); if (certCollection.isEmpty()) { throw new AcmeInvalidMessageException("Could not find certificate for signer ID " + si.getSID().toString()); } var ch = certCollection.iterator().next(); var gns = GeneralNames.fromExtensions(ch.getExtensions(), Extension.subjectAlternativeName); if (gns == null) { throw new AcmeInvalidMessageException("Certificate does not have a subjectAltName extension"); } for (var name : gns.getNames()) { if (name.getTagNo() == GeneralName.rfc822Name) { try { return new InternetAddress(name.getName().toString()); } catch (AddressException ex) { throw new AcmeInvalidMessageException("Invalid certificate email address: " + name.getName().toString(), ex); } } } throw new AcmeInvalidMessageException("No rfc822Name found in subjectAltName extension"); } /** * Generates a truststore from Java's own cacerts file. The result is cached. * * @return CaCerts truststore */ protected static KeyStore getCaCertsTrustStore() { var caCerts = CACERTS_TRUSTSTORE.get(); if (caCerts == null) { var javaHome = System.getProperty("java.home"); var caFileName = javaHome + File.separator + "lib" + File.separator + "security" + File.separator + "cacerts"; try (var in = new FileInputStream(caFileName)) { caCerts = KeyStore.getInstance("JKS"); caCerts.load(in, "changeit".toCharArray()); CACERTS_TRUSTSTORE.set(caCerts); } catch (KeyStoreException | IOException | CertificateException | NoSuchAlgorithmException ex) { throw new IllegalStateException("Cannot access cacerts", ex); } } return caCerts; } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/wrapper/SimpleMail.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.wrapper; import static java.util.Objects.requireNonNull; import static java.util.stream.Collectors.toUnmodifiableList; import java.util.Arrays; import java.util.Collection; import java.util.Collections; import java.util.Locale; import java.util.Optional; import jakarta.mail.Message; import jakarta.mail.MessagingException; import jakarta.mail.internet.InternetAddress; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; /** * Represents a simple, unsigned {@link Message}. *

* There is no signature validation at all. Use this class only for testing purposes, * or if a validation has already been performed in a separate step. * * @since 2.16 */ public class SimpleMail implements Mail { private static final String HEADER_MESSAGE_ID = "Message-ID"; private static final String HEADER_AUTO_SUBMITTED = "Auto-Submitted"; private final Message message; public SimpleMail(Message message) { this.message = requireNonNull(message, "message"); } @Override public InternetAddress getFrom() throws AcmeInvalidMessageException { try { var from = message.getFrom(); if (from == null) { throw new AcmeInvalidMessageException("Missing required 'From' header"); } if (from.length != 1) { throw new AcmeInvalidMessageException("Message must have exactly one sender, but has " + from.length); } if (!(from[0] instanceof InternetAddress from0)) { throw new AcmeInvalidMessageException("Invalid sender message type: " + from[0].getClass().getName()); } return from0; } catch (MessagingException ex) { throw new AcmeInvalidMessageException("Could not read 'From' header", ex); } } @Override public InternetAddress getTo() throws AcmeInvalidMessageException { try { var to = message.getRecipients(Message.RecipientType.TO); if (to == null) { throw new AcmeInvalidMessageException("Missing required 'To' header"); } if (to.length != 1) { throw new AcmeInvalidMessageException("Message must have exactly one recipient, but has " + to.length); } if (!(to[0] instanceof InternetAddress to0)) { throw new AcmeInvalidMessageException("Invalid recipient message type: " + to[0].getClass().getName()); } return to0; } catch (MessagingException ex) { throw new AcmeInvalidMessageException("Could not read 'To' header", ex); } } @Override public String getSubject() throws AcmeInvalidMessageException { try { var subject = message.getSubject(); if (subject == null) { throw new AcmeInvalidMessageException("Message must have a subject"); } return subject; } catch (MessagingException ex) { throw new AcmeInvalidMessageException("Could not read 'Subject' header", ex); } } @Override public Collection getReplyTo() throws AcmeInvalidMessageException { try { var rto = message.getReplyTo(); if (rto == null) { return Collections.emptyList(); } return Arrays.stream(rto) .filter(InternetAddress.class::isInstance) .map(InternetAddress.class::cast) .collect(toUnmodifiableList()); } catch (MessagingException ex) { throw new AcmeInvalidMessageException("Could not read 'Reply-To' header", ex); } } @Override public Optional getMessageId() throws AcmeInvalidMessageException { try { var mid = message.getHeader(HEADER_MESSAGE_ID); if (mid == null || mid.length == 0) { return Optional.empty(); } if (mid.length > 1) { throw new AcmeInvalidMessageException("Expected one Message-ID, but found " + mid.length); } return Optional.of(mid[0]); } catch (MessagingException ex) { throw new AcmeInvalidMessageException("Could not read '" + HEADER_MESSAGE_ID + "' header", ex); } } @Override public boolean isAutoSubmitted() throws AcmeInvalidMessageException { try { var autoSubmitted = message.getHeader(HEADER_AUTO_SUBMITTED); if (autoSubmitted == null) { return false; } return Arrays.stream(autoSubmitted) .map(String::trim) .map(as -> as.toLowerCase(Locale.ENGLISH)) .anyMatch(h -> h.equals("auto-generated") || h.startsWith("auto-generated;")); } catch (MessagingException ex) { throw new AcmeInvalidMessageException("Could not read '" + HEADER_AUTO_SUBMITTED + "' header", ex); } } } ================================================ FILE: acme4j-smime/src/main/java/org/shredzone/acme4j/smime/wrapper/package-info.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ /** * {@link org.shredzone.acme4j.smime.wrapper.Mail} is a wrapper interface which provides * access to all relevant headers of the validation email. Usually * {@link org.shredzone.acme4j.smime.wrapper.SignedMailBuilder} is used for parsing the * email and validating the signature. * {@link org.shredzone.acme4j.smime.wrapper.SimpleMail} is a simple implementation that * should only be used for testing purposes or after an external validation. */ @ReturnValuesAreNonnullByDefault @DefaultAnnotationForParameters(NonNull.class) @DefaultAnnotationForFields(NonNull.class) package org.shredzone.acme4j.smime.wrapper; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields; import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters; import edu.umd.cs.findbugs.annotations.NonNull; import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault; ================================================ FILE: acme4j-smime/src/main/resources/.gitignore ================================================ ================================================ FILE: acme4j-smime/src/main/resources/META-INF/services/org.shredzone.acme4j.provider.ChallengeProvider ================================================ # Challenge Provider for https://datatracker.ietf.org/doc/html/rfc8823 org.shredzone.acme4j.smime.challenge.EmailReply00ChallengeProvider ================================================ FILE: acme4j-smime/src/test/java/.gitignore ================================================ ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/EmailIdentifierTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime; import static org.assertj.core.api.Assertions.assertThat; import java.util.stream.Stream; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.Arguments; import org.junit.jupiter.params.provider.MethodSource; /** * Tests of {@link EmailIdentifier}. */ public class EmailIdentifierTest { @Test public void testConstants() { assertThat(EmailIdentifier.TYPE_EMAIL).isEqualTo("email"); } @ParameterizedTest @MethodSource("provideTestEmails") public void testEmail(Object input, String expected) { var id = input instanceof InternetAddress internetAddress ? EmailIdentifier.email(internetAddress) : EmailIdentifier.email(input.toString()); assertThat(id.getType()).isEqualTo(EmailIdentifier.TYPE_EMAIL); assertThat(id.getValue()).isEqualTo(expected); assertThat(id.getEmailAddress().getAddress()).isEqualTo(expected); } public static Stream provideTestEmails() throws AddressException { return Stream.of( Arguments.of("email@example.com", "email@example.com"), Arguments.of(new InternetAddress("email@example.com"), "email@example.com"), Arguments.of(new InternetAddress("Example Corp "), "info@example.com") ); } } ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/SMIMETests.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; import java.io.IOException; import java.io.InputStreamReader; import java.io.UncheckedIOException; import java.nio.charset.StandardCharsets; import java.security.KeyPair; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.util.Properties; import jakarta.mail.Message; import jakarta.mail.MessagingException; import jakarta.mail.Session; import jakarta.mail.internet.InternetAddress; import jakarta.mail.internet.MimeMessage; import org.shredzone.acme4j.Login; import org.shredzone.acme4j.smime.challenge.EmailReply00Challenge; import org.shredzone.acme4j.toolbox.JSON; import org.shredzone.acme4j.util.KeyPairUtils; /** * Some common helper methods for S/MIME unit tests. */ public abstract class SMIMETests { public static final String TOKEN_PART1 = "LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME="; public static final String TOKEN_PART2 = "DGyRejmCefe7v4NfDGDKfA"; public static final String TOKEN = TOKEN_PART1 + TOKEN_PART2; public static final String KEY_AUTHORIZATION = "AjXW0h9_4YMP6Sv-9tKQNUrapI0us7ayBn0nCGOkUsk"; public static final String RESPONSE_BODY = "-----BEGIN ACME RESPONSE-----\r\n" + KEY_AUTHORIZATION + "\r\n" + "-----END ACME RESPONSE-----\r\n"; protected final Session mailSession = Session.getDefaultInstance(new Properties()); /** * Safely generates an {@link InternetAddress} from the given email address. */ protected InternetAddress email(String address) { try { return new InternetAddress(address); } catch (MessagingException ex) { throw new IllegalArgumentException(ex); } } /** * Creates a mock {@link Message}. * * @param name * Name of the mock message to be read from the test resources. * @return Mock {@link MimeMessage} that was created */ protected MimeMessage mockMessage(String name) { try (var in = SMIMETests.class.getResourceAsStream("/email/" + name + ".eml")) { return new MimeMessage(mailSession, in); } catch (IOException ex) { throw new UncheckedIOException(ex); } catch (MessagingException ex) { throw new IllegalStateException(ex); } } /** * Returns a mock account key pair to be used for signing. */ protected KeyPair mockAccountKey() { try (var r = new InputStreamReader( SMIMETests.class.getResourceAsStream("/key.pem"), StandardCharsets.UTF_8)) { return KeyPairUtils.readKeyPair(r); } catch (IOException ex) { throw new UncheckedIOException(ex); } } /** * Returns a mock {@link Login} that can be used for signing. */ protected Login mockLogin() { var login = mock(Login.class); when(login.getPublicKey()).thenReturn(mockAccountKey().getPublic()); return login; } /** * Returns a mock {@link EmailReply00Challenge}. * * @param name * Resource name of the mock challenge * @return Generated {@link EmailReply00Challenge} */ protected EmailReply00Challenge mockChallenge(String name) { return new EmailReply00Challenge(mockLogin(), getJSON(name)); } /** * Reads a JSON string from json test files and parses it. * * @param key * JSON resource * @return Parsed JSON resource */ protected JSON getJSON(String key) { try { return JSON.parse(SMIMETests.class.getResourceAsStream("/json/" + key + ".json")); } catch (IOException ex) { throw new UncheckedIOException(ex); } } /** * Reads a certificate from the given resource. * * @param name * Resource name of the certificate * @return X509Certificate that was read */ protected X509Certificate readCertificate(String name) throws IOException { try (var in = SMIMETests.class.getResourceAsStream("/" + name + ".pem")) { var cf = CertificateFactory.getInstance("X.509"); return (X509Certificate) cf.generateCertificate(in); } catch (CertificateException ex) { throw new IOException(ex); } } } ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/challenge/EmailReply00ChallengeTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.challenge; import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertThrows; import java.net.URI; import java.net.URL; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Status; import org.shredzone.acme4j.provider.AbstractAcmeProvider; import org.shredzone.acme4j.smime.SMIMETests; /** * Unit tests for {@link EmailReply00Challenge}. */ public class EmailReply00ChallengeTest extends SMIMETests { /** * Test that the challenge provider is found and the challenge is generated properly. */ @Test public void testCreateChallenge() { var provider = new TestAcmeProvider(); var challenge = provider.createChallenge(mockLogin(), getJSON("emailReplyChallenge")); assertThat(challenge).isNotNull(); assertThat(challenge).isInstanceOf(EmailReply00Challenge.class); } /** * Test that {@link EmailReply00Challenge} generates a correct authorization key. */ @Test public void testEmailReplyChallenge() { var challenge = new EmailReply00Challenge(mockLogin(), getJSON("emailReplyChallenge")); assertThat(challenge.getType()).isEqualTo(EmailReply00Challenge.TYPE); assertThat(challenge.getStatus()).isEqualTo(Status.PENDING); assertThat(challenge.getToken(TOKEN_PART1)).isEqualTo(TOKEN_PART1 + TOKEN_PART2); assertThat(challenge.getTokenPart2()).isEqualTo(TOKEN_PART2); assertThat(challenge.getAuthorization(TOKEN_PART1)).isEqualTo(KEY_AUTHORIZATION); assertThat(challenge.getFrom()).isEqualTo("acme-generator@example.org"); assertThat(challenge.getExpectedSender().getAddress()).isEqualTo("acme-generator@example.org"); } /** * Test that {@link EmailReply00Challenge#getAuthorization()} is not implemented. */ @Test public void testInvalidGetAuthorization() { assertThrows(UnsupportedOperationException.class, () -> { var challenge = new EmailReply00Challenge(mockLogin(), getJSON("emailReplyChallenge")); challenge.getAuthorization(); }); } /** * A minimal {@link AbstractAcmeProvider} implementation for testing the challenge * builder. */ private static class TestAcmeProvider extends AbstractAcmeProvider { @Override public boolean accepts(URI serverUri) { throw new UnsupportedOperationException(); } @Override public URL resolve(URI serverUri) { throw new UnsupportedOperationException(); } } } ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/csr/SMIMECSRBuilderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.csr; import static java.nio.charset.StandardCharsets.UTF_8; import static org.assertj.core.api.Assertions.*; import static org.junit.jupiter.api.Assertions.assertThrows; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.StringReader; import java.io.StringWriter; import java.security.KeyPair; import java.security.Security; import java.util.Arrays; import jakarta.mail.internet.AddressException; import jakarta.mail.internet.InternetAddress; import org.assertj.core.api.AutoCloseableSoftAssertions; import org.bouncycastle.asn1.ASN1IA5String; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.DERBitString; import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.asn1.x500.style.BCStyle; import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.Extensions; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.asn1.x509.KeyUsage; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.openssl.PEMParser; import org.bouncycastle.pkcs.PKCS10CertificationRequest; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.util.KeyPairUtils; /** * Unit tests for {@link SMIMECSRBuilder}. */ public class SMIMECSRBuilderTest { private static KeyPair testKey; @BeforeAll public static void setup() { Security.addProvider(new BouncyCastleProvider()); testKey = KeyPairUtils.createKeyPair(512); } /** * Test if the generated S/MIME CSR is plausible. */ @Test public void testSMIMEGenerate() throws IOException, AddressException { var builder = new SMIMECSRBuilder(); builder.addEmail(new InternetAddress("Contact ")); builder.addEmail(new InternetAddress("Info ")); builder.addEmails(new InternetAddress("Sales Dept "), new InternetAddress("shop@example.com")); builder.addEmails(Arrays.asList( new InternetAddress("support@example.com"), new InternetAddress("help@example.com")) ); builder.setCountry("XX"); builder.setLocality("Testville"); builder.setOrganization("Testing Co"); builder.setOrganizationalUnit("Testunit"); builder.setState("ABC"); assertThat(builder.toString()).isEqualTo("CN=mail@example.com,C=XX,L=Testville," + "O=Testing Co,OU=Testunit,ST=ABC," + "EMAIL=mail@example.com,EMAIL=info@example.com," + "EMAIL=sales@example.com,EMAIL=shop@example.com," + "EMAIL=support@example.com,EMAIL=help@example.com," + "TYPE=SIGNING_AND_ENCRYPTION"); builder.sign(testKey); var csr = builder.getCSR(); assertThat(csr).isNotNull(); assertThat(csr.getEncoded()).isEqualTo(builder.getEncoded()); smimeCsrTest(csr); keyUsageTest(csr, KeyUsage.digitalSignature | KeyUsage.keyEncipherment); writerTest(builder); } /** * Test if the generated S/MIME CSR correctly sets the encryption only flag. */ @Test public void testSMIMEEncryptOnly() throws IOException, AddressException { var builder = new SMIMECSRBuilder(); builder.addEmail(new InternetAddress("mail@example.com")); builder.setKeyUsageType(KeyUsageType.ENCRYPTION_ONLY); builder.sign(testKey); var csr = builder.getCSR(); assertThat(csr).isNotNull(); keyUsageTest(csr, KeyUsage.keyEncipherment); } /** * Test if the generated S/MIME CSR correctly sets the signing only flag. */ @Test public void testSMIMESigningOnly() throws IOException, AddressException { var builder = new SMIMECSRBuilder(); builder.addEmail(new InternetAddress("mail@example.com")); builder.setKeyUsageType(KeyUsageType.SIGNING_ONLY); builder.sign(testKey); var csr = builder.getCSR(); assertThat(csr).isNotNull(); keyUsageTest(csr, KeyUsage.digitalSignature); } /** * Test if the generated S/MIME CSR correctly sets the signing and encryption flag. */ @Test public void testSMIMESigningAndEncryption() throws IOException, AddressException { var builder = new SMIMECSRBuilder(); builder.addEmail(new InternetAddress("mail@example.com")); builder.setKeyUsageType(KeyUsageType.SIGNING_AND_ENCRYPTION); builder.sign(testKey); var csr = builder.getCSR(); assertThat(csr).isNotNull(); keyUsageTest(csr, KeyUsage.digitalSignature | KeyUsage.keyEncipherment); } /** * Checks that addValue behaves correctly in dependence of the attributes being added. * If a common name is set, it should be handled in the same way when it's added by * using {@link SMIMECSRBuilder#addEmail(InternetAddress)}. */ @Test public void testAddAttrValues() throws Exception { var builder = new SMIMECSRBuilder(); var invAttNameExMessage = assertThrows(IllegalArgumentException.class, () -> X500Name.getDefaultStyle().attrNameToOID("UNKNOWNATT")).getMessage(); assertThat(builder.toString()).isEqualTo(",TYPE=SIGNING_AND_ENCRYPTION"); assertThatNullPointerException() .as("addValue(String, String)") .isThrownBy(() -> new SMIMECSRBuilder().addValue((String) null, "value")); assertThatNullPointerException() .as("addValue(ASN1ObjectIdentifier, String)") .isThrownBy(() -> new SMIMECSRBuilder().addValue((ASN1ObjectIdentifier) null, "value")); assertThatNullPointerException() .as("addValue(String, null)") .isThrownBy(() -> new SMIMECSRBuilder().addValue("C", null)); assertThatIllegalArgumentException() .as("addValue(String, null)") .isThrownBy(() -> new SMIMECSRBuilder().addValue("UNKNOWNATT", "val")) .withMessage(invAttNameExMessage); assertThatExceptionOfType(AddressException.class) .as("addValue(String, invalid String)") .isThrownBy(() -> new SMIMECSRBuilder().addValue("CN", "invalid@example..com")); assertThat(builder.toString()).isEqualTo(",TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue("C", "DE"); assertThat(builder.toString()).isEqualTo("C=DE,TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue("E", "contact@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue("CN", "firstcn@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn@example.com,EMAIL=firstcn@example.com,TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue("CN", "scnd@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn@example.com,EMAIL=firstcn@example.com,EMAIL=scnd@example.com,TYPE=SIGNING_AND_ENCRYPTION"); builder = new SMIMECSRBuilder(); builder.addValue(BCStyle.C, "DE"); assertThat(builder.toString()).isEqualTo("C=DE,TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue(BCStyle.EmailAddress, "contact@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue(BCStyle.CN, "firstcn@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn@example.com,EMAIL=firstcn@example.com,TYPE=SIGNING_AND_ENCRYPTION"); builder.addValue(BCStyle.CN, "scnd@example.com"); assertThat(builder.toString()).isEqualTo("C=DE,E=contact@example.com,CN=firstcn@example.com,EMAIL=firstcn@example.com,EMAIL=scnd@example.com,TYPE=SIGNING_AND_ENCRYPTION"); } /** * Checks if the S/MIME CSR contains the right parameters. *

* This is not supposed to be a Bouncy Castle test. If the * {@link PKCS10CertificationRequest} contains the right parameters, we assume that * Bouncy Castle encodes it properly. */ private void smimeCsrTest(PKCS10CertificationRequest csr) { var name = csr.getSubject(); try (var softly = new AutoCloseableSoftAssertions()) { softly.assertThat(name.getRDNs(BCStyle.CN)).as("CN") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("mail@example.com"); softly.assertThat(name.getRDNs(BCStyle.C)).as("C") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("XX"); softly.assertThat(name.getRDNs(BCStyle.L)).as("L") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("Testville"); softly.assertThat(name.getRDNs(BCStyle.O)).as("O") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("Testing Co"); softly.assertThat(name.getRDNs(BCStyle.OU)).as("OU") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("Testunit"); softly.assertThat(name.getRDNs(BCStyle.ST)).as("ST") .extracting(rdn -> rdn.getFirst().getValue().toString()) .contains("ABC"); } var attr = csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest); assertThat(attr).hasSize(1); var extensions = attr[0].getAttrValues().toArray(); assertThat(extensions).hasSize(1); var names = GeneralNames.fromExtensions((Extensions) extensions[0], Extension.subjectAlternativeName); assertThat(names.getNames()) .filteredOn(gn -> gn.getTagNo() == GeneralName.rfc822Name) .extracting(gn -> ASN1IA5String.getInstance(gn.getName()).getString()) .containsExactlyInAnyOrder("mail@example.com", "info@example.com", "sales@example.com", "shop@example.com", "support@example.com", "help@example.com"); } /** * Validate the Key Usage bits. * * @param csr * {@link PKCS10CertificationRequest} to validate * @param expectedUsageBits * Expected key usage bits. Exact match, validation fails if other bits are * set or reset. If {@code null}, validation fails if key usage bits are set. */ private void keyUsageTest(PKCS10CertificationRequest csr, Integer expectedUsageBits) { var attr = csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest); assertThat(attr).hasSize(1); var extensions = attr[0].getAttrValues().toArray(); assertThat(extensions).hasSize(1); var keyUsageBits = (DERBitString) ((Extensions) extensions[0]).getExtensionParsedValue(Extension.keyUsage); if (expectedUsageBits != null) { assertThat(keyUsageBits.intValue()).isEqualTo(expectedUsageBits); } else { assertThat(keyUsageBits).isNull(); } } /** * Checks if the {@link SMIMECSRBuilder#write(java.io.Writer)} method generates a * correct CSR PEM file. */ private void writerTest(SMIMECSRBuilder builder) throws IOException { // Write CSR to PEM String pem; try (var out = new StringWriter()) { builder.write(out); pem = out.toString(); } // Make sure PEM file is properly formatted assertThat(pem).matches( "-----BEGIN CERTIFICATE REQUEST-----[\\r\\n]+" + "([a-zA-Z0-9/+=]+[\\r\\n]+)+" + "-----END CERTIFICATE REQUEST-----[\\r\\n]*"); // Read CSR from PEM PKCS10CertificationRequest readCsr; try (var parser = new PEMParser(new StringReader(pem))) { readCsr = (PKCS10CertificationRequest) parser.readObject(); } // Verify that both keypairs are the same assertThat(builder.getCSR()).isNotSameAs(readCsr); assertThat(builder.getEncoded()).isEqualTo(readCsr.getEncoded()); // OutputStream is identical? byte[] pemBytes; try (var baos = new ByteArrayOutputStream()) { builder.write(baos); pemBytes = baos.toByteArray(); } assertThat(new String(pemBytes, UTF_8)).isEqualTo(pem); } /** * Make sure an exception is thrown when nothing is set. */ @Test public void testNoEmail() { assertThrows(IllegalStateException.class, () -> { var builder = new SMIMECSRBuilder(); builder.sign(testKey); }); } /** * Make sure all getters will fail if the CSR is not signed. */ @Test public void testNoSign() { var builder = new SMIMECSRBuilder(); assertThrows(IllegalStateException.class, builder::getCSR, "getCSR"); assertThrows(IllegalStateException.class, builder::getEncoded, "getEncoded"); assertThrows(IllegalStateException.class, () -> { try (var w = new StringWriter()) { builder.write(w); } },"write"); } } ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/email/EmailProcessorTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2021 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.email; import static jakarta.mail.Message.RecipientType.TO; import static org.assertj.core.api.Assertions.*; import java.io.IOException; import java.security.KeyStore; import java.security.Security; import java.util.Optional; import jakarta.mail.Message; import jakarta.mail.MessagingException; import jakarta.mail.internet.InternetAddress; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Disabled; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.Identifier; import org.shredzone.acme4j.exception.AcmeProtocolException; import org.shredzone.acme4j.smime.EmailIdentifier; import org.shredzone.acme4j.smime.SMIMETests; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; /** * Unit tests for {@link EmailProcessor} and {@link ResponseGenerator}. */ public class EmailProcessorTest extends SMIMETests { private final InternetAddress expectedFrom = email("acme-generator@example.org"); private final InternetAddress expectedTo = email("alexey@example.com"); private final InternetAddress expectedReplyTo = email("acme-validator@example.org"); private final Message message = mockMessage("challenge"); @BeforeAll public static void setup() { Security.addProvider(new BouncyCastleProvider()); } @Test public void testEmailParser() throws AcmeInvalidMessageException { var processor = EmailProcessor.plainMessage(message); processor.expectedFrom(expectedFrom); processor.expectedTo(expectedTo); processor.expectedIdentifier(EmailIdentifier.email(expectedTo)); processor.expectedIdentifier(new Identifier("email", expectedTo.getAddress())); assertThat(processor.getSender()).isEqualTo(expectedFrom); assertThat(processor.getRecipient()).isEqualTo(expectedTo); assertThat(processor.getMessageId()).isEqualTo(Optional.of("")); assertThat(processor.getToken1()).isEqualTo(TOKEN_PART1); assertThat(processor.getReplyTo()).contains(email("acme-validator@example.org")); } @Test public void testValidSignature() { assertThatNoException().isThrownBy(() -> { var message = mockMessage("valid-mail"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).strict().build(message); }); } @Test public void testInvalidSignature() { var ex = catchThrowableOfType(() -> { var message = mockMessage("invalid-signed-mail"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).strict().build(message); }, AcmeInvalidMessageException.class); assertThat(ex).isNotNull(); assertThat(ex.getMessage()).isEqualTo("Invalid signature"); assertThat(ex.getErrors()).hasSize(2); assertThat(ex.getErrors()) .first().hasFieldOrPropertyWithValue("id", "SignedMailValidator.emailFromCertMismatch"); assertThat(ex.getErrors()) .element(1).hasFieldOrPropertyWithValue("id", "SignedMailValidator.certPathInvalid"); } @Test public void testValidSignatureButNoSAN() { assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> { var message = mockMessage("invalid-nosan"); var certificate = readCertificate("valid-signer-nosan"); EmailProcessor.builder().certificate(certificate).strict().build(message); }) .withMessage("Certificate does not have a subjectAltName extension"); } @Test public void testSANDoesNotMatchFrom() { var ex = catchThrowableOfType(() -> { var message = mockMessage("invalid-cert-mismatch"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).strict().build(message); }, AcmeInvalidMessageException.class); assertThat(ex).isNotNull(); assertThat(ex.getMessage()).isEqualTo("Invalid signature"); assertThat(ex.getErrors()) .singleElement().hasFieldOrPropertyWithValue("id", "SignedMailValidator.emailFromCertMismatch"); } @Test public void testInvalidProtectedFromHeader() { var ex = catchThrowableOfType(() -> { var message = mockMessage("invalid-protected-mail-from"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).strict().build(message); }, AcmeInvalidMessageException.class); assertThat(ex).isNotNull(); assertThat(ex.getMessage()).isEqualTo("Invalid signature"); assertThat(ex.getErrors()) .singleElement().hasFieldOrPropertyWithValue("id", "SignedMailValidator.emailFromCertMismatch"); } @Test public void testInvalidProtectedToHeader() { assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> { var message = mockMessage("invalid-protected-mail-to"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).strict().build(message); }) .withMessage("Secured header 'To' does not match envelope header"); } @Test public void testInvalidProtectedSubjectHeader() { assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> { var message = mockMessage("invalid-protected-mail-subject"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).strict().build(message); }) .withMessage("Secured header 'Subject' does not match envelope header"); } @Test public void testNonStrictInvalidProtectedSubjectHeader() { assertThatNoException() .isThrownBy(() -> { var message = mockMessage("invalid-protected-mail-subject"); var certificate = readCertificate("valid-signer"); EmailProcessor.builder().certificate(certificate).relaxed().build(message); }); } // TODO: This test is blocking development atm. It fails because the signature of // the test email has expired. In order to fix it, RFC-7508 compliant test emails // need to be generated programmatically within the unit test. @Disabled @Test public void testValidSignatureRfc7508() throws Exception { var message = mockMessage("valid-mail-7508"); var keyStore = KeyStore.getInstance("JKS"); keyStore.load(EmailProcessorTest.class.getResourceAsStream("/7508-valid-ca.jks"), "test123".toCharArray()); var processor = EmailProcessor.builder().trustStore(keyStore).build(message); assertThat(processor.getSender()).isEqualTo(new InternetAddress("acme-challenge@dc-bsd.my.corp")); assertThat(processor.getRecipient()).isEqualTo(new InternetAddress("gitlab@dc-bsd.my.corp")); assertThat(processor.getToken1()).isEqualTo("ABxfL5s4bjvmyVRvl6y-Y_GhdzTdWpKqlmrKAIVe"); } // TODO: This test is blocking development atm. It fails because the keystore format // is invalid. This might be fixed together with testValidSignatureRfc7508(). @Disabled @Test public void testInvalidSignatureRfc7508() throws Exception { var message = mockMessage("valid-mail-7508"); var keyStore = KeyStore.getInstance("JKS"); keyStore.load(EmailProcessorTest.class.getResourceAsStream("/7508-fake-ca.jks"), "test123".toCharArray()); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> EmailProcessor.builder().trustStore(keyStore).build(message)); } @Test public void textExpectedFromFails() { assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.expectedFrom(expectedTo); }) .withMessage("Message is not sent by the expected sender"); } @Test public void textExpectedToFails() { assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.expectedTo(expectedFrom); }) .withMessage("Message is not addressed to expected recipient"); } @Test public void textExpectedIdentifierFails1() { assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.expectedIdentifier(EmailIdentifier.email(expectedFrom)); }) .withMessage("Message is not addressed to expected recipient"); } @Test public void textExpectedIdentifierFails2() { assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.expectedIdentifier(Identifier.ip("192.0.2.1")); }) .withMessage("Wrong identifier type: ip"); } @Test public void textNoChallengeFails1() { assertThatIllegalStateException() .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.getToken(); }) .withMessage("No challenge has been set yet"); } @Test public void textNoChallengeFails2() { assertThatIllegalStateException() .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.getAuthorization(); }) .withMessage("No challenge has been set yet"); } @Test public void textNoChallengeFails3() { assertThatIllegalStateException() .isThrownBy(() -> { var processor = EmailProcessor.plainMessage(message); processor.respond(); }) .withMessage("No challenge has been set yet"); } @Test public void testChallenge() throws AcmeInvalidMessageException { var challenge = mockChallenge("emailReplyChallenge"); var processor = EmailProcessor.plainMessage(message); processor.withChallenge(challenge); assertThat(processor.getToken()).isEqualTo(TOKEN); assertThat(processor.getAuthorization()).isEqualTo(KEY_AUTHORIZATION); assertThat(processor.respond()).isNotNull(); } @Test public void testChallengeMismatch() { assertThatExceptionOfType(AcmeProtocolException.class) .isThrownBy(() -> { var challenge = mockChallenge("emailReplyChallengeMismatch"); var processor = EmailProcessor.plainMessage(message); processor.withChallenge(challenge); }) .withMessage("Message is not sent by the expected sender"); } @Test public void testResponse() throws IOException, MessagingException, AcmeInvalidMessageException { var challenge = mockChallenge("emailReplyChallenge"); var response = EmailProcessor.plainMessage(message) .withChallenge(challenge) .respond() .generateResponse(mailSession); assertResponse(response, RESPONSE_BODY); } @Test public void testResponseWithHeaderFooter() throws IOException, MessagingException, AcmeInvalidMessageException { var challenge = mockChallenge("emailReplyChallenge"); var response = EmailProcessor.plainMessage(message) .withChallenge(challenge) .respond() .withHeader("This is an introduction.") .withFooter("This is a footer.") .generateResponse(mailSession); assertResponse(response, "This is an introduction.\r\n" + RESPONSE_BODY + "This is a footer."); } @Test public void testResponseWithCallback() throws IOException, MessagingException, AcmeInvalidMessageException { var challenge = mockChallenge("emailReplyChallenge"); var response = EmailProcessor.plainMessage(message) .withChallenge(challenge) .respond() .withGenerator((msg, body) -> msg.setContent("Head\r\n" + body + "Foot", "text/plain")) .generateResponse(mailSession); assertResponse(response, "Head\r\n" + RESPONSE_BODY + "Foot"); } private void assertResponse(Message response, String expectedBody) throws MessagingException, IOException { assertThat(response.getContentType()).isEqualTo("text/plain"); assertThat(response.getContent().toString()).isEqualTo(expectedBody); // This is a response, so the expected sender is the recipient of the challenge assertThat(response.getFrom()).hasSize(1); assertThat(response.getFrom()[0]).isEqualTo(expectedTo); // There is a Reply-To header, so we expect the mail to go only there assertThat(response.getRecipients(TO)).hasSize(1); assertThat(response.getRecipients(TO)[0]).isEqualTo(expectedReplyTo); assertThat(response.getSubject()).isEqualTo("Re: ACME: " + TOKEN_PART1); var inReplyToHeader = response.getHeader("In-Reply-To"); assertThat(inReplyToHeader).hasSize(1); assertThat(inReplyToHeader[0]).isEqualTo(""); } } ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/wrapper/SignedMailBuilderTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.wrapper; import static org.assertj.core.api.Assertions.assertThat; import java.security.KeyStoreException; import org.junit.jupiter.api.Test; /** * Unit tests for {@link SignedMailBuilder}. */ public class SignedMailBuilderTest { @Test public void testDefaultTrustStoreIsCreated() throws KeyStoreException { var keyStore = SignedMailBuilder.getCaCertsTrustStore(); assertThat(keyStore).isNotNull(); assertThat(keyStore.size()).isGreaterThan(0); // Make sure the instance is cached var keyStore2 = SignedMailBuilder.getCaCertsTrustStore(); assertThat(keyStore2).isSameAs(keyStore); } } ================================================ FILE: acme4j-smime/src/test/java/org/shredzone/acme4j/smime/wrapper/SignedMailTest.java ================================================ /* * acme4j - Java ACME client * * Copyright (C) 2023 Richard "Shred" Körber * http://acme4j.shredzone.org * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ package org.shredzone.acme4j.smime.wrapper; import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import java.util.ArrayList; import java.util.Collections; import java.util.Enumeration; import jakarta.mail.Header; import jakarta.mail.internet.InternetAddress; import org.junit.jupiter.api.Test; import org.shredzone.acme4j.smime.exception.AcmeInvalidMessageException; /** * Unit tests for {@link SignedMail}. */ public class SignedMailTest { @Test public void testCheckDuplicatedStrictGood() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com" )); // Success: Field is present and identical signedMail.checkDuplicatedField("From", "foo@example.com", false); assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("foo@example.com")); } @Test public void testCheckDuplicatedStrictBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", " foo@example.com " )); // Failure: Field is same, but has extra whitespaces assertThatExceptionOfType(AcmeInvalidMessageException.class).isThrownBy(() -> signedMail.checkDuplicatedField("From", "foo@example.com", false) ); } @Test public void testCheckDuplicatedRelaxedGood() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "FROM", " foo@example.com " )); // Good: Field is there and identical (ignoring case and whitespaces) signedMail.checkDuplicatedField("From", "foo@example.com", true); assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("foo@example.com")); } @Test public void testCheckDuplicatedRelaxedBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "bar@example.com" )); // Failure: Field is present, but different value assertThatExceptionOfType(AcmeInvalidMessageException.class).isThrownBy(() -> signedMail.checkDuplicatedField("From", "foo@example.com", true) ); } @Test public void testDeleteFieldStrictGood() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com" )); // Good: Field is present and identical signedMail.deleteField("From", "foo@example.com", false); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getFrom) .withMessage("Protected 'FROM' header is required, but missing"); } @Test public void testDeleteFieldStrictBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "bar@example.com" )); // Bad: Field is present, but has different value assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> signedMail.deleteField("From", "foo@example.com", false)) .withMessage("Secured header 'From' was not found in envelope header for deletion"); } @Test public void testDeleteFieldRelaxedGood() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "FROM", " foo@example.com " )); // Good: Field is present and identical (ignoring case and whitespaces) signedMail.deleteField("From", "foo@example.com", true); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getFrom) .withMessage("Protected 'FROM' header is required, but missing"); } @Test public void testDeleteFieldRelaxedBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "FROM", "bar@example.com" )); // Bad: Field is present, but has different value assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> signedMail.deleteField("From", "foo@example.com", true)) .withMessage("Secured header 'From' was not found in envelope header for deletion"); } @Test public void testModifyFieldStrictGood() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com" )); // Good: field is present, content is replaced signedMail.modifyField("From", "bar@example.com", false); assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("bar@example.com")); } @Test public void testModifyFieldStrictBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "FROM", "foo@example.com" )); // Failure: Field is not present because it's all-caps assertThatExceptionOfType(AcmeInvalidMessageException.class).isThrownBy(() -> signedMail.modifyField("From", "bar@example.com", false) ); } @Test public void testModifyFieldRelaxedGood() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "FROM", "foo@example.com" )); // Good: Field is present (ignoring case) signedMail.modifyField("From", "bar@example.com", true); assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("bar@example.com")); } @Test public void testModifyFieldRelaxedBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "To", "foo@example.com" )); // Failure: Field is not present at all assertThatExceptionOfType(AcmeInvalidMessageException.class).isThrownBy(() -> signedMail.modifyField("From", "foo@example.com", true) ); } @Test public void testImportUntrusted() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com", "Message-Id", "123456ABCDEF" )); // Success because Message ID does not need to be trusted assertThat(signedMail.getMessageId()).isNotEmpty().contains("123456ABCDEF"); // Failure because From is required to be trusted assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getFrom); } @Test public void testImportTrustedStrict() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com", "Message-Id", "123456ABCDEF" )); signedMail.importTrustedHeaders(withHeaders( "From", "foo@example.com" )); // Success because Message ID does not need to be trusted assertThat(signedMail.getMessageId()).isNotEmpty().contains("123456ABCDEF"); // Success because From is trusted assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("foo@example.com")); } @Test public void testImportTrustedRelaxed() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "Message-Id", "123456ABCDEF" )); signedMail.importTrustedHeadersRelaxed(withHeaders( "From", "foo@example.com" )); // Success because Message ID does not need to be trusted assertThat(signedMail.getMessageId()).isNotEmpty().contains("123456ABCDEF"); // Success because From is trusted assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("foo@example.com")); } @Test public void testImportStrictFails() { var signedMail = new SignedMail(); // Fails because there is no matching untrusted header assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(() -> signedMail.importTrustedHeaders(withHeaders( "From", "foo@example.com" ))); } @Test public void testFromEmpty() { var signedMail = new SignedMail(); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getFrom) .withMessage("Protected 'FROM' header is required, but missing"); } @Test public void testFromUntrusted() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com" )); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getFrom) .withMessage("Protected 'FROM' header is required, but missing"); } @Test public void testFromTrusted() throws Exception { var signedMail = new SignedMail(); signedMail.importTrustedHeadersRelaxed(withHeaders( "From", "foo@example.com" )); assertThat(signedMail.getFrom()).isEqualTo(new InternetAddress("foo@example.com")); } @Test public void testToEmpty() { var signedMail = new SignedMail(); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getTo) .withMessage("Protected 'TO' header is required, but missing"); } @Test public void testToUntrusted() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "To", "foo@example.com" )); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getTo) .withMessage("Protected 'TO' header is required, but missing"); } @Test public void testToTrusted() throws Exception { var signedMail = new SignedMail(); signedMail.importTrustedHeadersRelaxed(withHeaders( "To", "foo@example.com" )); assertThat(signedMail.getTo()).isEqualTo(new InternetAddress("foo@example.com")); } @Test public void testSubjectEmpty() { var signedMail = new SignedMail(); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getSubject) .withMessage("Protected 'SUBJECT' header is required, but missing"); } @Test public void testSubjectUntrusted() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "Subject", "abc123" )); assertThatExceptionOfType(AcmeInvalidMessageException.class) .isThrownBy(signedMail::getSubject) .withMessage("Protected 'SUBJECT' header is required, but missing"); } @Test public void testSubjectTrusted() throws Exception { var signedMail = new SignedMail(); signedMail.importTrustedHeadersRelaxed(withHeaders( "Subject", "abc123" )); assertThat(signedMail.getSubject()).isEqualTo("abc123"); } @Test public void testMessageIdEmpty() { var signedMail = new SignedMail(); assertThat(signedMail.getMessageId()).isEmpty(); } @Test public void testMessageId() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "Message-Id", "12345ABCDE" )); assertThat(signedMail.getMessageId()).isNotEmpty().contains("12345ABCDE"); } @Test public void testReplyToEmpty() throws Exception { var signedMail = new SignedMail(); assertThat(signedMail.getReplyTo()).isEmpty(); } @Test public void testReplyTo() throws Exception { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "Reply-To", "foo@example.com", "Reply-To", "bar@example.org" )); assertThat(signedMail.getReplyTo()).contains( new InternetAddress("foo@example.com"), new InternetAddress("bar@example.org") ); } @Test public void testIsAutoSubmitted() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "Auto-Submitted", "auto-generated; type=acme" )); assertThat(signedMail.isAutoSubmitted()).isTrue(); } @Test public void testIsNotAutoSubmitted() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "Auto-Submitted", "no" )); assertThat(signedMail.isAutoSubmitted()).isFalse(); } @Test public void testIsAutoSubmittedMissing() { var signedMail = new SignedMail(); assertThat(signedMail.isAutoSubmitted()).isFalse(); } @Test public void testMissingSecuredHeadersEmpty() { var signedMail = new SignedMail(); assertThat(signedMail.getMissingSecuredHeaders()).contains("FROM", "TO", "SUBJECT"); } @Test public void testMissingSecuredHeadersGood() { var signedMail = new SignedMail(); signedMail.importTrustedHeadersRelaxed(withHeaders( "From", "foo@example.com", "To", "bar@example.org", "Subject", "foo123" )); assertThat(signedMail.getMissingSecuredHeaders()).isEmpty(); } @Test public void testMissingSecuredHeadersTrustedBad() { var signedMail = new SignedMail(); signedMail.importTrustedHeadersRelaxed(withHeaders( "From", "foo@example.com", "To", "bar@example.org" )); assertThat(signedMail.getMissingSecuredHeaders()).contains("SUBJECT"); } @Test public void testMissingSecuredHeadersUntustedBad() { var signedMail = new SignedMail(); signedMail.importUntrustedHeaders(withHeaders( "From", "foo@example.com", "To", "bar@example.org", "Subject", "foo123" )); assertThat(signedMail.getMissingSecuredHeaders()).contains("FROM", "TO", "SUBJECT"); } private Enumeration

withHeaders(String... kv) { var headers = new ArrayList
(); for (var ix = 0; ix < kv.length; ix += 2) { headers.add(new Header(kv[ix], kv[ix+1])); } return Collections.enumeration(headers); } } ================================================ FILE: acme4j-smime/src/test/resources/.gitignore ================================================ ================================================ FILE: acme4j-smime/src/test/resources/email/challenge.eml ================================================ Auto-Submitted: auto-generated; type=acme Date: Sat, 5 Dec 2020 10:08:55 +0100 Message-ID: From: acme-generator@example.org To: Alexey Reply-To: acme-validator@example.org Subject: =?UTF-8?Q?ACME:_LgYemJLy3F1LDki=20JrdIGbEzyFJyOyf=20=206vBdyZ1TG3sME=3D?= Content-Type: text/plain MIME-Version: 1.0 This is an automatically generated ACME challenge for email address "alexey@example.com". If you haven't requested an S/MIME certificate generation for this email address, be very afraid. If you did request it, your email client might be able to process this request automatically, or you might have to paste the first token part into an external program. ================================================ FILE: acme4j-smime/src/test/resources/email/invalid-cert-mismatch.eml ================================================ From: different-ca@example.org To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----6B6A5C5DBC60D7D16B6C08BF092D4185" This is an S/MIME signed message ------6B6A5C5DBC60D7D16B6C08BF092D4185 Content-Type: message/RFC822; forwarded=no From: different-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------6B6A5C5DBC60D7D16B6C08BF092D4185 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIGzQYJKoZIhvcNAQcCoIIGvjCCBroCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCA/4wggP6MIIC4qADAgECAhQoC/xUcLhcK13sGSiYxuUPf758tDANBgkq hkiG9w0BAQsFADB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjEx MDQxMjU1MzlaFw0zMjExMDExMjU1MzlaMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQH DAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIG A1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1w bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzTyW1VRm+mQH YU5hZWgzgrPRkRzMLlLoCamlRs5DjGf3zIpo9a/17m60YfIXBJruImUBXxa5lp0Z qaayty+nZOpS0wBZSqTLuslZ0WuyyyW2DEBNO7jLW58cMn8MfAwMYjDcxtubNb7M AG9iZRj6wn6tKCsXtYUgAIpNhyPPtDuEZ5df1ecOnvlW2vO+MwytM8DLLtwolET/ tPzOXPHDiyKjij02jyJ1DlZxptKudiKaBeY1WY/W/PpS6fGskTJQc/bZPgE3OP/9 Y9Y1uzZTulkO3R6MlLNdLam32/ehpJvSWyfSbToyC2ejvaXoRChPFcAmTpqA0HPg h8sudiS14QIDAQABo3QwcjAdBgNVHQ4EFgQUR0gRYoOCPJYqFiPGwB141VTCXuIw HwYDVR0jBBgwFoAUR0gRYoOCPJYqFiPGwB141VTCXuIwDwYDVR0TAQH/BAUwAwEB /zAfBgNVHREEGDAWgRR2YWxpZC1jYUBleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsF AAOCAQEAJDQsNTWxVLNHBrVl6p6IetzeBt64GoWp6OP5C8/HY3dlznfbrn6ZvWBr Vsnc7VZ49r8r/QvRKRrljkIQuNwaW/LmRxJ1AVGGiorspmrdz0Lf2WOXnLH/+4lR q5dar5YmGqi9Mo2j5ALg/2MiO1PonuKs1eX9tLZCCeanXFexU0qaeFZelunJ6UUm BXpaGO1QfECcNnvarudosbe1ve6YGABn8MpAY+8zdYnYHPB8Pojhzvk7/8PMHoPu njDb3lZT+b8BDmNz+GISCUSHYkdK2rWh+8wqD3T5rOtzTqAPuSNeDNocUF6wzxem HWqvP7yM3VoXYvn7FA4NCa9mE3k8MzGCApcwggKTAgEBMIGUMHwxCzAJBgNVBAYT AlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNh dGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZh bGlkLWNhQGV4YW1wbGUuY29tAhQoC/xUcLhcK13sGSiYxuUPf758tDAJBgUrDgMC GgUAoIHYMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X DTIyMTEwNDEzMzE1NVowIwYJKoZIhvcNAQkEMRYEFNE5fZJFFgePdLTkBjs3GMcD M5UyMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAL BglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3 DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIB AEN+8Cgvfw/72HPSSgJROYqScFrYTCRF7HTAk22zJCVzuh21rbEiPGLJ9Sy4ak/i BXvXtkX8YJBGuVYrx6QxoF8vmcwlIPVw9Qoc2FevyfRQD19hP7rd7miZ8LWu0B8v d54mr7aD5zQADLvQGlxjKvCSM3F8HF1KQrRZrfJbEL9NRrgYD7c8ZEAvisaoEfPO vRjsj9IzKg/RWhOAmh5n591ZNKVb8k0G+5lyCSuP8m/9k0sE705sVrq4sbgIgtFB HNVLwYvxb88F//rFosFW/njsnlgFx5hjpLbwKu6Du2Sd7L1oye/xUGlKDY8yuy2m pwKapV2IpD8TjsL7NZ7rJ5U= ------6B6A5C5DBC60D7D16B6C08BF092D4185-- ================================================ FILE: acme4j-smime/src/test/resources/email/invalid-nosan.eml ================================================ From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----47B1F5074B8F7A13042C44F61463F58F" This is an S/MIME signed message ------47B1F5074B8F7A13042C44F61463F58F Content-Type: message/RFC822; forwarded=no From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------47B1F5074B8F7A13042C44F61463F58F Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIGrAYJKoZIhvcNAQcCoIIGnTCCBpkCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCA90wggPZMIICwaADAgECAhRPShCzW2lh0D89RfDJ5mos/gMAJjANBgkq hkiG9w0BAQsFADB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjEx MDQxMjU1MzlaFw0zMjExMDExMjU1MzlaMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQH DAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIG A1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1w bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2BDJcOmFx6Tu W58rpO4FXbvF7ZoSpIOi4YWfSmD7LSHUq+xGx/vodijFT1Y6a74o4d+XeYTH/X4j FO9QPdzZDuG8t3ziFACctptaFywUjgYYJQGyPmfg3hn1Cz72q4tAqegOEwL78NA2 YcEd6sx0udAF80C1QHi/kKBMDgj9AOyNyIZ/rBN8CZSkfkpPYWI99Fl/DOuYnr7k MN1TUWS1906mPqBslh1YVyp6fdGaL6DdlIY+ZE5c9BhST/t+7eLq7fnB5KB+tDvH D1qnL858K+5Hjfc9MUYTyffDiJaG9zHkEKi3zd0EGcaf1r+lskRqEIOqROjLSDim T5Q4CuHCYQIDAQABo1MwUTAdBgNVHQ4EFgQURoDGdRoZP6EOfLXTlNxWPDTRmp8w HwYDVR0jBBgwFoAURoDGdRoZP6EOfLXTlNxWPDTRmp8wDwYDVR0TAQH/BAUwAwEB /zANBgkqhkiG9w0BAQsFAAOCAQEAvVI9Yj8lL0cvdNY3RD/GQ/tQCGBAzoFTODJU wn4zE/LfiXfu8SxJhzcpjzKc2j+mxuwGh0OqraIO2FkpO23+X1gCdCt+ClE/6nMs 8UMo4H1wMYYGhjkoLvsH9Ne5N+91PvLQG97LoLsoy+Y95ws23WyqUJ2g7A7Isk3v 7MJZVH2d93hjbtWQ6+3/PP5zJwubEwiDAYvycODfvAig9+0QBIy+uE7XxnEhKxHJ pvN3p8NmLya7XH3v92N7M6CioyBqw8HL7I5lt5HBqa/U9USVMMmi9v+tFLZYyd7r 7acw6hB7MDcLmtEu08Cgo89K23oTm1JBJZrjZUFbYcYP+fiuizGCApcwggKTAgEB MIGUMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoM FUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xIzAh BgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1wbGUuY29tAhRPShCzW2lh0D89RfDJ 5mos/gMAJjAJBgUrDgMCGgUAoIHYMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw HAYJKoZIhvcNAQkFMQ8XDTIyMTEwNDEzMzE1NVowIwYJKoZIhvcNAQkEMRYEFK+s B97I9ZGpDGUMWLsE3dCU/pbtMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEq MAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcN AwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0G CSqGSIb3DQEBAQUABIIBAEvS2tccMXu/OG8fzgOWsf5MzjBdDD/6doTLuIJS7Ktv 1alpT8ZqSBn4jOgrlM7efTFK8y1vlOdoFZIsfIe+92lclvgHc/2Dw4XB5SswZ59y fZH+AVtVpzi5oFYiunhBn19vRP9Bri4ma8gCRe7pUwN15Gap8gl3+UQtUY17wcME H7ALcuG0ETPTxz9p2ueN6FmrthmrDSaZVqW5nyTizgr0zSxicEcwfFz9JZGZFKyp lPSVrgCwZ1/yaWXlnBXPTdO/DmAvNUAjUk0HZFu+mnelzPPs3c5s4LY3pBNjDPE2 i2hxgRjca2QMsveYdwZn8I/m1P7yatJ3EozHpO3T4Gc= ------47B1F5074B8F7A13042C44F61463F58F-- ================================================ FILE: acme4j-smime/src/test/resources/email/invalid-protected-mail-from.eml ================================================ From: tampered-ca@example.org To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----1FD9CF28CC0AD72EF1FF6D0511838F0E" This is an S/MIME signed message ------1FD9CF28CC0AD72EF1FF6D0511838F0E Content-Type: message/RFC822; forwarded=no From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------1FD9CF28CC0AD72EF1FF6D0511838F0E Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIGzQYJKoZIhvcNAQcCoIIGvjCCBroCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCA/4wggP6MIIC4qADAgECAhQoC/xUcLhcK13sGSiYxuUPf758tDANBgkq hkiG9w0BAQsFADB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjEx MDQxMjU1MzlaFw0zMjExMDExMjU1MzlaMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQH DAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIG A1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1w bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzTyW1VRm+mQH YU5hZWgzgrPRkRzMLlLoCamlRs5DjGf3zIpo9a/17m60YfIXBJruImUBXxa5lp0Z qaayty+nZOpS0wBZSqTLuslZ0WuyyyW2DEBNO7jLW58cMn8MfAwMYjDcxtubNb7M AG9iZRj6wn6tKCsXtYUgAIpNhyPPtDuEZ5df1ecOnvlW2vO+MwytM8DLLtwolET/ tPzOXPHDiyKjij02jyJ1DlZxptKudiKaBeY1WY/W/PpS6fGskTJQc/bZPgE3OP/9 Y9Y1uzZTulkO3R6MlLNdLam32/ehpJvSWyfSbToyC2ejvaXoRChPFcAmTpqA0HPg h8sudiS14QIDAQABo3QwcjAdBgNVHQ4EFgQUR0gRYoOCPJYqFiPGwB141VTCXuIw HwYDVR0jBBgwFoAUR0gRYoOCPJYqFiPGwB141VTCXuIwDwYDVR0TAQH/BAUwAwEB /zAfBgNVHREEGDAWgRR2YWxpZC1jYUBleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsF AAOCAQEAJDQsNTWxVLNHBrVl6p6IetzeBt64GoWp6OP5C8/HY3dlznfbrn6ZvWBr Vsnc7VZ49r8r/QvRKRrljkIQuNwaW/LmRxJ1AVGGiorspmrdz0Lf2WOXnLH/+4lR q5dar5YmGqi9Mo2j5ALg/2MiO1PonuKs1eX9tLZCCeanXFexU0qaeFZelunJ6UUm BXpaGO1QfECcNnvarudosbe1ve6YGABn8MpAY+8zdYnYHPB8Pojhzvk7/8PMHoPu njDb3lZT+b8BDmNz+GISCUSHYkdK2rWh+8wqD3T5rOtzTqAPuSNeDNocUF6wzxem HWqvP7yM3VoXYvn7FA4NCa9mE3k8MzGCApcwggKTAgEBMIGUMHwxCzAJBgNVBAYT AlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNh dGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZh bGlkLWNhQGV4YW1wbGUuY29tAhQoC/xUcLhcK13sGSiYxuUPf758tDAJBgUrDgMC GgUAoIHYMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X DTIyMTEwNDEzMzE1NVowIwYJKoZIhvcNAQkEMRYEFK+sB97I9ZGpDGUMWLsE3dCU /pbtMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAL BglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3 DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIB AFli04jnSd0d0lnE9GO23qzxI98QIbCz1NU1qk+zDyAhwOWQJdMUfuekk3g4Gn2q OFzdvlIMpgG2W7AVZlLUQMQjWIoDWkTeqxM8n6StoXcDvlArBHQDbourufFUu7OE 3TVsI6l/jZG3Xub9Uar0S3lF6rQ/A3vl28poRL/EIQye6ypg6UbS/EvkvfbsKUJD 6SpExlwh0R7lk1g/xn3tFVSEAH7VSJYr/8C/Bak06NPOtZZSSeU9ryRzeK/gN3SJ nrEp+NkTezzApjSnZasrPSbzmRL4+18x3kmAmnwR3aRi7F7KhCs78qPUEVP5XbhX 2hO9RjMy6Uki+R/AG4aempk= ------1FD9CF28CC0AD72EF1FF6D0511838F0E-- ================================================ FILE: acme4j-smime/src/test/resources/email/invalid-protected-mail-subject.eml ================================================ From: valid-ca@example.com To: recipient@example.org Subject: ACME: aDiFfErEnTtOkEn Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----6E9953AAECB0BDB6F65BCD88900D3E15" This is an S/MIME signed message ------6E9953AAECB0BDB6F65BCD88900D3E15 Content-Type: message/RFC822; forwarded=no From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------6E9953AAECB0BDB6F65BCD88900D3E15 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIGzQYJKoZIhvcNAQcCoIIGvjCCBroCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCA/4wggP6MIIC4qADAgECAhQoC/xUcLhcK13sGSiYxuUPf758tDANBgkq hkiG9w0BAQsFADB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjEx MDQxMjU1MzlaFw0zMjExMDExMjU1MzlaMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQH DAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIG A1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1w bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzTyW1VRm+mQH YU5hZWgzgrPRkRzMLlLoCamlRs5DjGf3zIpo9a/17m60YfIXBJruImUBXxa5lp0Z qaayty+nZOpS0wBZSqTLuslZ0WuyyyW2DEBNO7jLW58cMn8MfAwMYjDcxtubNb7M AG9iZRj6wn6tKCsXtYUgAIpNhyPPtDuEZ5df1ecOnvlW2vO+MwytM8DLLtwolET/ tPzOXPHDiyKjij02jyJ1DlZxptKudiKaBeY1WY/W/PpS6fGskTJQc/bZPgE3OP/9 Y9Y1uzZTulkO3R6MlLNdLam32/ehpJvSWyfSbToyC2ejvaXoRChPFcAmTpqA0HPg h8sudiS14QIDAQABo3QwcjAdBgNVHQ4EFgQUR0gRYoOCPJYqFiPGwB141VTCXuIw HwYDVR0jBBgwFoAUR0gRYoOCPJYqFiPGwB141VTCXuIwDwYDVR0TAQH/BAUwAwEB /zAfBgNVHREEGDAWgRR2YWxpZC1jYUBleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsF AAOCAQEAJDQsNTWxVLNHBrVl6p6IetzeBt64GoWp6OP5C8/HY3dlznfbrn6ZvWBr Vsnc7VZ49r8r/QvRKRrljkIQuNwaW/LmRxJ1AVGGiorspmrdz0Lf2WOXnLH/+4lR q5dar5YmGqi9Mo2j5ALg/2MiO1PonuKs1eX9tLZCCeanXFexU0qaeFZelunJ6UUm BXpaGO1QfECcNnvarudosbe1ve6YGABn8MpAY+8zdYnYHPB8Pojhzvk7/8PMHoPu njDb3lZT+b8BDmNz+GISCUSHYkdK2rWh+8wqD3T5rOtzTqAPuSNeDNocUF6wzxem HWqvP7yM3VoXYvn7FA4NCa9mE3k8MzGCApcwggKTAgEBMIGUMHwxCzAJBgNVBAYT AlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNh dGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZh bGlkLWNhQGV4YW1wbGUuY29tAhQoC/xUcLhcK13sGSiYxuUPf758tDAJBgUrDgMC GgUAoIHYMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X DTIyMTEwNDEzMzE1NVowIwYJKoZIhvcNAQkEMRYEFK+sB97I9ZGpDGUMWLsE3dCU /pbtMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAL BglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3 DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIB AFli04jnSd0d0lnE9GO23qzxI98QIbCz1NU1qk+zDyAhwOWQJdMUfuekk3g4Gn2q OFzdvlIMpgG2W7AVZlLUQMQjWIoDWkTeqxM8n6StoXcDvlArBHQDbourufFUu7OE 3TVsI6l/jZG3Xub9Uar0S3lF6rQ/A3vl28poRL/EIQye6ypg6UbS/EvkvfbsKUJD 6SpExlwh0R7lk1g/xn3tFVSEAH7VSJYr/8C/Bak06NPOtZZSSeU9ryRzeK/gN3SJ nrEp+NkTezzApjSnZasrPSbzmRL4+18x3kmAmnwR3aRi7F7KhCs78qPUEVP5XbhX 2hO9RjMy6Uki+R/AG4aempk= ------6E9953AAECB0BDB6F65BCD88900D3E15-- ================================================ FILE: acme4j-smime/src/test/resources/email/invalid-protected-mail-to.eml ================================================ From: valid-ca@example.com To: tampered-recipient@example.com Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----2D5F3855936C8172B69EB7BC1C12A23A" This is an S/MIME signed message ------2D5F3855936C8172B69EB7BC1C12A23A Content-Type: message/RFC822; forwarded=no From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------2D5F3855936C8172B69EB7BC1C12A23A Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIGzQYJKoZIhvcNAQcCoIIGvjCCBroCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCA/4wggP6MIIC4qADAgECAhQoC/xUcLhcK13sGSiYxuUPf758tDANBgkq hkiG9w0BAQsFADB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjEx MDQxMjU1MzlaFw0zMjExMDExMjU1MzlaMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQH DAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIG A1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1w bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzTyW1VRm+mQH YU5hZWgzgrPRkRzMLlLoCamlRs5DjGf3zIpo9a/17m60YfIXBJruImUBXxa5lp0Z qaayty+nZOpS0wBZSqTLuslZ0WuyyyW2DEBNO7jLW58cMn8MfAwMYjDcxtubNb7M AG9iZRj6wn6tKCsXtYUgAIpNhyPPtDuEZ5df1ecOnvlW2vO+MwytM8DLLtwolET/ tPzOXPHDiyKjij02jyJ1DlZxptKudiKaBeY1WY/W/PpS6fGskTJQc/bZPgE3OP/9 Y9Y1uzZTulkO3R6MlLNdLam32/ehpJvSWyfSbToyC2ejvaXoRChPFcAmTpqA0HPg h8sudiS14QIDAQABo3QwcjAdBgNVHQ4EFgQUR0gRYoOCPJYqFiPGwB141VTCXuIw HwYDVR0jBBgwFoAUR0gRYoOCPJYqFiPGwB141VTCXuIwDwYDVR0TAQH/BAUwAwEB /zAfBgNVHREEGDAWgRR2YWxpZC1jYUBleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsF AAOCAQEAJDQsNTWxVLNHBrVl6p6IetzeBt64GoWp6OP5C8/HY3dlznfbrn6ZvWBr Vsnc7VZ49r8r/QvRKRrljkIQuNwaW/LmRxJ1AVGGiorspmrdz0Lf2WOXnLH/+4lR q5dar5YmGqi9Mo2j5ALg/2MiO1PonuKs1eX9tLZCCeanXFexU0qaeFZelunJ6UUm BXpaGO1QfECcNnvarudosbe1ve6YGABn8MpAY+8zdYnYHPB8Pojhzvk7/8PMHoPu njDb3lZT+b8BDmNz+GISCUSHYkdK2rWh+8wqD3T5rOtzTqAPuSNeDNocUF6wzxem HWqvP7yM3VoXYvn7FA4NCa9mE3k8MzGCApcwggKTAgEBMIGUMHwxCzAJBgNVBAYT AlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNh dGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZh bGlkLWNhQGV4YW1wbGUuY29tAhQoC/xUcLhcK13sGSiYxuUPf758tDAJBgUrDgMC GgUAoIHYMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X DTIyMTEwNDEzMzE1NVowIwYJKoZIhvcNAQkEMRYEFK+sB97I9ZGpDGUMWLsE3dCU /pbtMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAL BglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3 DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIB AFli04jnSd0d0lnE9GO23qzxI98QIbCz1NU1qk+zDyAhwOWQJdMUfuekk3g4Gn2q OFzdvlIMpgG2W7AVZlLUQMQjWIoDWkTeqxM8n6StoXcDvlArBHQDbourufFUu7OE 3TVsI6l/jZG3Xub9Uar0S3lF6rQ/A3vl28poRL/EIQye6ypg6UbS/EvkvfbsKUJD 6SpExlwh0R7lk1g/xn3tFVSEAH7VSJYr/8C/Bak06NPOtZZSSeU9ryRzeK/gN3SJ nrEp+NkTezzApjSnZasrPSbzmRL4+18x3kmAmnwR3aRi7F7KhCs78qPUEVP5XbhX 2hO9RjMy6Uki+R/AG4aempk= ------2D5F3855936C8172B69EB7BC1C12A23A-- ================================================ FILE: acme4j-smime/src/test/resources/email/invalid-signed-mail.eml ================================================ From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----2D188458DC295B22904B7A1FB62F57BF" This is an S/MIME signed message ------2D188458DC295B22904B7A1FB62F57BF Content-Type: message/RFC822; forwarded=no From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------2D188458DC295B22904B7A1FB62F57BF Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIG1QYJKoZIhvcNAQcCoIIGxjCCBsICAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCBAQwggQAMIIC6KADAgECAhRuqrQwjQAEKPLiumz639inbqPeJzANBgkq hkiG9w0BAQsFADB+MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVFbWNhIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSUwIwYJKoZIhvcNAQkBFhZpbnZhbGlkLWNhQGV4YW1wbGUuY29tMB4XDTIy MTEwNDEyNTUzOVoXDTMyMTEwMTEyNTUzOVowfjELMAkGA1UEBhMCWFgxEjAQBgNV BAcMCUFjbWUgQ2l0eTEeMBwGA1UECgwVRW1jYSBDZXJ0aWZpY2F0ZXMgTHRkMRQw EgYDVQQDDAtleGFtcGxlLmNvbTElMCMGCSqGSIb3DQEJARYWaW52YWxpZC1jYUBl eGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxVUSNR pIreCKvtK148IWN7MWfK8fymmPOF8oQcFieCC0mfw8efc/4MEVA5qN3avHOXd1RG VgaR+tM30zRiTLllc6YnPePUPZNSQmJcnXgMlRhmOeCfo2hNglWFBnP/CV29xarP Cf94DqXGrLZ8L8uGtk/JsNOreced34V4RZ9WvN53HlyiNtEJJLggM17wzJZcV+rQ 7LtsBHZfDOdTScCpEDqLZDmLMVLEBUtrwo5+5mYw4M0PDEP2D4qPux7NAHuaG66F Zt7mq6DcceG/AneuUN7xOyMQ9x/D3NfiSgXbZeJM+BbE0cT7EY9WdZBtsS6HjJA0 yt98FgAIDoSzRQcCAwEAAaN2MHQwHQYDVR0OBBYEFB0Xb1ErzzEjzPrJC8PvkAJ3 qnoGMB8GA1UdIwQYMBaAFB0Xb1ErzzEjzPrJC8PvkAJ3qnoGMA8GA1UdEwEB/wQF MAMBAf8wIQYDVR0RBBowGIEWaW52YWxpZC1jYUBleGFtcGxlLmNvbTANBgkqhkiG 9w0BAQsFAAOCAQEAnwFh8H7lwMWrHSceM6MVt+5M0yVX/r6K5YWGI/AaFG2Q5jkz 6yIeESgiXukza4oKY1I1clZwWus9fnrwn+AWbtvKbGLklFWCUB60fx82dZwoO14Q Tm3GX6wwC0Y5eFYiXwEJ4gnazBWEWscp4E94AKqr1EYuOI9sR22l/rNtANrEiVsT P4+kUgLEr9Y5infYglXQMjDVfNXRSETBnx4a5Fljd7pSD4e7H19eMiByd78q98ze t0g2anl2cJbdM6cgu5iyAgS3BgMrFMnd8m7KkZwum+tslNWA1tbDGK0AWH7ztjh3 orifkxq2Hw6tdypZoWoLrwSEDEvNIy8+sQjUOTGCApkwggKVAgEBMIGWMH4xCzAJ BgNVBAYTAlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoMFUVtY2EgQ2Vy dGlmaWNhdGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xJTAjBgkqhkiG9w0B CQEWFmludmFsaWQtY2FAZXhhbXBsZS5jb20CFG6qtDCNAAQo8uK6bPrf2Kduo94n MAkGBSsOAwIaBQCggdgwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG 9w0BCQUxDxcNMjIxMTA0MTMzMTU1WjAjBgkqhkiG9w0BCQQxFgQUr6wH3sj1kakM ZQxYuwTd0JT+lu0weQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJYIZI AWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAw DQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZIhvcN AQEBBQAEggEAdZ4XoWViOrqOd4kWZVD+12GXJ7NcCWHOiTdXZ0S/3TKwwTPwQ0f0 XZmk8iJwcfXqAv48ITK+yh4jk8urtrjS3xohHGxVonifbgxoLm/yHqA13D4F0M9q r0jfmXAWfH1HDk6AtZA5c1IJVJNMcVcLHkib232FgpicgPEZNWvRr8zHCNN3dymF Qme9h2BqHxy2+nX96BBEiRMImG9Z9G4+sOqpwiDTNgzr7nFtldKtjiV/GarBeteZ nx4QcHXY307ydLDrh2JzLK/+LZEhTMBQ2rWGfAo/owDGi/Pal//SgqQWFy3luJp2 8WG34Z4CnG514YmRzN2Z1V3fvreRInllkQ== ------2D188458DC295B22904B7A1FB62F57BF-- ================================================ FILE: acme4j-smime/src/test/resources/email/valid-mail-7508.eml ================================================ Return-Path: X-Original-To: gitlab@dc-bsd.my.corp Delivered-To: gitlab@dc-bsd.my.corp Received: from [127.0.0.1] (acme-ca-02.dc-bsd.my.corp [10.70.15.231]) by mail.dc-bsd.my.corp (Postfix) with ESMTP id 0119D9CC22 for ; Sat, 26 Nov 2022 21:09:39 +0000 (UTC) Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="--_NmP-1d902f4d1e8a735a-Part_1" Auto-Submitted: auto-generated; type=acme From: acme-challenge@dc-bsd.my.corp To: gitlab@dc-bsd.my.corp Subject: ACME: ABxfL5s4bjvmyVRvl6y-Y_GhdzTdWpKqlmrKAIVe Message-ID: Date: Sat, 26 Nov 2022 21:09:38 +0000 MIME-Version: 1.0 ----_NmP-1d902f4d1e8a735a-Part_1 Content-Type: multipart/alternative; boundary="--_NmP-1d902f4d1e8a735a-Part_2" ----_NmP-1d902f4d1e8a735a-Part_2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

This is an automatically generated ACME challenge for email = address gitlab@dc-bsd.my.corp. If you haven't requested an S/MIME = certificate generation for this email address, be very afraid. If you did = request it, your email client might be able to process this request = automatically, or you might have to paste the first token part into an = external program.

Please reply to this mail and fill out the = following template: 

-----BEGIN ACME RESPONSE-----
<fill in challengeResponse here>
-----END ACME RESPONSE-----
Use the value of the following calculation inside the ACME response: 
  token =3D (decodeBase64url(token-part1) || decodeBase64url(token-par=
t2))
  keyAuthorization =3D base64url(token) || '.' || base64url(Thumbprint(acco=
untKey))
  challengeResponse =3D base64url(SHA256(keyAuthorization))
Where can I find all the ingredients for this?
  • token-part1 is = in the subject of this email after 'ACME: ',
  • token-part2 can be = found in your challenge request (over https),
  • accountKey has been = generated in your ACME client.

----_NmP-1d902f4d1e8a735a-Part_2 Content-Type: application/json; charset=utf8 Content-Encoding: utf8 { "token-part1": "001c5f2f9b386e3be6c9546f97acbe63f1a17734dd5a92aa966aca00855e" } ----_NmP-1d902f4d1e8a735a-Part_2-- ----_NmP-1d902f4d1e8a735a-Part_1 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7s MIIUXQYJKoZIhvcNAQcCoIIUTjCCFEoCAQExDzANBglghkgBZQMEAgEFADCCBkkGCSqGSIb3DQEH AaCCBjoEggY2Q29udGVudC1UeXBlOiBtdWx0aXBhcnQvYWx0ZXJuYXRpdmU7DQogYm91bmRhcnk9 Ii0tX05tUC0xZDkwMmY0ZDFlOGE3MzVhLVBhcnRfMiINCg0KLS0tLV9ObVAtMWQ5MDJmNGQxZThh NzM1YS1QYXJ0XzINCkNvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04DQpDb250 ZW50LVRyYW5zZmVyLUVuY29kaW5nOiBxdW90ZWQtcHJpbnRhYmxlDQoNCjxodG1sPjxwPlRoaXMg aXMgYW4gYXV0b21hdGljYWxseSBnZW5lcmF0ZWQgQUNNRSBjaGFsbGVuZ2UgZm9yIGVtYWlsID0N CmFkZHJlc3MgPGVtPmdpdGxhYkBkYy1ic2QubXkuY29ycDwvZW0+LiBJZiB5b3UgaGF2ZW4ndCBy ZXF1ZXN0ZWQgYW4gUy9NSU1FID0NCmNlcnRpZmljYXRlIGdlbmVyYXRpb24gZm9yIHRoaXMgZW1h aWwgYWRkcmVzcywgYmUgdmVyeSBhZnJhaWQuIElmIHlvdSBkaWQgPQ0KcmVxdWVzdCBpdCwgeW91 ciBlbWFpbCBjbGllbnQgbWlnaHQgYmUgYWJsZSB0byBwcm9jZXNzIHRoaXMgcmVxdWVzdCA9DQph dXRvbWF0aWNhbGx5LCBvciB5b3UgbWlnaHQgaGF2ZSB0byBwYXN0ZSB0aGUgZmlyc3QgdG9rZW4g cGFydCBpbnRvIGFuID0NCmV4dGVybmFsIHByb2dyYW0uPC9wPiA8cD5QbGVhc2UgcmVwbHkgdG8g dGhpcyBtYWlsIGFuZCBmaWxsIG91dCB0aGUgPQ0KZm9sbG93aW5nIHRlbXBsYXRlOiA8cHJlPi0t LS0tQkVHSU4gQUNNRSBSRVNQT05TRS0tLS0tDQombHQ7ZmlsbCBpbiBjaGFsbGVuZ2VSZXNwb25z ZSBoZXJlJmd0Ow0KLS0tLS1FTkQgQUNNRSBSRVNQT05TRS0tLS0tDQo8L3ByZT5Vc2UgdGhlIHZh bHVlIG9mIHRoZSBmb2xsb3dpbmcgY2FsY3VsYXRpb24gaW5zaWRlIHRoZSBBQ01FIHJlc3BvbnNl Og0KPHByZT4gIHRva2VuID0zRCAoZGVjb2RlQmFzZTY0dXJsKHRva2VuLXBhcnQxKSB8fCBkZWNv ZGVCYXNlNjR1cmwodG9rZW4tcGFyPQ0KdDIpKQ0KICBrZXlBdXRob3JpemF0aW9uID0zRCBiYXNl NjR1cmwodG9rZW4pIHx8ICcuJyB8fCBiYXNlNjR1cmwoVGh1bWJwcmludChhY2NvPQ0KdW50S2V5 KSkNCiAgY2hhbGxlbmdlUmVzcG9uc2UgPTNEIGJhc2U2NHVybChTSEEyNTYoa2V5QXV0aG9yaXph dGlvbikpDQo8L3ByZT5XaGVyZSBjYW4gSSBmaW5kIGFsbCB0aGUgaW5ncmVkaWVudHMgZm9yIHRo aXM/PHVsPjxsaT50b2tlbi1wYXJ0MSBpcyA9DQppbiB0aGUgc3ViamVjdCBvZiB0aGlzIGVtYWls IGFmdGVyICdBQ01FOiAnLDwvbGk+PGxpPnRva2VuLXBhcnQyIGNhbiBiZSA9DQpmb3VuZCBpbiB5 b3VyIGNoYWxsZW5nZSByZXF1ZXN0IChvdmVyIGh0dHBzKSw8L2xpPjxsaT5hY2NvdW50S2V5IGhh cyBiZWVuID0NCmdlbmVyYXRlZCBpbiB5b3VyIEFDTUUgY2xpZW50LjwvbGk+PC91bD48L3A+PC9o dG1sPg0KLS0tLV9ObVAtMWQ5MDJmNGQxZThhNzM1YS1QYXJ0XzINCkNvbnRlbnQtVHlwZTogYXBw bGljYXRpb24vanNvbjsgY2hhcnNldD11dGY4DQpDb250ZW50LUVuY29kaW5nOiB1dGY4DQoNCnsg InRva2VuLXBhcnQxIjogIjAwMWM1ZjJmOWIzODZlM2JlNmM5NTQ2Zjk3YWNiZTYzZjFhMTc3MzRk ZDVhOTJhYTk2NmFjYTAwODU1ZSIgfQ0KLS0tLV9ObVAtMWQ5MDJmNGQxZThhNzM1YS1QYXJ0XzIt LQ0KoIIK5DCCBI8wggQUoAMCAQICFGFq2BiR4ebW84K3/HrjMpkODKUtMAoGCCqGSM49BAMDMEkx CzAJBgNVBAYTAkpQMQ4wDAYDVQQHDAVUb2tpbzEQMA4GA1UECgwHTXkuQ29ycDEYMBYGA1UEAwwP Um9vdCBDQSAyMDIyIEcxMB4XDTIyMTEyNDIxNDAxN1oXDTI1MDUyODIxNDAxNlowSDELMAkGA1UE BhMCSlAxDjAMBgNVBAcMBVRva2lvMRAwDgYDVQQKDAdNeS5Db3JwMRcwFQYDVQQDDA5TdWIgQ0Eg MjAyMiBHMTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAIILhCsJsrzhrAELwxAbrKaH ALeP7liQqUiPDbN+JfRvqyEBpBG8JBkGC76uM5TIQ+f+28IBIs0YwdjIiCNPeew/nAPZ1aNZEYco vQ7G3CQ7mUAhFkeGKOVaS+2LOqvmdry5p1SKlC0ziw/Yf3dD1KSQ4sBPBa7gOp8pDpe9YKX/j/fX k83iSTFvrp1LTe4BILMh9YzVAukKR5A3WgVkrR156gLoV6Rew6uSwHAOtl4JAYBclRohmvbjU/FP k2kX8h6NK+V21HXD0inhyI/NnyVPxEO+n2isnrrtz/R6t2pUPn28xhNjbnFEBk8KZ4fQH23/BRtA cIibh3dzetVRJdoVZEjoYmZdveMB6TqsJJtlSSHTVIKcWNUFKAiqS5wSHVaX2XnjdVgqkQU3j5kD JBCwPG47KpoNdTTa4JWQwI9G57kGAvPomj+6ljYSavzfCeQ8nxwkoRhG0eXjalpOnjUPAxowqhmE mRYTg7hzIFPXYInhFIvHwd4zFkPh8HOa7wIDAQABo4IBjjCCAYowEgYDVR0TAQH/BAgwBgEB/wIB ADAOBgNVHQ8BAf8EBAMCAYYwHgYDVR0gBBcwFTAIBgZngQwBAgEwCQYHZ4EMAQUBAjB+BggrBgEF BQcBAQRyMHAwbgYIKwYBBQUHMAKGYmh0dHA6Ly9hY21lLWNhLTAxLmRjLWJzZC5teS5jb3JwL2Rv d25sb2FkL1Jvb3QvNTQ1MWYxOWZkZDg5MmNjYmU5YmU3ODM1ODc2NjcwZmQxYjY5OTllOC9jYS5j cnQuY2VyMGwGA1UdHwRlMGMwYaBfoF2GW2h0dHA6Ly9hY21lLWNhLTAxLmRjLWJzZC5teS5jb3Jw L2Rvd25sb2FkL1Jvb3QvNTQ1MWYxOWZkZDg5MmNjYmU5YmU3ODM1ODc2NjcwZmQxYjY5OTllOC5j cmwwKwYDVR0jBCQwIoAgxGqTGFlSJtP48rVLeyMc58TIb5WWC/mBW4AKc0OmIm0wKQYDVR0OBCIE INUBWh3giyFeu6hqGeExhD+S2sWYkeQcsGY6tX6AUgULMAoGCCqGSM49BAMDA2kAMGYCMQDW0NKq k5JJl+DQvDBAVWZ99LFzKP2y9H8RHNynK2g+VlF6h2141+SWO+ev2GAFj5kCMQC8HuhmB1g+aYuP wcuBtpOSZGrdTHXFmRubI/rb4K8rZTgP/FQXzbK81Mctv1V+AxgwggZNMIIEtaADAgECAhRTWC34 33N0r2EkwdKjLxrvITOOgDANBgkqhkiG9w0BAQsFADBIMQswCQYDVQQGEwJKUDEOMAwGA1UEBwwF VG9raW8xEDAOBgNVBAoMB015LkNvcnAxFzAVBgNVBAMMDlN1YiBDQSAyMDIyIEcxMB4XDTIyMTEy NDIxNDExNVoXDTIzMDIyMjIxNDExNFowVzELMAkGA1UEBhMCSlAxDjAMBgNVBAcMBVRva2lvMRAw DgYDVQQKDAdNeS5Db3JwMSYwJAYDVQQDFh1hY21lLWNoYWxsZW5nZUBkYy1ic2QubXkuY29ycDCC AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAInbq8HuIIHbaSgUP5jMSZuIt82r34Cbd4b6 C1OgzJWW2CY++t1wkwmAA4NRHZEesm3c6AsqfYbbvifdAlll4bDuQXAtMDphyICgllLqyvdhI7ya FjhMzTyGHKXKztbjNyLwz9gFP/g6v/44EsPdagaFaVjFGeaBGr/JSih2cdBo8oICaEFhRymtARQP 95mu+A0bV16zE2JnSqvN6ivIrN2uHQjlo0uymWRXJsK3Jv3Xm71vnKiESclkYQHNXi7PyA1GuOEO oxSln7FQhzXYYurGenjzg9WAemtPPVw3jcMg9rM1k+Lkns/VLj3VTXhDZg1Ye6CsmTpUEmVo3seu vM2Y8GyTndmNt/tVAwiD77Ok5BRbSCBzQkopwMuzajg5PYXd0VGjhMUOxfgZavZGGFpjwPkEqY7s hhSwp5Wmq5OBehpPmh47ILHgUrctjALcgWgc4gaLwTVeDOOvHA0IbQBAFqD1mxNb1i4gSEJc9dUa lxc4LGa6ubhVLsNg9n7mdQIDAQABo4ICHjCCAhowCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAw FgYDVR0lAQH/BAwwCgYIKwYBBQUHAwQwKAYDVR0RBCEwH4EdYWNtZS1jaGFsbGVuZ2VAZGMtYnNk Lm15LmNvcnAwEwYDVR0gBAwwCjAIBgZngQwBAgIwgeAGCCsGAQUFBwEBBIHTMIHQMF8GCCsGAQUF BzABhlNodHRwOi8vYWNtZS1jYS0wMS5kYy1ic2QubXkuY29ycC9vY3NwL1N1Yi82MTZhZDgxODkx ZTFlNmQ2ZjM4MmI3ZmM3YWUzMzI5OTBlMGNhNTJkLzBtBggrBgEFBQcwAoZhaHR0cDovL2FjbWUt Y2EtMDEuZGMtYnNkLm15LmNvcnAvZG93bmxvYWQvU3ViLzYxNmFkODE4OTFlMWU2ZDZmMzgyYjdm YzdhZTMzMjk5MGUwY2E1MmQvY2EuY3J0LmNlcjBrBgNVHR8EZDBiMGCgXqBchlpodHRwOi8vYWNt ZS1jYS0wMS5kYy1ic2QubXkuY29ycC9kb3dubG9hZC9TdWIvNjE2YWQ4MTg5MWUxZTZkNmYzODJi N2ZjN2FlMzMyOTkwZTBjYTUyZC5jcmwwKwYDVR0jBCQwIoAg1QFaHeCLIV67qGoZ4TGEP5LaxZiR 5BywZjq1foBSBQswKQYDVR0OBCIEIFWVbzWpC2IKkBu6DBLEtmO/1GjEXKJaYigKZkkPYBsgMA0G CSqGSIb3DQEBCwUAA4IBgQAFvMhQ3dpIYwXch5Op0v3qhnRpZFpZh/3DCjLAQt2d+O71nVGGt6Bj jsiewHU6Dtl5zxDZfz9cQTaRhEWfXka2byFWKfYw3xq64cmr5a7+9RynvtrSBjx9a+IOVNAylyjK xnNdWVZLa0Qna1Qqngz32i7aXxENuES2kZcBTnLDEaA3WBuGdlqBsFn1T0A6pP20/np8TS4Q17hR GEAE9jrhcmRcbP7ABqDz7+Jcq0qnpXE8zJwm9DsR4HJ1Cudsm3iIz3BSDOchUMPPcOOG+JltYOus eaheeNFDdyxKIx4TZkRwI+avl27DJ4O2n/OKqDQZTYcg/HxH2xWwNfq2/Z08YeH/I4xJnlPxZSDG DjvVNcQMsAwOdG2O55Lq7q4wmp7ZH2JVA97vekBAJwltjyy3APDOeqi4CnzlaZcOn0GRg7MasQmF AYbOlo8Ti8oe4U65w8Y2q4ip1EbiwfNMrAkcaAVGIJm2pTapp9nOraed68uMogF7xPhucJLA7Zer WMMxggL9MIIC+QIBATBgMEgxCzAJBgNVBAYTAkpQMQ4wDAYDVQQHDAVUb2tpbzEQMA4GA1UECgwH TXkuQ29ycDEXMBUGA1UEAwwOU3ViIENBIDIwMjIgRzECFFNYLfjfc3SvYSTB0qMvGu8hM46AMA0G CWCGSAFlAwQCAQUAoIHvMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwLwYJKoZIhvcNAQkEMSIE IIbuwptDlJ0DVnN9vhoyQl6l6BeOjhuVjyRkfKXrS2bSMIGhBgsqhkiG9w0BCRACNzGBkTGBjgoB ATCBiDA8GgdTdWJqZWN0DC5BQ01FOiBBQnhmTDVzNGJqdm15VlJ2bDZ5LVlfR2hkelRkV3BLcWxt cktBSVZlAgEAMB4aAlRvDBVnaXRsYWJAZGMtYnNkLm15LmNvcnACAQAwKBoERnJvbQwdYWNtZS1j aGFsbGVuZ2VAZGMtYnNkLm15LmNvcnACAQAwDQYJKoZIhvcNAQELBQAEggGAGUyk3DnAEFJeB3xS qbgx6NdbkP3G1ah9el01wEez4jQC1pvRe07dMApkJImlSxnOB5Lp/06a14YvAu/rGdmTIAZjeuXV VPxo+urSTUj4dZB26HNKHyUwXvKWgIhfwlrc/kK+sXyYXk8cNNtAuOQlTJyU1B1NG5nFKTi4UOZI 9B1Lc0MktnrAntB70bOVcT0Lz5Qgslc8jwIUePJLyGKohKTe/744QPqZAz7nQaXS9E30yd1oTB7I FH4Fg9GjWnD8rLvdCR/S54zEqsdIX/YCmky5DzyjLthY1Al4AJwaodd5gPQn2xhtkxssHLg48/X+ 3Se+JTyad6MXmMixnlJFL8DoL8r/BcfZbT4b8oLWMrbURooMPVnxYbTx67IOGxuIYFolM9d9F39P GBcFkTGIbcVUOIyV2vGH0fXOiVx4ktm4j3Ds843KZ8hj52SZr7RBAsgileucs713UOjfhrQqkbZh nF5r9fOKs8ky8tSePQ8izk/jXC6PY5D7xyELoPrh ----_NmP-1d902f4d1e8a735a-Part_1-- ================================================ FILE: acme4j-smime/src/test/resources/email/valid-mail.eml ================================================ From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Auto-Submitted: auto-generated; type=acme Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----163CF1BA3ECF9F288779BFBE9EF3E10C" This is an S/MIME signed message ------163CF1BA3ECF9F288779BFBE9EF3E10C Content-Type: message/RFC822; forwarded=no From: valid-ca@example.com To: recipient@example.org Subject: ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME= Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 This is an automatically generated ACME challenge. ------163CF1BA3ECF9F288779BFBE9EF3E10C Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIGzQYJKoZIhvcNAQcCoIIGvjCCBroCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3 DQEHAaCCA/4wggP6MIIC4qADAgECAhQoC/xUcLhcK13sGSiYxuUPf758tDANBgkq hkiG9w0BAQsFADB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBDaXR5MR4w HAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4YW1wbGUu Y29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjEx MDQxMjU1MzlaFw0zMjExMDExMjU1MzlaMHwxCzAJBgNVBAYTAlhYMRIwEAYDVQQH DAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNhdGVzIEx0ZDEUMBIG A1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZhbGlkLWNhQGV4YW1w bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzTyW1VRm+mQH YU5hZWgzgrPRkRzMLlLoCamlRs5DjGf3zIpo9a/17m60YfIXBJruImUBXxa5lp0Z qaayty+nZOpS0wBZSqTLuslZ0WuyyyW2DEBNO7jLW58cMn8MfAwMYjDcxtubNb7M AG9iZRj6wn6tKCsXtYUgAIpNhyPPtDuEZ5df1ecOnvlW2vO+MwytM8DLLtwolET/ tPzOXPHDiyKjij02jyJ1DlZxptKudiKaBeY1WY/W/PpS6fGskTJQc/bZPgE3OP/9 Y9Y1uzZTulkO3R6MlLNdLam32/ehpJvSWyfSbToyC2ejvaXoRChPFcAmTpqA0HPg h8sudiS14QIDAQABo3QwcjAdBgNVHQ4EFgQUR0gRYoOCPJYqFiPGwB141VTCXuIw HwYDVR0jBBgwFoAUR0gRYoOCPJYqFiPGwB141VTCXuIwDwYDVR0TAQH/BAUwAwEB /zAfBgNVHREEGDAWgRR2YWxpZC1jYUBleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsF AAOCAQEAJDQsNTWxVLNHBrVl6p6IetzeBt64GoWp6OP5C8/HY3dlznfbrn6ZvWBr Vsnc7VZ49r8r/QvRKRrljkIQuNwaW/LmRxJ1AVGGiorspmrdz0Lf2WOXnLH/+4lR q5dar5YmGqi9Mo2j5ALg/2MiO1PonuKs1eX9tLZCCeanXFexU0qaeFZelunJ6UUm BXpaGO1QfECcNnvarudosbe1ve6YGABn8MpAY+8zdYnYHPB8Pojhzvk7/8PMHoPu njDb3lZT+b8BDmNz+GISCUSHYkdK2rWh+8wqD3T5rOtzTqAPuSNeDNocUF6wzxem HWqvP7yM3VoXYvn7FA4NCa9mE3k8MzGCApcwggKTAgEBMIGUMHwxCzAJBgNVBAYT AlhYMRIwEAYDVQQHDAlBY21lIENpdHkxHjAcBgNVBAoMFUFjbWUgQ2VydGlmaWNh dGVzIEx0ZDEUMBIGA1UEAwwLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFHZh bGlkLWNhQGV4YW1wbGUuY29tAhQoC/xUcLhcK13sGSiYxuUPf758tDAJBgUrDgMC GgUAoIHYMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X DTIyMTEwNDEzMzE1NVowIwYJKoZIhvcNAQkEMRYEFK+sB97I9ZGpDGUMWLsE3dCU /pbtMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAL BglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3 DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIB AFli04jnSd0d0lnE9GO23qzxI98QIbCz1NU1qk+zDyAhwOWQJdMUfuekk3g4Gn2q OFzdvlIMpgG2W7AVZlLUQMQjWIoDWkTeqxM8n6StoXcDvlArBHQDbourufFUu7OE 3TVsI6l/jZG3Xub9Uar0S3lF6rQ/A3vl28poRL/EIQye6ypg6UbS/EvkvfbsKUJD 6SpExlwh0R7lk1g/xn3tFVSEAH7VSJYr/8C/Bak06NPOtZZSSeU9ryRzeK/gN3SJ nrEp+NkTezzApjSnZasrPSbzmRL4+18x3kmAmnwR3aRi7F7KhCs78qPUEVP5XbhX 2hO9RjMy6Uki+R/AG4aempk= ------163CF1BA3ECF9F288779BFBE9EF3E10C-- ================================================ FILE: acme4j-smime/src/test/resources/invalid-signer-privkey.pem ================================================ -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDMVVEjUaSK3gir 7StePCFjezFnyvH8ppjzhfKEHBYnggtJn8PHn3P+DBFQOajd2rxzl3dURlYGkfrT N9M0Yky5ZXOmJz3j1D2TUkJiXJ14DJUYZjngn6NoTYJVhQZz/wldvcWqzwn/eA6l xqy2fC/LhrZPybDTq3nHnd+FeEWfVrzedx5cojbRCSS4IDNe8MyWXFfq0Oy7bAR2 XwznU0nAqRA6i2Q5izFSxAVLa8KOfuZmMODNDwxD9g+Kj7sezQB7mhuuhWbe5qug 3HHhvwJ3rlDe8TsjEPcfw9zX4koF22XiTPgWxNHE+xGPVnWQbbEuh4yQNMrffBYA CA6Es0UHAgMBAAECggEAByliW6OL6dYYZbY9U+M1pF/3/lRNoPZR3A8wzdKSMDZN oPn5ibCcByZzIOW0dnopKr//TbPdZgON0ANf4rEjUUguAn/Tmn2g3t3+N6ZZWpDO VPmYQ7g0qP42eDreXAhvUprJJ9Bz4EFb+hF5kjfOEQsarrc5/GFBNm7hG7N4dTos ANLHDVt9p++40mBC9UnFTI9fghYqqsBipI2hMcVtLlfsTyhfdYk2atC0YwWH2g7H nyFsfrgwNlza5iAKuQn1vGhM6nigGBiDfHifNoTHZPhIcgHRwPvZWCpxcAt8wPw1 4blqZPRqmbOYQHisXVSbKJbgN8zZiZB2j/SSDv9IyQKBgQDqpiSaiBZ+bUfy5M07 mSClnHR8/zulR7NuSWZ5C92w2EFYI/OkSwKeshKdmafCz9VeVkeCUjjRkAGOF2pr I1icdY0XDt/Pd+jQzDqTtiUwwMOLRyvV437nCsMer++LbKRblEL+uSLCPhV2dnyx GUXj9JJhnGeZ+xKH20cE1dr2NQKBgQDe7QG6UGrXUzfN2BttvJfOAKETtVfl1Mm0 uEC2skPlY1KVFYOCMuOFXLHwlc0KYNzVh5qBH+3dPyX1zjTurXmnaOcW0LxgJ4JN vKiXDLrt8HYJqANjYCh7vaZmuZ8RduR4iS+E+JG6JLAdfGIzPvzzUgbo5hXuFnQE dN8gsJcFywKBgAF24fmY6dMGKZHJfcJmdT6zWELDcQLaDLOef6Y3vb1xzA6ZwtZ+ pViKMfWL1PExTNqW3UFh8/rS1D+nw8FBajcnwKapMBpiXDCZZbAwTdEdEttWqV5f WhZlCcyyOmN7XRc5OKXQT/g4XPftS1/rkXUXvKYhTMA4QehZJPtRvlkVAoGBAMS+ h/fXYXQIjget4wdGmvPEumSad6jv09UbiIG1cxbQQeIxyo7uOr9IwAKFMyElu8D4 nPO5KkVJpkb6Ztz/XY7SlqEcOCTkuavCBUjKg2/b+VEsZ1EdXJ1ZE7M1v526QInh CX9hobuXBZgAXuq7fKOCkXabGl+2kU4dl49SSvdhAoGAH06W9bZUiqkLIzv+LizW rVP9fN4A8EGNtdWVrVD0Ql0hh/PBqGiiVwg47LAVuvpIc9kDDQM/5A6tF7aOGRDR k5ZDIrnWmrGQcEMTcisc5OwPnNjLVzV9r0swmeWcqZDrfgxeKpG7vdRaQdR++0FU 1zaGc8HFGtTeJw6f6ZYttg8= -----END PRIVATE KEY----- ================================================ FILE: acme4j-smime/src/test/resources/invalid-signer.pem ================================================ -----BEGIN CERTIFICATE----- MIIEADCCAuigAwIBAgIUbqq0MI0ABCjy4rps+t/Yp26j3icwDQYJKoZIhvcNAQEL BQAwfjELMAkGA1UEBhMCWFgxEjAQBgNVBAcMCUFjbWUgQ2l0eTEeMBwGA1UECgwV RW1jYSBDZXJ0aWZpY2F0ZXMgTHRkMRQwEgYDVQQDDAtleGFtcGxlLmNvbTElMCMG CSqGSIb3DQEJARYWaW52YWxpZC1jYUBleGFtcGxlLmNvbTAeFw0yMjExMDQxMjU1 MzlaFw0zMjExMDExMjU1MzlaMH4xCzAJBgNVBAYTAlhYMRIwEAYDVQQHDAlBY21l IENpdHkxHjAcBgNVBAoMFUVtY2EgQ2VydGlmaWNhdGVzIEx0ZDEUMBIGA1UEAwwL ZXhhbXBsZS5jb20xJTAjBgkqhkiG9w0BCQEWFmludmFsaWQtY2FAZXhhbXBsZS5j b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMVVEjUaSK3gir7Ste PCFjezFnyvH8ppjzhfKEHBYnggtJn8PHn3P+DBFQOajd2rxzl3dURlYGkfrTN9M0 Yky5ZXOmJz3j1D2TUkJiXJ14DJUYZjngn6NoTYJVhQZz/wldvcWqzwn/eA6lxqy2 fC/LhrZPybDTq3nHnd+FeEWfVrzedx5cojbRCSS4IDNe8MyWXFfq0Oy7bAR2Xwzn U0nAqRA6i2Q5izFSxAVLa8KOfuZmMODNDwxD9g+Kj7sezQB7mhuuhWbe5qug3HHh vwJ3rlDe8TsjEPcfw9zX4koF22XiTPgWxNHE+xGPVnWQbbEuh4yQNMrffBYACA6E s0UHAgMBAAGjdjB0MB0GA1UdDgQWBBQdF29RK88xI8z6yQvD75ACd6p6BjAfBgNV HSMEGDAWgBQdF29RK88xI8z6yQvD75ACd6p6BjAPBgNVHRMBAf8EBTADAQH/MCEG A1UdEQQaMBiBFmludmFsaWQtY2FAZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQAD ggEBAJ8BYfB+5cDFqx0nHjOjFbfuTNMlV/6+iuWFhiPwGhRtkOY5M+siHhEoIl7p M2uKCmNSNXJWcFrrPX568J/gFm7bymxi5JRVglAetH8fNnWcKDteEE5txl+sMAtG OXhWIl8BCeIJ2swVhFrHKeBPeACqq9RGLjiPbEdtpf6zbQDaxIlbEz+PpFICxK/W OYp32IJV0DIw1XzV0UhEwZ8eGuRZY3e6Ug+Hux9fXjIgcne/KvfM3rdINmp5dnCW 3TOnILuYsgIEtwYDKxTJ3fJuypGcLpvrbJTVgNbWwxitAFh+87Y4d6K4n5Math8O rXcqWaFqC68EhAxLzSMvPrEI1Dk= -----END CERTIFICATE----- ================================================ FILE: acme4j-smime/src/test/resources/json/emailReplyChallenge.json ================================================ { "type": "email-reply-00", "url": "https://example.com/acme/chall/ABprV_B7yEyA4f", "status": "pending", "from": "acme-generator@example.org", "token": "DGyRejmCefe7v4NfDGDKfA" } ================================================ FILE: acme4j-smime/src/test/resources/json/emailReplyChallengeMismatch.json ================================================ { "type": "email-reply-00", "url": "https://example.com/acme/chall/CoFefB832SAebe", "status": "pending", "from": "acme-challenge+2i211oi1204310@example.com", "token": "IAi2dsjFIDSJsifdj394wf" } ================================================ FILE: acme4j-smime/src/test/resources/key.pem ================================================ -----BEGIN RSA PRIVATE KEY----- MIIBOgIBAAJBANu2drKTZw3HX3fi0l4yAG5RV/nwl4poPOR+03xHvtQSedLX1CSg DC6ChkDJ4fqcNMX8LGCSgspj1d0b8gKQDu0CAwEAAQJAYlXkAkDe2tfk7q9iIC6Y 6scVbRQ1fwjwWAQ7e2BRFHDsLNdTvFacwGAhHci83DVIwq6kl7MudUNhXGYi2yvt MQIhAOnwrcQvFc/g/RkFmWjcKFfzsZGYO2tP2vW4CqDhoFGzAiEA8G5Vw/Yl25vs QrF8RqouarLghHRG+qN4BpVYQwxZjN8CIQDKRVBpdXC9mcIc1WuMb/bt/QYGZgLS SWx/0s5VxmAQ4wIgIDT3gi+X9KoXZPu3hRPI8fwSPUwCMhLxwhgBYcHmwQsCIDX5 IpHdsed3vjY69bjID8LgkIK7BUDGeIkQTMLxKtGb -----END RSA PRIVATE KEY----- ================================================ FILE: acme4j-smime/src/test/resources/valid-signer-nosan-privkey.pem ================================================ -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDYEMlw6YXHpO5b nyuk7gVdu8XtmhKkg6LhhZ9KYPstIdSr7EbH++h2KMVPVjprvijh35d5hMf9fiMU 71A93NkO4by3fOIUAJy2m1oXLBSOBhglAbI+Z+DeGfULPvari0Cp6A4TAvvw0DZh wR3qzHS50AXzQLVAeL+QoEwOCP0A7I3Ihn+sE3wJlKR+Sk9hYj30WX8M65ievuQw 3VNRZLX3TqY+oGyWHVhXKnp90ZovoN2Uhj5kTlz0GFJP+37t4urt+cHkoH60O8cP Wqcvznwr7keN9z0xRhPJ98OIlob3MeQQqLfN3QQZxp/Wv6WyRGoQg6pE6MtIOKZP lDgK4cJhAgMBAAECggEAEZOKA4KnpJY84pyn5P6M1rNt9jZkolfoAd8IFnmdrS31 mje6CU4reqM1686IqZeaRUeWT6cWyr7+VRdjqGilCqIf4zBIRtbG6M7p7P0jveru f2IsMQnrv72OUsggMlO9YqTzMiY5vvz9E4YtbBqOO0haF4/xvqkj8jyr+y9Nf4vY Yag2EUddUX2Giqln97aE8G2O8+LJzXTIk1K15DfyBcq1kkye8OSkjsnLybP4wo+v uRSDbReF//j+MDepP6IZNPBVyEDyjaXFrNmVb+USyHtzKXwl/GwoYjN7gtOtqc1V 8vVj1H6+RJK1E67ORLctzzMUZfG6vDB2UZ+vv0lqnQKBgQD7sYWfq1rMzUNhVX4D ef0AOoQlBpnOiwoc+7JEXoZoKBw5xrTAxsKRtJFSgIYDYbfi2y3XLu5IO69nkao6 EqArzaGn+Uc5JcCw4GVVoe6q6W4SwTGC690d/D7R2h24CYjqrIXkFwtvvM6f+5gl Vu8da1eXbH73JAEigkKtrvQqVQKBgQDbwzTL6E6hY6DXAxsWzSp1d1n/SK6NdByX 2yfCQRAQVX6KPVo8Gw1ZGH3IJ/KNVL/TXzDV3NfY6cYBbydcu0/EcVBS11+3KhT7 uB+Y6T3RThwzRDRBlaeJtUmN63JWmCOBiMIRPmJU2uxS3JzNMqC5QekkjRb/7S2J 300hAdlb3QKBgGkt3zRBTFmHcZ/sNRPI15RP38cFQiMQ8XH5MJ7njW1bTahLRF/G 76op9gyvDtG89TZE95wTzZm772ntcmCARhToAqUKQ9w6zZJcw5wMZotfrxMBTupy HF4aejoB1yeAPIos/Gq7wpi4IvSyE/uOn7AAmoL54PjwP9Um8Cxaj0hdAoGBALQf p6KJ4gj989LHxOhHeUmWbbmEBS4DwXvmMQxS76uzp2f/KXqiYappHI91zqRwllnV Z92iiXhNA/Ig/Q5QqOzGQ6Piy50BbPl0zNE0O2rWrt6GRJ6M3ylL4eHk3W6EfHWr dgVUMJyEY7b3A75chMfTchh3XCaga/bZhApNza4xAoGAZF1mFIowaUog23TWiann ZuCrZObtd2bk4LdtUYSAs2oUFSEWOR4d/av+eb68yf+n69gk1MrP4BA3hyQOX1M9 Cz/9x/1Tewytywi36noxlgvTfAe3U93LxGjob4z2bsGQ0Xt8q4ngIrEvDeBQa0cq bUOxUekM/49+AAToLiTrZhM= -----END PRIVATE KEY----- ================================================ FILE: acme4j-smime/src/test/resources/valid-signer-nosan.pem ================================================ -----BEGIN CERTIFICATE----- MIID2TCCAsGgAwIBAgIUT0oQs1tpYdA/PUXwyeZqLP4DACYwDQYJKoZIhvcNAQEL BQAwfDELMAkGA1UEBhMCWFgxEjAQBgNVBAcMCUFjbWUgQ2l0eTEeMBwGA1UECgwV QWNtZSBDZXJ0aWZpY2F0ZXMgTHRkMRQwEgYDVQQDDAtleGFtcGxlLmNvbTEjMCEG CSqGSIb3DQEJARYUdmFsaWQtY2FAZXhhbXBsZS5jb20wHhcNMjIxMTA0MTI1NTM5 WhcNMzIxMTAxMTI1NTM5WjB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBD aXR5MR4wHAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4 YW1wbGUuY29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgQyXDphcek7lufK6TuBV27 xe2aEqSDouGFn0pg+y0h1KvsRsf76HYoxU9WOmu+KOHfl3mEx/1+IxTvUD3c2Q7h vLd84hQAnLabWhcsFI4GGCUBsj5n4N4Z9Qs+9quLQKnoDhMC+/DQNmHBHerMdLnQ BfNAtUB4v5CgTA4I/QDsjciGf6wTfAmUpH5KT2FiPfRZfwzrmJ6+5DDdU1FktfdO pj6gbJYdWFcqen3Rmi+g3ZSGPmROXPQYUk/7fu3i6u35weSgfrQ7xw9apy/OfCvu R433PTFGE8n3w4iWhvcx5BCot83dBBnGn9a/pbJEahCDqkToy0g4pk+UOArhwmEC AwEAAaNTMFEwHQYDVR0OBBYEFEaAxnUaGT+hDny105TcVjw00ZqfMB8GA1UdIwQY MBaAFEaAxnUaGT+hDny105TcVjw00ZqfMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI hvcNAQELBQADggEBAL1SPWI/JS9HL3TWN0Q/xkP7UAhgQM6BUzgyVMJ+MxPy34l3 7vEsSYc3KY8ynNo/psbsBodDqq2iDthZKTtt/l9YAnQrfgpRP+pzLPFDKOB9cDGG BoY5KC77B/TXuTfvdT7y0Bvey6C7KMvmPecLNt1sqlCdoOwOyLJN7+zCWVR9nfd4 Y27VkOvt/zz+cycLmxMIgwGL8nDg37wIoPftEASMvrhO18ZxISsRyabzd6fDZi8m u1x97/djezOgoqMgasPBy+yOZbeRwamv1PVElTDJovb/rRS2WMne6+2nMOoQezA3 C5rRLtPAoKPPStt6E5tSQSWa42VBW2HGD/n4ros= -----END CERTIFICATE----- ================================================ FILE: acme4j-smime/src/test/resources/valid-signer-privkey.pem ================================================ -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDNPJbVVGb6ZAdh TmFlaDOCs9GRHMwuUugJqaVGzkOMZ/fMimj1r/XubrRh8hcEmu4iZQFfFrmWnRmp prK3L6dk6lLTAFlKpMu6yVnRa7LLJbYMQE07uMtbnxwyfwx8DAxiMNzG25s1vswA b2JlGPrCfq0oKxe1hSAAik2HI8+0O4Rnl1/V5w6e+Vba874zDK0zwMsu3CiURP+0 /M5c8cOLIqOKPTaPInUOVnGm0q52IpoF5jVZj9b8+lLp8ayRMlBz9tk+ATc4//1j 1jW7NlO6WQ7dHoyUs10tqbfb96Gkm9JbJ9JtOjILZ6O9pehEKE8VwCZOmoDQc+CH yy52JLXhAgMBAAECggEAT/IIjSvV+zYou8o03TQEUKbr/Ls7e9X2pgDrrROes1wy Zf4KWZ3Dzi9YW4jaV4RkO4idyqUHAPjMLM4O8pWA/qnaPm/12EIuS+Gv94gcus5D Ri1sCFX4/QUTDkZ4Hf/xePQwo9Oad4qNW6QHr3rV/xoqKCn1D9O9/gfhoEEeYMVV nPdHlRR1QPcbptsBGkMYrZ8LwjQb8rMvNTK8HRhc4cKrkobEFvwXcWNO9aIlLveP Q58TlQUijeu4eZPM9c3vjl8rM7Oic/ftuU6jmt9IayAVoYblw7yzeEk3lnBlPzME e01hr+QD6ZJiquO1stdm6a7TJv15lAghhTBysy7oawKBgQDcY+PBZByHOZ5GzDBb fwcScm/RM5zMfDJKrYLNehawJ5egyUOeRm+Ym8d7PpCOWrHLURLpxak2Nrsmivf8 g1OYAFnWWQm6j3GmlnEspp65n/UVPHETq7tvqulOHmvcOVROsSgHWu8JMgk8mlK1 kEKlw3y5yzIB7SdyUhCjY5UMGwKBgQDuZeWfg44qvi9o3bb0zbjAHgh0hCQjHy/G NVcaVXx06j0a1tAFyESmJqtCEbScrInZnrmpXmTvX5UQczWHi4RYMI8NNFmf3+i0 XHxWICFrQhdkxppvrEJeXbdfws+UJT8A9K8kokYRO3WyDzrngddfvCbYgHQjMly+ 3Ke8oS2tswKBgQC0sf2ZoSA2ysn3mBCJ5AODX2pIZv3HNojxa4OUPuZ9NWj/fiS/ j1aOFCMg7DIPVVLytR1BqDtNZOBbAJPEaFRQivEdalEssdFn2W8fQdlfrkN+TtkT XLlIHCQ/VXfvzt1Ny7hbF3Zm3qxuEMWBca8DQ91uY6gzpiKye5CCtfINQwKBgQDh EPIoFlsxnzvDFQ6VL2MsfS4eUmKLhfXkepcxFWPaPQpTPFpIGzo0Ym1sgqqw/3Nl MKS3cZZ5JxPj4+C1htH7MFzdan7yoMFhBa+c39itGkhbq+RBaa9+x5tHnPO8OS2y CU8QluLvgeMrp5VE2yAqEcfavernD7TfvBHf04r8YQKBgCHRqnBwHOGHiWyy/Wdu ySxqN1hfJWBdKRbtxTj5uCKp/orNtiRVB4GC1ZqhCJ38rZwMSSbp00o9nyDXlRfP jTo2zHrxtwem5hB31cZalPt4twJ5SofmNLDngz7UxwpTs8jWaAf8yAtRgdxWbYRg bRbZ+LceWQUl8T/RC7UQpy0Y -----END PRIVATE KEY----- ================================================ FILE: acme4j-smime/src/test/resources/valid-signer.pem ================================================ -----BEGIN CERTIFICATE----- MIID+jCCAuKgAwIBAgIUKAv8VHC4XCtd7BkomMblD3++fLQwDQYJKoZIhvcNAQEL BQAwfDELMAkGA1UEBhMCWFgxEjAQBgNVBAcMCUFjbWUgQ2l0eTEeMBwGA1UECgwV QWNtZSBDZXJ0aWZpY2F0ZXMgTHRkMRQwEgYDVQQDDAtleGFtcGxlLmNvbTEjMCEG CSqGSIb3DQEJARYUdmFsaWQtY2FAZXhhbXBsZS5jb20wHhcNMjIxMTA0MTI1NTM5 WhcNMzIxMTAxMTI1NTM5WjB8MQswCQYDVQQGEwJYWDESMBAGA1UEBwwJQWNtZSBD aXR5MR4wHAYDVQQKDBVBY21lIENlcnRpZmljYXRlcyBMdGQxFDASBgNVBAMMC2V4 YW1wbGUuY29tMSMwIQYJKoZIhvcNAQkBFhR2YWxpZC1jYUBleGFtcGxlLmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM08ltVUZvpkB2FOYWVoM4Kz 0ZEczC5S6AmppUbOQ4xn98yKaPWv9e5utGHyFwSa7iJlAV8WuZadGammsrcvp2Tq UtMAWUqky7rJWdFrsssltgxATTu4y1ufHDJ/DHwMDGIw3MbbmzW+zABvYmUY+sJ+ rSgrF7WFIACKTYcjz7Q7hGeXX9XnDp75VtrzvjMMrTPAyy7cKJRE/7T8zlzxw4si o4o9No8idQ5WcabSrnYimgXmNVmP1vz6UunxrJEyUHP22T4BNzj//WPWNbs2U7pZ Dt0ejJSzXS2pt9v3oaSb0lsn0m06Mgtno72l6EQoTxXAJk6agNBz4IfLLnYkteEC AwEAAaN0MHIwHQYDVR0OBBYEFEdIEWKDgjyWKhYjxsAdeNVUwl7iMB8GA1UdIwQY MBaAFEdIEWKDgjyWKhYjxsAdeNVUwl7iMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0R BBgwFoEUdmFsaWQtY2FAZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADggEBACQ0 LDU1sVSzRwa1ZeqeiHrc3gbeuBqFqejj+QvPx2N3Zc53265+mb1ga1bJ3O1WePa/ K/0L0Ska5Y5CELjcGlvy5kcSdQFRhoqK7KZq3c9C39ljl5yx//uJUauXWq+WJhqo vTKNo+QC4P9jIjtT6J7irNXl/bS2Qgnmp1xXsVNKmnhWXpbpyelFJgV6WhjtUHxA nDZ72q7naLG3tb3umBgAZ/DKQGPvM3WJ2BzwfD6I4c75O//DzB6D7p4w295WU/m/ AQ5jc/hiEglEh2JHStq1ofvMKg90+azrc06gD7kjXgzaHFBesM8Xph1qrz+8jN1a F2L5+xQODQmvZhN5PDM= -----END CERTIFICATE----- ================================================ FILE: acme4j-smime/tool/smime-generator.py ================================================ #!/bin/env python3 # # acme4j - Java ACME client # # Copyright (C) 2022 Richard "Shred" Körber # http://acme4j.shredzone.org # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # # # This tool creates ACME test e-mails and signs them. It can be # used to generate S/MIME mails for unit tests. # # Requires: M2Crypto # # WARNING: DO NOT USE THIS CODE TO GENERATE REAL S/MIME MAILS! # This generator is only meant to create test mails for unit test # purposes, and may lack security relevant features that are # needed for real S/MIME mails. # from M2Crypto import BIO, Rand, SMIME def makebuf(text): return BIO.MemoryBuffer(bytes(text, 'UTF-8')) def signmail(text, sender, recipient, subject, privkey, pubkey, envelopeFrom=None, envelopeTo=None, envelopeSubject=None): body = 'Content-Type: message/RFC822; forwarded=no\r\n\r\n' body += 'From: {}\r\n'.format(sender) body += 'To: {}\r\n'.format(recipient) body += 'Subject: {}\r\n'.format(subject) body += 'Message-ID: \r\n' body += 'MIME-Version: 1.0\r\n' body += 'Content-Type: text/plain; charset=utf-8\r\n' body += '\r\n' body += text body += '\r\n' s = SMIME.SMIME() s.load_key(privkey, pubkey) p7 = s.sign(makebuf(body), SMIME.PKCS7_DETACHED) out = BIO.MemoryBuffer() out.write('From: {}\r\n'.format(envelopeFrom if envelopeFrom is not None else sender)) out.write('To: {}\r\n'.format(envelopeTo if envelopeTo is not None else recipient)) out.write('Subject: {}\r\n'.format(envelopeSubject if envelopeSubject is not None else subject)) out.write('Auto-Submitted: auto-generated; type=acme\r\n') out.write('Message-ID: \r\n') s.write(out, p7, makebuf(body)) return out.read() with open('src/test/resources/email/valid-mail.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'valid-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/valid-signer-privkey.pem', 'src/test/resources/valid-signer.pem')) with open('src/test/resources/email/invalid-cert-mismatch.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'different-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/valid-signer-privkey.pem', 'src/test/resources/valid-signer.pem', envelopeFrom="different-ca@example.org")) with open('src/test/resources/email/invalid-nosan.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'valid-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/valid-signer-nosan-privkey.pem', 'src/test/resources/valid-signer-nosan.pem')) with open('src/test/resources/email/invalid-signed-mail.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'valid-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/invalid-signer-privkey.pem', 'src/test/resources/invalid-signer.pem')) with open('src/test/resources/email/invalid-protected-mail-from.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'valid-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/valid-signer-privkey.pem', 'src/test/resources/valid-signer.pem', envelopeFrom="tampered-ca@example.org")) with open('src/test/resources/email/invalid-protected-mail-to.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'valid-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/valid-signer-privkey.pem', 'src/test/resources/valid-signer.pem', envelopeTo="tampered-recipient@example.com")) with open('src/test/resources/email/invalid-protected-mail-subject.eml', 'wb') as w: w.write(signmail('This is an automatically generated ACME challenge.', 'valid-ca@example.com', 'recipient@example.org', 'ACME: LgYemJLy3F1LDkiJrdIGbEzyFJyOyf6vBdyZ1TG3sME=', 'src/test/resources/valid-signer-privkey.pem', 'src/test/resources/valid-signer.pem', envelopeSubject="ACME: aDiFfErEnTtOkEn")) ================================================ FILE: acme4j-smime/tool/test-key-generator.sh ================================================ #!/bin/bash # # acme4j - Java ACME client # # Copyright (C) 2022 Richard "Shred" Körber # http://acme4j.shredzone.org # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # # # Generates test keys for S/MIME unit tests. # # WARNING: DO NOT USE THIS CODE FOR KEY GENERATION IN PRODUCTION # ENVIRONMENTS! # TARGET=src/test/resources/ openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3650 \ -keyout "$TARGET/valid-signer-privkey.pem" -out "$TARGET/valid-signer.pem" \ -subj "/C=XX/L=Acme City/O=Acme Certificates Ltd/CN=example.com/emailAddress=valid-ca@example.com" \ -addext "subjectAltName=email:valid-ca@example.com" openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3650 \ -keyout "$TARGET/valid-signer-nosan-privkey.pem" -out "$TARGET/valid-signer-nosan.pem" \ -subj "/C=XX/L=Acme City/O=Acme Certificates Ltd/CN=example.com/emailAddress=valid-ca@example.com" openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3650 \ -keyout "$TARGET/invalid-signer-privkey.pem" -out "$TARGET/invalid-signer.pem" \ -subj "/C=XX/L=Acme City/O=Emca Certificates Ltd/CN=example.com/emailAddress=invalid-ca@example.com" \ -addext "subjectAltName=email:invalid-ca@example.com" ================================================ FILE: pom.xml ================================================ 4.0.0 org.shredzone.acme4j acme4j 5.1.1-SNAPSHOT pom acme4j ACME client for Java https://acme4j.shredzone.org 2015 Apache License Version 2.0 LICENSE-APL.txt https://codeberg.org/shred/acme4j/ scm:git:git@codeberg.org:shred/acme4j.git scm:git:git@codeberg.org:shred/acme4j.git HEAD Codeberg https://codeberg.org/shred/acme4j/issues shred Richard Körber 1.83 4.5.14 2.0.5 0.9.6 5.14.3 2.0.17 utf-8 utf-8 acme4j-client acme4j-smime acme4j-example acme4j-it org.apache.maven.plugins maven-compiler-plugin 3.14.1 17 com.github.spotbugs spotbugs-maven-plugin 4.9.8.2 check org.apache.maven.plugins maven-surefire-plugin 3.5.4 classes 10 requires-network org.apache.maven.plugins maven-failsafe-plugin 3.5.4 integration-test verify org.apache.maven.plugins maven-jar-plugin 3.5.0 **/.gitignore org.apache.maven.plugins maven-release-plugin 3.3.1 true v@{project.version} false true org.apache.maven.plugins maven-source-plugin 3.4.0 attach-sources jar org.apache.maven.plugins maven-gpg-plugin 3.2.8 sign-artifacts deploy sign org.sonatype.central central-publishing-maven-plugin 0.10.0 true central org.apache.maven.plugins maven-javadoc-plugin 3.12.0 syntax,reference true en draft a Draft: attach-javadocs jar org.shredzone.maven mkdocs-maven-plugin 1.2 ${project.build.directory}/site com.github.spotbugs spotbugs-annotations 4.9.8 true com.google.code.findbugs jsr305 org.junit.jupiter junit-jupiter ${junit.version} test org.assertj assertj-core 3.27.7 test net.javacrumbs.json-unit json-unit-assertj 5.1.1 test org.mockito mockito-core 5.23.0 test org.wiremock wiremock 3.2.0 test ================================================ FILE: src/doc/docs/ca/actalis.md ================================================ # Actalis Website: [Actalis](https://www.actalis.com) Available since acme4j 4.0.0 ## Connection URIs * `acme://actalis.com` - Production server Actalis does not provide a staging server (as of August 2025). ## Note * Actalis requires account creation with [key identifier](../usage/account.md#external-account-binding). ## Disclaimer _acme4j_ is not officially supported or endorsed by Actalis. If you have _acme4j_ related issues, please do not ask them for support, but [open an issue here](https://codeberg.org/shred/acme4j/issues). ================================================ FILE: src/doc/docs/ca/google.md ================================================ # Google Website: [Google Trust Services](https://pki.goog/) Available since acme4j 3.5.0 ## Connection URIs * `acme://pki.goog` - Production server * `acme://pki.goog/staging` - Staging server ## Note _Google Trust Services_ requires account creation with [External Account Binding](../usage/account.md#external-account-binding). See [this tutorial](https://cloud.google.com/certificate-manager/docs/public-ca-tutorial) about how to create the EAB secrets. You will get a `keyId` and a `b64MacKey` that can be directly passed into `AccountBuilder.withKeyIdentifier()`. !!! note You cannot use the production EAB secrets for accessing the staging server, but you need separate secrets! Please read the respective chapter of the tutorial about how to create them. _Google Trust Services_ request `HS256` as MAC algorithm. If you use the connection URIs above, this is set automatically. If you use a `https` connection URI, you will need to set the MAC algorithm manually by adding `withMacAlgorithm("HS256")` to the `AccountBuilder`. ## Disclaimer _acme4j_ is not officially supported or endorsed by Google. If you have _acme4j_ related issues, please do not ask them for support, but [open an issue here](https://codeberg.org/shred/acme4j/issues). ================================================ FILE: src/doc/docs/ca/index.md ================================================ # Certificate Authorities _acme4j_ should support any CA that is providing an ACME server. ## Available Providers !!! note _acme4j_ is not limited to these providers. **You can always connect to any [RFC 8555](https://tools.ietf.org/html/rfc8555) compliant server** by passing the `URL` of its directory endpoint to the `Session`. The _acme4j_ package contains these providers (in alphabetical order): * [Actalis](actalis.md) * [Google](google.md) * [Let's Encrypt](letsencrypt.md) * [Pebble](pebble.md) * [SSL.com](sslcom.md) * [ZeroSSL](zerossl.md) More CAs may be supported in future releases of _acme4j_. Also, CAs can publish provider jar files that plug into _acme4j_ and offer extended support. ## Disclaimer _acme4j_ is an independent software, and not officially supported or endorsed by any of these CAs. If you have _acme4j_ related issues, please do not ask them for support, but [open an issue here](https://codeberg.org/shred/acme4j/issues). ================================================ FILE: src/doc/docs/ca/letsencrypt.md ================================================ # Let's Encrypt Website: [Let's Encrypt](https://letsencrypt.org) ## Connection URIs * `acme://letsencrypt.org` - Production server * `acme://letsencrypt.org/staging` - Testing server ## Note * Let's Encrypt does not support `Account.getOrders()`, although it's required by RFC8555. Invocation will throw an `AcmeNotSupportedException`. See [this issue](https://github.com/letsencrypt/boulder/issues/3335) for more information. ================================================ FILE: src/doc/docs/ca/pebble.md ================================================ # Pebble [Pebble](https://github.com/letsencrypt/pebble) is a small ACME test server. This ACME provider can be used to connect to a local Pebble server instance, mainly for running integration tests. ## Connection URIs * `acme://pebble` - Connect to a Pebble server at `localhost` and standard port 14000. * `acme://pebble:12345` - Connect to a Pebble server at `localhost` and port 12345. * `acme://pebble/pebble.example.com` - Connect to a Pebble server at `pebble.example.com` and standard port 14000. * `acme://pebble/pebble.example.com:12345` - Connect to a Pebble server at `pebble.example.com` and port 12345. Pebble uses a self-signed certificate for HTTPS connections. The Pebble provider accepts this certificate. ## Different Host Name The Pebble server provides an end-entity certificate for the `localhost` and `pebble` domain. If your Pebble server can be reached at a different domain (like `pebble.example.com` above), you need to create a correct end-entity certificate on your Pebble server. [See here](https://github.com/letsencrypt/pebble/tree/main/test/certs) for how to use `minica` to create a matching certificate, and the section below for how to use it in your integration tests. Otherwise, you will get an `AcmeNetworkException: Network error` that is caused by a `java.io.IOException: No subject alternative DNS name matching [...] found` when trying to access the Pebble server. If you cannot create a correct end-entity certificate on your Pebble server, you could also globally disable host name verification on Java side: `-Djdk.internal.httpclient.disableHostnameVerification` !!! warning **Disable hostname verification for testing purposes only, never in a production environment!** Create a correct end-entity certificate whenever possible. ## Custom CA Certificate Pebble provides a default CA certificate, which can be found at `test/certs/pebble.minica.pem` of the Pebble server. This default CA is integrated into _acme4j_'s Pebble provider, and is automatically accepted. If you run a Pebble instance with a custom `pebble.minica.pem`, copy your PEM file as a resource to your project (either in the `src/test/resources` or `src/test/resources/META-INF` folder). ================================================ FILE: src/doc/docs/ca/sslcom.md ================================================ # SSL.com Website: [SSL.com](https://ssl.com) Available since acme4j 3.2.0. **This provider is experimental!** ## Connection URIs * `acme://ssl.com`, `acme://ssl.com/ecc` - Production server, ECDSA certificate mode * `acme://ssl.com/rsa` - Production server, RSA certificate mode * `acme://ssl.com/staging`, `acme://ssl.com/staging/ecc` - Testing server, ECDSA certificate mode * `acme://ssl.com/staging/rsa` - Testing server, RSA certificate mode ## Note * This CA requires [External Account Binding (EAB)](../usage/account.md#external-account-binding) for account creation. However, the CA's directory resource returns `externalAccountRequired` as `false`, which is incorrect. If you use one of the `acme:` URIs above, _acme4j_ will patch the metadata transparently. If you directly connect to SSL.com via `https:` URI though, `Metadata.isExternalAccountRequired()` could return a wrong value. (As of February 2024) * The certificate of the ssl.com staging server seems to be unmonitored. When it expires, an `AcmeNetworkException` is thrown which is caused by a `CertificateExpiredException`. There is nothing you can do to fix this error, except to ask the ssl.com support to renew the expired certificate on their server. **Please do not open an issue at acme4j.** (As of June 2024) ## Disclaimer _acme4j_ is not officially supported or endorsed by SSL.com. If you have _acme4j_ related issues, please do not ask them for support, but [open an issue here](https://codeberg.org/shred/acme4j/issues). ================================================ FILE: src/doc/docs/ca/zerossl.md ================================================ # ZeroSSL Website: [ZeroSSL](https://zerossl.com) Available since acme4j 3.2.0. **This provider is experimental!** ## Connection URIs * `acme://zerossl.com` - Production server ZeroSSL does not provide a staging server (as of February 2024). ## Note * ZeroSSL requires account creation with [key identifier](../usage/account.md#external-account-binding). * ZeroSSL makes use of the retry-after header, so expect that the `fetch()` methods return an `Instant`, and wait until this moment has passed (see [example](../example.md)). * Certificate creation can take a considerable amount of time (up to 24h). The retry-after header still gives a short retry period, resulting in a very high number of status update reattempts. * Server response can be very slow sometimes. If there are frequent timeouts, you can increase the duration in the [network settings](../usage/advanced.md#network-settings). !!! note If you have used the [example code](../example.md) of _acme4j_ before version 3.2.0, please review the updated example for how to use ZeroSSL with _acme4j_. ## Disclaimer _acme4j_ is not officially supported or endorsed by ZeroSSL. If you have _acme4j_ related issues, please do not ask them for support, but [open an issue here](https://codeberg.org/shred/acme4j/issues). ================================================ FILE: src/doc/docs/challenge/dns-01.md ================================================ # dns-01 Challenge With the `dns-01` challenge, you prove to the CA that you are able to control the DNS records of the domain to be authorized, by creating a TXT record with a signed content. `Dns01Challenge` provides a resource record name and a digest string: ```java Dns01Challenge challenge = auth.findChallenge(Dns01Challenge.class); String resourceName = challenge.getRRName(auth.getIdentifier()); String digest = challenge.getDigest(); ``` The CA expects a TXT record at `resourceName` with the `digest` string as value. The `Dns01Challenge.getRRName()` method converts the domain name to a resource record name (including the trailing full stop, e.g. `_acme-challenge.www.example.org.`). The validation was successful if the CA was able to fetch the TXT record and got the correct `digest` returned. ================================================ FILE: src/doc/docs/challenge/dns-account-01.md ================================================ # dns-account-01 Challenge With the `dns-account-01` challenge, you prove to the CA that you are able to control the DNS records of the domain to be authorized, by creating a TXT record with a signed content. This challenge is specified in [draft-ietf-acme-dns-account-label-02](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/). !!! warning The support of this challenge is **experimental**. The implementation is only unit tested for compliance with the specification, but is not integration tested yet. There may be breaking changes in this part of the API in future releases. Semantic versioning does not apply here. `DnsAccount01Challenge` provides a digest string and a resource record name: ```java DnsAccount01Challenge challenge = auth.findChallenge(DnsAccount01Challenge.class); String resourceRecordName = challenge.getRRName(auth.getIdentifier()); String digest = challenge.getDigest(); ``` The CA expects a TXT record at `resourceRecordName` with the `digest` string as value. The `getRRName()` method converts the domain name to a resource record name (including the trailing full stop). The validation was successful if the CA was able to fetch the TXT record and got the correct `digest` returned. ================================================ FILE: src/doc/docs/challenge/dns-persist-01.md ================================================ # dns-persist-01 Challenge With the `dns-persist-01` challenge, you prove to the CA that you are able to control the DNS records of the domain to be authorized, by creating a TXT record that refers to your account. In contrast to the [`dns-01`](dns-01.md) challenge, the DNS TXT records are long-term and can be created manually, so your services do not need the access credentials of your DNS server. This challenge is specified in [draft-ietf-acme-dns-persist-01](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/). !!! warning The support of this challenge is **experimental**. The implementation is only unit tested for compliance with the specification, but is not integration tested yet. There may be breaking changes in this part of the API in future releases. Semantic versioning does not apply here. `DnsPersist01Challenge` provides a resource record name and a digest string: ```java DnsPersist01Challenge challenge = auth.findChallenge(DnsPersist01Challenge.class); String resourceName = challenge.getRRName(auth.getIdentifier()); String rdata = challenge.getRData(); ``` The CA expects a TXT record at `resourceName` with the `rdata` string as value. The `DnsPersist01Challenge.getRRName()` method converts the domain name to a resource record name (including the trailing full stop, e.g. `_validation-persist.www.example.org.`). The `rdata` value is bound to your account at the CA. It stays the same for future challenges. If the TXT record is already set, you can skip ahead and trigger the challenge. However, most CAs will automatically authorize your domain if the TXT record exists, so you may not even need to complete the challenge. The validation was successful if the CA was able to fetch the TXT record. ## Additional parameters To add further parameters to the RDATA, a builder can be used: ```java String rdata = challenge.buildRData() .issuerDomainName("ca.example.com") .wildcard() .persistUntil(Instant.now().plus(3, ChronoUnit.MONTHS)) .noQuotes() .build(); ``` * `issuerDomainName` sets a different issuer domain name. It must be one of `DnsPersist01Challenge.getIssuerDomainNames()`. If not set, the first issuer domain name of that list is taken as default. * `wildcard` marks that you want to authorize wildcard. * `persistUntil` limits the validity of the TXT record. If not set, the TXT record will be valid indefinitely. * `noQuotes` generates RDATA without quote-enclosed strings. You _must_ then take care of long RDATA values yourself! `getRdata()` is just a shortcut for `buildRData().build()`. ================================================ FILE: src/doc/docs/challenge/email-reply-00.md ================================================ # email-reply-00 Challenge The `email-reply-00` challenge permits to get end-user S/MIME certificates, as specified in [RFC 8823](https://tools.ietf.org/html/rfc8823). The CA must support issuance of S/MIME certificates. _Let's Encrypt_ does not currently support it. !!! warning The support of this challenge is **experimental**. The implementation is only unit tested for compliance with the RFC, but is not integration tested yet. ## Setup and Requirements To use the S/MIME support, you need to: * add the `acme4j-smime` module to your list of dependencies * make sure that `BouncyCastleProvider` is added as security provider [RFC 8823](https://tools.ietf.org/html/rfc8823) requires that the DKIM or S/MIME signature of incoming mails _must_ be checked. Outgoing mails _must_ have a valid DKIM signature. Starting with v2.15, _acme4j_ is able to validate and sign S/MIME verification mails. DKIM is usually done by the MTA and thus out of the scope of `acme4j-smime`. ## Ordering The certificate ordering process is similar to a standard domain certificate order. However, if `Identifier` objects are needed, use `EmailIdentifier.email()` to generate an identifier for the email address you want an S/MIME certificate for. To generate a CSR, the module provides a `SMIMECSRBuilder` that works similar to the standard `CSRBuilder`, but accepts `EmailIdentifier` objects. With the `SMIMECSRBuilder.setKeyUsageType()`, the desired usage type of the S/MIME certificate can be selected. By default, the certificate can be used both for encryption and signing. However, this is just a proposal, and the CA is free to ignore it or return an error if the desired usage type is not supported. ## Challenge and Response The CA validates ownership of the email address by two components. Firstly, the CA sends a challenge email to the email address that requested the S/MIME certificate. The subject of this email always starts with an `ACME:` prefix, so it can be filtered by the inbound MTA for automatic processing. After the prefix, the mail subject contains the first part of the challenge token (called "Token 1"). Secondly, the CA provides a new `EmailReply00Challenge` challenge that needs to be verified by the client. The challenge contains the second part of the challenge token (called "Token 2"). Both token parts are concatenated to give the full token that is required for generating the key authorization. The `EmailReply00Challenge` class offers methods like `getToken(String part1)`, `getTokenPart2()`, and `getAuthorization(String part1)` for that. The client now needs to generate a response to the request email. This is a standard mail response to the sender's address. The subject line must be kept, except of an optional `Re:` or a similar prefix. The mail body must contain a `text/plain` part that contains the wrapped key authorization string. For example: ```text -----BEGIN ACME RESPONSE----- LoqXcYV8q5ONbJQxbmR7SCTNo3tiAXDfowy jxAjEuX0= -----END ACME RESPONSE----- ``` This response is sent back to the CA. After that, the `EmailReply00Challenge` is triggered. The CA now has a proof of ownership of the email address, and can issue the S/MIME certificate. ## Response Helper The response process can be executed programmatically, or even manually. To help with the process, `acme4j-smime` provides an `EmailProcessor` that helps you to parse the challenge email, and generate a matching response mail. It is basically invoked like this: ```java Message challengeMessage = // incoming challenge message from the CA EmailReply00Challenge challenge = // challenge that is requested by the CA EmailIdentifier identifier = // email address to get the S/MIME cert for jakarta.mail.Session mailSession = // jakarta.mail session Message response = EmailProcessor.plainMessage(challengeMessage) .expectedIdentifier(identifier) .withChallenge(challenge) .respond() .generateResponse(mailSession); Transport.send(response); // send response to the CA challenge.trigger(); // trigger the challenge ``` The `EmailProcessor` and the related `ResponseGenerator` offer more methods for validating and for customizing the response email, see [the autodocs](../acme4j-smime/apidocs/org.shredzone.acme4j.smime/module-summary.html). ## Validating S/MIME Challenge E-Mails The `EmailProcessor` is able to validate challenge e-mails that were signed by the CA using S/MIME. To do so, invoke the processor like this: ```java Message challengeMessage = // incoming challenge message from the CA EmailReply00Challenge challenge = // challenge that is requested by the CA EmailIdentifier identifier = // email address to get the S/MIME cert for Message response = EmailProcessor.signedMessage(challengeMessage) .expectedIdentifier(identifier) .withChallenge(challenge) .respond() .generateResponse(); Transport.send(response); // send response to the CA challenge.trigger(); // trigger the challenge ``` If you need more control of the signature verification process, you can use `EmailProcessor.builder()`. It is useful e.g. if you need to use a different trust store, or if your MTA has mangled the incoming message, so a relaxed verification is needed. ================================================ FILE: src/doc/docs/challenge/http-01.md ================================================ # http-01 Challenge With the `http-01` challenge, you prove to the CA that you are able to control the website content of the domain to be authorized, by making a file with a signed content available at a given path. `Http01Challenge` provides two strings: ```java Http01Challenge challenge = auth.findChallenge(Http01Challenge.class); String domain = auth.getIdentifier().getDomain(); String token = challenge.getToken(); String content = challenge.getAuthorization(); ``` `token` is the name of the file that will be requested by the CA server. It must contain the `content` string, without any leading or trailing white spaces or line breaks. The `Content-Type` header must be either `text/plain` or absent. The expected path is (assuming that `${domain}` is the domain to be authorized, and `${token}` is the token): ``` http://${domain}/.well-known/acme-challenge/${token} ``` The validation was successful if the CA was able to download that file and found `content` in it. !!! note The request is sent to port 80 only, but redirects are followed. If your domain has multiple IP addresses, the CA randomly selects some of them. There is no way to choose a different port or a fixed IP address. Your server should be able to handle multiple requests to the challenge. The ACME server may check your response multiple times, and from different IPs. Also keep your response available until the `Authorization` status has changed to `VALID` or `INVALID`. ================================================ FILE: src/doc/docs/challenge/index.md ================================================ # Challenges Challenges are used to prove ownership of a domain. There are different kinds of challenges. The most simple is maybe the HTTP challenge, where a file must be made available at the domain that is to be validated. It is assumed that you control the domain if you are able to publish a given file under a given path. The ACME specifications define these standard challenges: * [dns-01](dns-01.md) ([RFC 8555](https://datatracker.ietf.org/doc/html/rfc8555#section-8.4), section 8.4) * [http-01](http-01.md) ([RFC 8555](https://datatracker.ietf.org/doc/html/rfc8555#section-8.3), section 8.3) _acme4j_ also supports these non-standard challenges: * [dns-account-01](dns-account-01.md) ([draft-ietf-acme-dns-account-label-02](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/)) * [dns-persist-01](dns-persist-01.md) ([draft-ietf-acme-dns-persist-01](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/)) * [email-reply-00](email-reply-00.md) ([RFC 8823](https://tools.ietf.org/html/rfc8823)) * [tls-alpn-01](tls-alpn-01.md) ([RFC 8737](https://tools.ietf.org/html/rfc8737)) ================================================ FILE: src/doc/docs/challenge/tls-alpn-01.md ================================================ # tls-alpn-01 Challenge With the `tls-alpn-01` challenge, you prove to the CA that you are able to control the web server of the domain to be authorized, by letting it respond to a request with a specific self-signed cert utilizing the ALPN extension. This challenge is specified in [RFC 8737](https://tools.ietf.org/html/rfc8737). You need to create a self-signed certificate with the domain to be validated set as the only _Subject Alternative Name_. The byte array provided by `challenge.getAcmeValidation()` must be set as DER encoded `OCTET STRING` extension with the object id `1.3.6.1.5.5.7.1.31`. It is required to set this extension as critical. _acme4j_ does the heavy lifting for you though, and provides a certificate that is ready to use. It is valid for 7 days, which is ample of time to perform the validation. ```java TlsAlpn01Challenge challenge = auth.findChallenge(TlsAlpn01Challenge.class); Identifier identifier = auth.getIdentifier(); KeyPair certKeyPair = KeyPairUtils.createKeyPair(2048); X509Certificate cert = challenge.createCertificate(certKeyPair, identifier); ``` Now use `cert` and `certKeyPair` to let your web server respond to TLS requests containing an ALPN extension with the value `acme-tls/1` and a SNI extension containing your subject (`identifier`). When the validation is completed, the `cert` and `certKeyPair` are not used anymore and can be disposed. !!! note The request is sent to port 443 only. If your domain has multiple IP addresses, the CA randomly selects some of them. There is no way to choose a different port or a fixed IP address. Your server should be able to handle multiple requests to the challenge. The ACME server may check your response multiple times, and from different IPs. Also keep your response available until the `Authorization` status has changed to `VALID` or `INVALID`. ================================================ FILE: src/doc/docs/development/challenge.md ================================================ # ACME Challenge RFC 8555 only specifies the [`http-01`](../challenge/http-01.md) and [`dns-01`](../challenge/dns-01.md) challenges. _acme4j_ permits to add further challenge types, which are either generic or provider proprietary. ## Provider Proprietary Challenges If your provider requires a challenge that is too special for generic use, you can add it to your provider package and generate it via `createChallenge(Login, JSON)`. See the [Individual Challenges](provider.md#individual-challenges) section of the [ACME Provider](provider.md) chapter. ## Generic Challenges Starting with _acme4j_ v2.12, generic challenges can be added globally using Java's `ServiceLoader` mechanism. Your implementation must provide a challenge provider that implements the `org.shredzone.acme4j.provider.ChallengeProvider` interface and is annotated with a `org.shredzone.acme4j.provider.ChallengeType` annotation giving the name of your challenge. The only method `Challenge create(Login login, JSON data)` must return a new instance of your `Challenge` class which is initialized with the challenge data given in the `data` JSON structure. A simple example of a `ChallengeProvider` is: ```java @ChallengeType("my-example-01") public class MyExample01ChallengeProvider implements ChallengeProvider { @Override public Challenge create(Login login, JSON data) { return new MyExample01Challenge(login, data); } } ``` Note that you cannot replace predefined challenges, or another challenge implementation of the same type. If your `@ChallengeType` is already known to _acme4j_, an exception will be thrown on initialization time. The `ChallengeProvider` implementation needs to be registered with Java's `ServiceLoader`. In the `META-INF/services` path of your project, create a file `org.shredzone.acme4j.provider.ChallengeProvider` and write the fully qualified class name of your implementation into that file. If you use Java modules, there must also be a `provides` section in your `module-info.java`, e.g.: ```java provides org.shredzone.acme4j.provider.ChallengeProvider with org.example.acme.challenge.MyExample01ChallengeProvider; ``` The `acme4j-smime` module is implemented that way, and also serves as an example of how to add generic challenges. ## Adding your generic Challenge to _acme4j_ After you completed your challenge code, you can send in a pull request and apply for inclusion in the _acme4j_ code base. If it is just a simple challenge implementation, you can apply for inclusion in the `acme4j-client` module. If the challenge is complex, or requires further dependencies, please create a separate module. These preconditions must be met: * The challenge must be of common interest. If the challenge is only useful to your CA, better publish an own Java package instead. * The specification of the challenge must be available to the public. It must be downloadable free of charge and without prior obligation to register. * Your source code must be published under the terms of [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). * You have the permission of all trademark holders involved, to use their trademarks in the source codes, and package names. The _acme4j_ development team reserves the right to reject your pull request, without giving any reason. If you cannot meet these preconditions (or if your pull request was rejected), you can publish a JAR package of your _acme4j_ challenge yourself. Due to the plug-in nature of _acme4j_ challenges, it is sufficient to have that package in the Java classpath at runtime. There is no need to publish the source code. ================================================ FILE: src/doc/docs/development/index.md ================================================ # acme4j Development This part of the documentation is addressed to developers who want to extend _acme4j_, or who want to use _acme4j_ for integration tests. * [Write an own Provider extension](provider.md) * [Integration Tests](testing.md) ================================================ FILE: src/doc/docs/development/provider.md ================================================ # ACME Provider Basically, it is possible to connect to any kind of ACME server just by connecting to the URL of its directory resource: ```java Session session = new Session("https://api.example.org/directory"); ``` ACME providers are "plugins" to _acme4j_ that are specialized on a single CA. The example above would then look like this (if the CA is supported by _acme4j_): ```java Session session = new Session("acme://example.org"); ``` ## Writing your own Provider Every CA that provides an ACME server should also have an own `AcmeProvider`, and if it is just for the sake of a pretty `acme:` URI. However, it is also possible to adapt the behavior of wide parts of _acme4j_ to special characteristics of the CA, just by overriding methods and extending classes. A client provider implements the [`AcmeProvider`](../acme4j-client/apidocs/org.shredzone.acme4j/org/shredzone/acme4j/provider/AcmeProvider.html) interface, but usually it is easier to extend [`AbstractAcmeProvider`](../acme4j-client/apidocs/org.shredzone.acme4j/org/shredzone/acme4j/provider/AbstractAcmeProvider.html) and implement only these two methods: * `accepts(URI)` checks if the client provider is accepting the provided URI. Usually it would be a URI like `acme://example.com`. Note that the `http` and `https` schemes are reserved for the generic provider and cannot be used by other providers. * `resolve(URI)` parses the URI and returns the corresponding URL of the directory service. The `AcmeProvider` implementation needs to be registered with Java's `ServiceLoader`. In the `META-INF/services` path of your project, create a file `org.shredzone.acme4j.provider.AcmeProvider` and write the fully qualified class name of your implementation into that file. If you use Java modules, there must also be a `provides` section in your `module-info.java`, e.g.: ```java provides org.shredzone.acme4j.provider.AcmeProvider with org.example.acme.provider.MyAcmeProvider; ``` When _acme4j_ tries to connect to an acme URI, it first invokes the `accepts(URI)` method of all registered `AcmeProvider`s. Only one of the providers must return `true` for a successful connection. _acme4j_ then invokes the `resolve(URI)` method of that provider, and connects to the directory URL that is returned. The connection fails if no or more than one `AcmeProvider` implementation accepts the acme URI. ## Certificate Pinning The standard Java mechanisms are used to verify the HTTPS certificate provided by the ACME server. To pin the certificate, or use a self-signed certificate, override the `createHttpConnector()` method of `AbstractAcmeProvider` and return a subclassed `HttpConnector` class that modifies the `HttpURLConnection` as necessary. ## Individual Challenges If your ACME server provides challenges that are not specified in the ACME protocol, there should be an own `Challenge` implementation for each of your challenge, by extending the [`Challenge`](../apidocs/org/shredzone/acme4j/challenge/Challenge.html) class. In your `AcmeProvider` implementation, override the `createChallenge(Login, JSON)` method so it returns a new instance of your `Challenge` implementation when your individual challenge type is requested. All other types should be delegated to the super method. ## Amended Directory Service To override single entries of an ACME server's directory, or to use a static directory, override the `directory(Session, URI)` method, and return a `JSON` of all available resources and their respective URL. ## Adding your Provider to _acme4j_ After you completed your provider code, you can send in a pull request and apply for inclusion in the _acme4j_ code base. These preconditions must be met: * Your provider's source code must be published under the terms of [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). * The source code of your ACME server must be publicly available under an [OSI compliant license](https://opensource.org/licenses/alphabetical). * To avoid name conflicts, the `acme:` URI used must have the official domain name of your service as domain part. * You have the permission of all trademark holders involved, to use their trademarks in the source codes, package names, and the acme URI. The _acme4j_ development team reserves the right to reject your pull request, without giving any reason. If you cannot meet these preconditions (or if your pull request was rejected), you can publish a JAR package of your _acme4j_ provider yourself. Due to the plug-in nature of _acme4j_ providers, it is sufficient to have that package in the Java classpath at runtime. There is no need to publish the source code. ================================================ FILE: src/doc/docs/development/testing.md ================================================ # Testing acme4j ## Integration Tests _acme4j_ provides a number of integration tests. These tests are _not_ executed by maven by default, as they require Docker on the build machine. To run them, install Docker and make it available to your user. Then invoke `mvn -Pci verify` to run the integration tests. The integration tests use the [latest docker image](https://hub.docker.com/r/letsencrypt/pebble) of the [Pebble ACME test server](https://github.com/letsencrypt/pebble) in a container named _pebble_. A second docker container named _bammbamm_ uses [pebble-challtestsrv](https://hub.docker.com/r/letsencrypt/pebble-challtestsrv) as a test server. Pebble connects to this test server for resolving domain names and for the verification of challenges. If you change into the `acme-it` module's directory, you can also build, start and stop the test servers with `mvn docker:build`, `mvn docker:start` and `mvn docker:stop`, respectively. While the test servers are running, you can run the integration tests in your IDE. `mvn docker:remove` finally removes the test server images. If you like to change the default configuration of the integration tests (e.g. because you are running _pebble_ and _pebble-challtestsrv_ instances on a dedicated test server), you can do so by changing these system properties: * `pebbleHost`: Host name of the pebble server. Default: `localhost` * `pebblePort`: Port the pebble server is listening on. Default: 14000 * `bammbammUrl`: URI of the _pebble-challtestsrv_ to connect to. Default: `http://localhost:8055` !!! warning _pebble-challtestsrv_ is meant for testing purposes only. Only use it in secured testing environments. The server is neither hardened nor does it offer any kind of authentication. ## Boulder It is also possible to run some tests against the [Boulder](https://github.com/letsencrypt/boulder) ACME server, but the setup is a little tricky. First, build and start the integration test Docker containers as [explained above](#Integration_Tests). When the servers are started, find out the IP address of the _bammbamm_ server: ```bash docker inspect bammbamm -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' ``` Now set up a Docker instance of Boulder. Follow the instructions in the [Boulder README](https://github.com/letsencrypt/boulder#quickstart). When you are ready to start it, set the `FAKE_DNS` env variable to the IP address of _bammbamm_ you have found before. The Boulder integration tests can now be run with `mvn -P boulder verify`. For a local Boulder installation, just make sure that `FAKE_DNS` is set to `127.0.0.1`. You'll also need to expose the ports 5001 and 5002 of _bammbamm_ by changing the `acme4j-it/pom.xml` accordingly. ================================================ FILE: src/doc/docs/example.md ================================================ # Example For a quick start, there is a simple example provided in the `acme4j-example` module. The example class is named `org.shredzone.acme4j.example.ClientTest`. It will demonstrate all the steps that are necessary for generating key pairs, authorizing domains, and ordering a certificate. This chapter contains a copy of the class file, along with explanations about what is happening. ## Caveats - The `ClientTest` is meant to be a simple example and proof of concept. It is not meant for production use as it is. - The exception handling is very simple. If an exception occurs during the process, the example will fail altogether. A real client should handle exceptions like `AcmeUserActionRequiredException` and `AcmeRateLimitedException` properly, by showing the required user action, or delaying the registration process until the rate limitation has been lifted, or the retry time has been reached. - At some places the example synchronously polls the server state. This is sufficient for simple cases, but a more complex client should use timers instead. The client should also make use of the fact that authorizations can be executed in parallel, shortening the certification time for multiple domains. - I recommend reading at least the chapters about [usage](usage/index.md) and [challenges](challenge/index.md), to learn more about how _acme4j_ and the ACME protocol works. - To make the example easier to understand, I will use the specific datatypes instead of the `var` keyword. ## Configuration **The example won't run as-is.** You first need to set some constants according to the CA you intend to connect to. All constants can be found at the top of the class. There is one constant that you **must** change in order to make the example work at all: * `CA_URI`: Set this constant to the connection URI of the CA you intend to use, see the [Connecting](usage/connecting.md) chapter. (The default value is just an example placeholder and won't work.) Depending on the requirements of your CA, you might also need to set these constants: * `ACCOUNT_EMAIL`: This is the email address that is connected to your account. The default is `null`, meaning that no email address is set. Some CAs accept that, but otherwise you can set your email address here. * `EAB_KID`, `EAB_HMAC`: If your CA requires External Account Binding (EAB), it will provide you with a KID and a HMAC pair that is connected to your account. In this case, you must provide both values in the corresponding constants (be careful not to mix them up). Otherwise, both constants must be set to `null`, which is the default and disables EAB. The other constants should work with their default values, but can still be changed if necessary: * `ACCOUNT_KEY_SUPPLIER`: A function for generating a new account key pair. The default generates an EC key pair, but you can also use other `KeyPairUtils` methods (or entirely different means) to generate other kind of key pairs. * `DOMAIN_KEY_SUPPLIER`: A function for generating a new domain key pair. The default generates an RSA key pair, but you can also use other `KeyPairUtils` methods (or entirely different means) to generate other kind of key pairs. * `USER_KEY_FILE`: File name where the generated account key is stored. Default is `user.key`. * `DOMAIN_KEY_FILE`: File name where the generated domain key is stored. Default is `domain.key`. * `DOMAIN_CHAIN_FILE`: File name where the ordered domain certificate chain is stored. Default is `domain-chain.crt`. * `CHALLENGE_TYPE`: The challenge type you want to perform for domain validation. The default is `ChallengeType.HTTP` for [http-01](challenge/http-01.md) validation, but you can also use `ChallengeType.DNS` to perform a [dns-01](challenge/dns-01.md) validation. The example does not support other kind of challenges. * `TIMEOUT`: Maximum time until an expected resource status must be reached. Default is 60 seconds. If you get frequent timeouts with your CA, increase the timeout. ## Running the Example After configuration, you can run the `ClientTest` class in your IDE, giving the domain names to be registered as parameters. When changing into the `acme4j-example` directory, the test client can also be invoked via maven in a command line: ```sh mvn exec:java -Dexec.args="example.com example.org" ``` ## Invocation The `main()` method performs a simple parameter check, and then invokes the `ClientTest.fetchCertificate()` method, giving a collection of domain names to get a certificate for. ```java public static void main(String... args) { if (args.length == 0) { System.err.println("Usage: ClientTest ..."); System.exit(1); } LOG.info("Starting up..."); Security.addProvider(new BouncyCastleProvider()); Collection domains = Arrays.asList(args); try { ClientTest ct = new ClientTest(); ct.fetchCertificate(domains); } catch (Exception ex) { LOG.error("Failed to get a certificate for domains " + domains, ex); } } ``` !!! note The example requires the `BouncyCastleProvider` to be added as security provider. ## The Main Workflow The `fetchCertificate()` method contains the main workflow. It expects a collection of domain names. ```java public void fetchCertificate(Collection domains) throws IOException, AcmeException, InterruptedException { // Load the user key file. If there is no key file, create a new one. KeyPair userKeyPair = loadOrCreateUserKeyPair(); // Create a session. Session session = new Session(CA_URI); // Get the Account. // If there is no account yet, create a new one. Account acct = findOrRegisterAccount(session, userKeyPair); // Load or create a key pair for the domains. // This should not be the userKeyPair! KeyPair domainKeyPair = loadOrCreateDomainKeyPair(); // Order the certificate Order order = acct.newOrder().domains(domains).create(); // Perform all required authorizations for (Authorization auth : order.getAuthorizations()) { authorize(auth); } // Wait for the order to become READY order.waitUntilReady(TIMEOUT); // Order the certificate order.execute(domainKeyPair); // Wait for the order to complete Status status = order.waitForCompletion(TIMEOUT); if (status != Status.VALID) { LOG.error("Order has failed, reason: {}", order.getError() .map(Problem::toString) .orElse("unknown")); throw new AcmeException("Order failed... Giving up."); } // Get the certificate Certificate certificate = order.getCertificate(); LOG.info("Success! The certificate for domains {} has been generated!", domains); LOG.info("Certificate URL: {}", certificate.getLocation()); // Write a combined file containing the certificate and chain. try (FileWriter fw = new FileWriter(DOMAIN_CHAIN_FILE)) { certificate.writeCertificate(fw); } // That's all! Configure your web server to use the // DOMAIN_KEY_FILE and DOMAIN_CHAIN_FILE for the // requested domains. } ``` When this method returned successfully, you will find the domain key pair in a file that is named `domain.key`, and the certificate (including the full certificate path) in a file named `domain-chain.crt`. If no account was registered with the CA yet, there will also be a new file called `user.key`, which is your account key pair. ## Creating Key Pairs There are two sets of key pairs. One is required for creating and accessing your account, the other is required for encrypting the traffic on your domain(s). Even though it is technically possible to use a common key pair for everything, you are strongly encouraged to use separate key pairs for your account and for each of your certificates. A first helper method looks for a file that is called `user.key`. It will contain the key pair that is required for accessing your account. If there is no such key pair, a new one is generated. !!! important Backup this key pair in a safe place, as you will be locked out from your account if you should ever lose it! There may be no way to recover a lost key pair or regain access to your account if the key is lost. ```java private KeyPair loadOrCreateUserKeyPair() throws IOException { if (USER_KEY_FILE.exists()) { // If there is a key file, read it try (FileReader fr = new FileReader(USER_KEY_FILE)) { return KeyPairUtils.readKeyPair(fr); } } else { // If there is none, create a new key pair and save it KeyPair userKeyPair = ACCOUNT_KEY_SUPPLIER.get(); try (FileWriter fw = new FileWriter(USER_KEY_FILE)) { KeyPairUtils.writeKeyPair(userKeyPair, fw); } return userKeyPair; } } ``` A second helper generates a new `domain.key` file unless it is already present. ```java private KeyPair loadOrCreateDomainKeyPair() throws IOException { if (DOMAIN_KEY_FILE.exists()) { try (FileReader fr = new FileReader(DOMAIN_KEY_FILE)) { return KeyPairUtils.readKeyPair(fr); } } else { KeyPair domainKeyPair = DOMAIN_KEY_SUPPLIER.get(); try (FileWriter fw = new FileWriter(DOMAIN_KEY_FILE)) { KeyPairUtils.writeKeyPair(domainKeyPair, fw); } return domainKeyPair; } } ``` ## Registering an Account If you do not have an account set up already, you need to create one first. The following method will show a link to the terms of service and ask you to accept it. After that, the `AccountBuilder` will create an account using the given account `KeyPair`. It will set an email address if provided. If the CA performs External Account Binding and a KID and HMAC is provided, it is forwarded to the CA. If your `KeyPair` has already been registered with the CA, no new account will be created, but your existing account will be used. ```java private Account findOrRegisterAccount(Session session, KeyPair accountKey) throws AcmeException { // Ask the user to accept the TOS, if server provides us with a link. Optional tos = session.getMetadata().getTermsOfService(); if (tos.isPresent()) { acceptAgreement(tos.get()); } AccountBuilder accountBuilder = new AccountBuilder() .agreeToTermsOfService() .useKeyPair(accountKey); // Set your email (if available) if (ACCOUNT_EMAIL != null) { accountBuilder.addEmail(ACCOUNT_EMAIL); } // Use the KID and HMAC if the CA uses External Account Binding if (EAB_KID != null && EAB_HMAC != null) { accountBuilder.withKeyIdentifier(EAB_KID, EAB_HMAC); } Account account = accountBuilder.create(session); LOG.info("Registered a new user, URL: {}", account.getLocation()); return account; } ``` !!! note The invocation of `agreeToTermsOfService()` is mandatory for creating a new account. Do not just invoke this method, but make sure that the user has actually read and accepted the terms of service. ## Authorizing a Domain In order to get a certificate, you need to prove ownership of the domains. In this example client, this can be done either by providing a certain file via HTTP, or by setting a certain `TXT` record in your DNS. You can choose the desired challenge type by setting the `CHALLENGE_TYPE` constant. By default, the HTTP challenge is used. ```java private void authorize(Authorization auth) throws AcmeException, InterruptedException { LOG.info("Authorization for domain {}", auth.getIdentifier().getDomain()); // The authorization is already valid. // No need to process a challenge. if (auth.getStatus() == Status.VALID) { return; } // Find the desired challenge and prepare it. Challenge challenge = null; switch (CHALLENGE_TYPE) { case HTTP: challenge = httpChallenge(auth); break; case DNS: challenge = dnsChallenge(auth); break; } if (challenge == null) { throw new AcmeException("No challenge found"); } // If the challenge is already verified, // there's no need to execute it again. if (challenge.getStatus() == Status.VALID) { return; } // Now trigger the challenge. challenge.trigger(); // Poll for the challenge to complete. Status status = challenge.waitForCompletion(TIMEOUT); if (status != Status.VALID) { LOG.error("Challenge has failed, reason: {}", challenge.getError() .map(Problem::toString) .orElse("unknown")); throw new AcmeException("Challenge failed... Giving up."); } LOG.info("Challenge has been completed. Remember to remove the validation resource."); completeChallenge("Challenge has been completed.\nYou can remove the resource again now."); } ``` ## HTTP Challenge For the HTTP challenge, your server must provide a certain file in the `/.well-known/acme-challenge/` path. This file must be accessible via GET request to your domain. The request is always performed against port 80, but the CA will follow HTTP redirects. If there is a redirection to HTTPS, an invalid (e.g. self-signed, mismatched, or expired) certificate will be accepted by the CA so that the challenge can be completed. In this example, a modal dialog will describe the file name and file content that needs to be used for the challenge. You have to manually set up your web server, so it will provide the file on the specified path. After that, confirm the dialog to trigger the challenge. When the authorization process is completed, the file is not used any more and can be safely deleted. ```java public Challenge httpChallenge(Authorization auth) throws AcmeException { // Find a single http-01 challenge Http01Challenge challenge = auth.findChallenge(Http01Challenge.class) .orElseThrow(() -> new AcmeException("Found no " + Http01Challenge.TYPE + " challenge, don't know what to do...")); // Output the challenge, wait for acknowledge... LOG.info("Please create a file in your web server's base directory."); LOG.info("It must be reachable at: http://{}/.well-known/acme-challenge/{}", auth.getIdentifier().getDomain(), challenge.getToken()); LOG.info("File name: {}", challenge.getToken()); LOG.info("Content: {}", challenge.getAuthorization()); LOG.info("The file must not contain any leading or trailing whitespaces or line breaks!"); LOG.info("If you're ready, dismiss the dialog..."); StringBuilder message = new StringBuilder(); message.append("Please create a file in your web server's base directory.\n\n"); message.append("http://") .append(auth.getIdentifier().getDomain()) .append("/.well-known/acme-challenge/") .append(challenge.getToken()) .append("\n\n"); message.append("Content:\n\n"); message.append(challenge.getAuthorization()); acceptChallenge(message.toString()); return challenge; } ``` This is the default challenge of the example, and probably also the most commonly used challenge. However, the CA may also offer other challenges, like the DNS challenge. ## DNS Challenge For this challenge, a `TXT` record with a given token needs to be created for the domain to be validated. Again, a modal dialog will describe the name and content of the `TXT` record. You have to manually configure your DNS server accordingly. After that, confirm the dialog to trigger the challenge. When the authorization has been completed, the `TXT` record can be safely removed again. ```java public Challenge dnsChallenge(Authorization auth) throws AcmeException { // Find a single dns-01 challenge Dns01Challenge challenge = auth.findChallenge(Dns01Challenge.TYPE) .map(Dns01Challenge.class::cast) .orElseThrow(() -> new AcmeException("Found no " + Dns01Challenge.TYPE + " challenge, don't know what to do...")); // Output the challenge, wait for acknowledge... LOG.info("Please create a TXT record:"); LOG.info("{} IN TXT {}", challenge.getRRName(auth.getIdentifier()), challenge.getDigest()); LOG.info("If you're ready, dismiss the dialog..."); StringBuilder message = new StringBuilder(); message.append("Please create a TXT record:\n\n"); message.append(challenge.getRRName(auth.getIdentifier())) .append(" IN TXT ") .append(challenge.getDigest()); acceptChallenge(message.toString()); return challenge; } ``` !!! note Make sure that the `TXT` record is actually available before confirming the dialog. The CA may verify the challenge immediately after it was triggered. The challenge will then fail if your DNS server was not ready yet. Depending on your hosting provider, a DNS update may take several minutes until completed. !!! note For security reasons, the DNS challenge is mandatory for creating wildcard certificates. This is a restriction of the CA, and not imposed by _acme4j_. ## Checking the Status The ACME protocol does not specify the sending of events. For this reason, resource status changes must be actively polled by the client. _acme4j_ offers very simple polling methods called `waitForStatus()`, `waitUntilReady()`, and `waitForCompletion()`. These methods check the status in a synchronous busy loop. It updates the local copy of the resource using the `fetch()` method, and then checks if the status is either `VALID` or `INVALID` (or `READY` on `waitUntilReady()`). If none of these states have been reached, it just sleeps for a certain amount of time, and then rechecks the resource status. Some CAs respond with a `Retry-After` HTTP header, which provides a recommendation when to check for a status change again. If this header is present, the `fetch()` method will return the given instant. If this header is not present, we will just wait a reasonable amount of time before checking again. An enterprise level implementation would do an asynchronous polling instead, by storing the recheck time in a database or a queue with scheduled delivery. !!! note Some CAs might provide a `Retry-After` even if the resource has reached a terminal state. For this reason, always check the status _before_ waiting for the recommended time, and leave the loop if a terminal status has been reached. ## User Interaction In order to keep the example simple, Swing `JOptionPane` dialogs are used for user communication. If the user rejects a dialog, an exception is thrown and the example client is aborted. ```java public void acceptChallenge(String message) throws AcmeException { int option = JOptionPane.showConfirmDialog(null, message, "Prepare Challenge", JOptionPane.OK_CANCEL_OPTION); if (option == JOptionPane.CANCEL_OPTION) { throw new AcmeException("User cancelled the challenge"); } } public void completeChallenge(String message) { JOptionPane.showMessageDialog(null, message, "Complete Challenge", JOptionPane.INFORMATION_MESSAGE); } public void acceptAgreement(URI agreement) throws AcmeException { int option = JOptionPane.showConfirmDialog(null, "Do you accept the Terms of Service?\n\n" + agreement, "Accept ToS", JOptionPane.YES_NO_OPTION); if (option == JOptionPane.NO_OPTION) { throw new AcmeException("User did not accept Terms of Service"); } } ``` ================================================ FILE: src/doc/docs/faq.md ================================================ # FAQ and Troubleshooting ## I have lost my account key pair. What can I do? There is no automatic way to recover the key pair or restore access to your account. If you just create a new account with a new key pair, subsequent domain authorization attempts are likely to fail because there is already such an authorization associated with your old account. All you can do is to contact the CA support hotline and ask for support. You can still revoke certificates without account key pair though, see [here](usage/revocation.md#without-account-key). ## I suddenly get "Network error" when connecting to Pebble. **Symptom:** When connecting to Pebble, `org.shredzone.acme4j.exception.AcmeNetworkException: Network error` exceptions are thrown, with `PKIX path building failed` mentioned as cause. The code has worked before. **Cause:** Starting with v2.9.0, Pebble uses a new self-signed certificate for its API connection. It doesn't match the certificate stored in _acme4j_ before v4.0.0. **Solution:** Update to _acme4j_ v4.0.0 or higher. If you cannot update _acme4j_, download Pebble's certificate from [here](https://raw.githubusercontent.com/letsencrypt/pebble/refs/heads/main/test/certs/pebble.minica.key.pem). Store the file either as resource (e.g. `src/main/resources` or `src/test/resources`, respectively), or as `META-INF`. It will [override the stored certificate](ca/pebble.md#custom-ca-certificate). (This workaround only affects the Pebble provider, and is safe for production use.) ## My `Challenge` is in status `PENDING`. What does it mean? **Symptom:** After the challenge was triggered, it changes to status `PENDING`. **Cause:** You have triggered the challenge, and are now waiting for the CA to verify it. **Solution:** Wait until the challenge changes to either `VALID` or `INVALID` state. Do not remove challenge related resources (e.g. HTML files or DNS records) before. ## My `Challenge` returns status `INVALID`. What has gone wrong? **Symptom:** After the challenge was triggered, it eventually changes to status `INVALID`. **Cause:** There may be multiple causes for that, but usually it means that the CA could not verify your challenge. **Solution:** If the status is `INVALID`, invoke `Challenge.getError()` to get the cause of the failure. For example, you can log the output of `challenge.getError().toString()`. Make sure that your challenge is ready for verification _before_ you invoke `Challenge.trigger()`. Also make sure not to remove the challenge until the status is either `VALID` or `INVALID`. Read more about errors [here](usage/errors.md). ## My `Order` returns status `INVALID`. What has gone wrong? **Symptom:** Your challenge(s) passed as `VALID`. However, when you execute the order, it changes to status `INVALID`. No certificate was issued. **Cause:** There may be multiple reasons for that. It seems that you are still missing steps that are required by the CA before completion. **Solution:** If the status is `INVALID`, invoke `Order.getError()` to get the cause of the failure. For example, you can log the output of `order.getError().toString()`. Also see [here](usage/errors.md). ## My `Order` seems to be stuck in status `PROCESSING`. What can I do? **Symptom:** Your challenge(s) passed as `VALID`. However, when you execute the order, it seems to be stuck in status `PROCESSING`. **Cause:** The CA may have retained your order to carry out background checks. These checks can take hours or even days. Please read the CA documentation for further details. **Solution:** There is nothing you can do on software side. ## Browsers do not accept my certificate. **Symptom:** A certificate was successfully issued. However, the browser does not accept the certificate, and shows an error that the cert authority is invalid. **Cause:** This problem occurs when the staging server of a CA is used (e.g. `acme://letsencrypt.org/staging`). The certificate is signed correctly, but the staging issuer certificate is not known to the browser. **Solution:** Use the production server of your CA (e.g. `acme://letsencrypt.org`). ## The http-01 challenge fails. **Symptom:** You set up your response token in the `/.well-known/acme-challenge/` path, and you can also successfully fetch it locally, but the challenge is failing with `Invalid response: 404` (or another HTTP error code). **Cause:** The CA could not access your response token, but gets a 404 page (or some other kind of error page) instead. Bear in mind that the response token is not evaluated locally by _acme4j_, but is fetched by the CA server. **Solution:** The CA server could not access your response token from the outside. One reason may be that a firewall or reverse proxy is blocking the access. Another reason may be that your local DNS resolves the domain differently. The CA uses public DNS servers to resolve the domain name. This error often happens when you try to validate a foreign domain (e.g. `example.com` or `example.org`). ## `Account.getOrders()` fails with an exception. **Symptom:** According to RFC 8555, it should be possible to get a list of all orders of an account. But when I invoke `Account.getOrders()`, an `AcmeProtocolException` is thrown. **Cause:** _Let's Encrypt_ does not support getting a list of orders, even though it is mandatory by RFC 8555 (see [this issue](https://github.com/letsencrypt/boulder/issues/3335)). **Solution:** There is no solution. You need to store the location of your orders locally, and use `Login.bindOrder()` to rebind the location to your session and restore the `Order` object. ## The S/MIME certificate challenge fails. **Symptom:** You try to order an S/MIME certificate from a providing CA. However, the CA constantly refuses the response e-mail because the contained ACME response is purportedly invalid. **Cause:** Unfortunately [RFC 8823](https://tools.ietf.org/html/rfc8823) has an ambiguous specification about how to concatenate the two token parts. The text permits two different interpretations that may give different results. _acme4j_ uses an implementation that corresponds to the [intention of the author of RFC 8823](https://mailarchive.ietf.org/arch/msg/acme/KusfZm3qC50IfcAAuTXtmbFK0KM/). If the CA is implemented following the other interpretation, the ACME e-mail response will not match (see [this issue](https://codeberg.org/shred/acme4j/issues/123)). **Solution:** It is a difficult situation that is caused by an ambiguous specification, but it is like it is now. Since _acme4j_ follows the intention of the RFC author, I take the position that the _acme4j_ implementation is correct. Please open a bug report at the CA, and refer to [this issue](https://codeberg.org/shred/acme4j/issues/123). If the two tokens are split at a position, so the first token won't have trailing base64 padding bits, the CA service can be implemented in a way that is compatible to both interpretations. ## Suddenly acme4j starts throwing `AcmeUserActionRequiredException` everywhere! How can I fix that? **Symptom:** Many _acme4j_ methods suddenly throw a `AcmeUserActionRequiredException` after interacting with the server. It is impossible to order certificates. **Cause:** The CA has probably changed its terms of service and wants you to accept them before resuming. **Solution:** Invoke `AcmeUserActionRequiredException.getInstance()` to get a URL of a web page that describes all further steps to be taken. You might also be able to resolve the issue by logging into your CA's account, but that is up to the CA's discretion. Unfortunately, manual action is required in any case, there is no way to automate this process. This is an intentional protocol decision, and _acme4j_ is just the messenger. ## Can you support us in complying with the EU Cyber Resilience Act (CRA)? No. I'm not legally required to do so. _acme4j_ is developed and maintained by one person in their free time, with no company or organization behind it. It is non-commercial, not monetized, and there is no intent to make profit. In other words: This software is a gift. If you use it in a commercial context, _you_ may have obligations under the CRA, but _I_ don't. Please understand that while I welcome open collaboration and feedback, I cannot provide legal compliance support for third-party commercial use. ## Development seems to be very slow. Why is that? There are two main reasons: 1. The code base is mature and stable. First released in December 2015, it has grown into a well-tested and reliable piece of software. With high unit test coverage and regular integration tests against a Pebble server, known issues have been fixed quickly over the years. That's why updates are rare: there's simply not much to do. Which means you get to enjoy a stable, dependable library. 2. It's a volunteer effort. This project is maintained by a single person in their free time, with no company or funding behind it. Development happens when there's time and motivation. But after a decade of work, other priorities sometimes come first. While that means fewer updates, it also means the project isn't driven by deadlines or commercial pressure. ## Where can I find the _acme4j_ Repository? * The main repository is hosted at [Codeberg](https://codeberg.org/shred/acme4j). * There is a fully functional mirror at [GitHub](https://github.com/shred/acme4j). You can use both sites for posting issues and pull requests. However, Codeberg is the preferred repository. ## Where can I find more help? * [Let's Encrypt Documentation](https://letsencrypt.org/docs/) * [Let's Encrypt Community](https://community.letsencrypt.org/) - If the question is _acme4j_ related, please mention it in your post. I don't read the forum every day, but I will answer as soon as I notice it. * [SSL.com Knowledge base](https://www.ssl.com/info/) ================================================ FILE: src/doc/docs/index.md ================================================ # acme4j A Java client for the _Automatic Certificate Management Environment_ (ACME) protocol as specified in [RFC 8555](https://tools.ietf.org/html/rfc8555). ACME is a protocol that a certificate authority (CA) and an applicant can use to automate the process of verification and certificate issuance. This Java client helps to connect to an ACME server, and performing all necessary steps to manage certificates. The source code can be found at [Codeberg](https://codeberg.org/shred/acme4j) and is distributed under the terms of [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). Latest version: ![maven central](https://shredzone.org/maven-central/org.shredzone.acme4j/acme4j/badge.svg) ## Features * Mature and stable code base. First release was in December 2015! * Fully [RFC 8555](https://tools.ietf.org/html/rfc8555) compliant * Supports the `http-01`, `dns-01`, and `tls-alpn-01` ([RFC 8737](https://tools.ietf.org/html/rfc8737)) challenges * Supports [RFC 8738](https://tools.ietf.org/html/rfc8738) IP identifier validation * Supports [RFC 8739](https://tools.ietf.org/html/rfc8739) short-term automatic certificate renewal (experimental) * Supports [RFC 8823](https://tools.ietf.org/html/rfc8823) for S/MIME certificates (experimental) * Supports [RFC 9444](https://tools.ietf.org/html/rfc9444) for subdomain validation * Supports [RFC 9773](https://tools.ietf.org/html/rfc9773) for renewal information * Supports [draft-ietf-acme-profiles-01](https://datatracker.ietf.org/doc/draft-ietf-acme-profiles/) for certificate profiles (experimental) * Supports [draft-ietf-acme-dns-account-label-02](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/) for DNS labeled with ACME account ID challenges (experimental) * Supports [draft-ietf-acme-dns-persist-01](https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/) for dns-persist-01 challenges (experimental) * Easy to use Java API * Requires JRE 17 or higher * Supports [Actalis](https://www.actalis.com/), [Google Trust Services](https://pki.goog/), [Let's Encrypt](https://letsencrypt.org/), [SSL.com](https://www.ssl.com/), [ZeroSSL](https://zerossl.com/), and **all other CAs that comply with the ACME protocol (RFC 8555)**. Note that _acme4j_ is an independent project that is not supported or endorsed by any of the CAs. * Built with maven, packages available at [Maven Central](http://search.maven.org/#search|ga|1|g%3A%22org.shredzone.acme4j%22) * Extensive unit and integration tests * Adheres to [Semantic Versioning](https://semver.org/) ## Dependencies * [Bouncy Castle](https://www.bouncycastle.org/) * [jose4j](https://bitbucket.org/b_c/jose4j/wiki/Home) * [slf4j](http://www.slf4j.org/) * For `acme4j-smime`: [Jakarta Mail](https://eclipse-ee4j.github.io/mail/), [Bouncy Castle](https://www.bouncycastle.org/) ## Quick Start There is an [example source code](example.md) included in this project. It gives an example of how to get a TLS certificate with _acme4j_. ## Modules _acme4j_ consists of four modules. All modules are [available at Maven Central](https://mvnrepository.com/artifact/org.shredzone.acme4j) and can easily be added to the dependency list of your project. You can also download the jar files [at Codeberg](https://codeberg.org/shred/acme4j/releases/latest). acme4j-client : [`acme4j-client`](https://mvnrepository.com/artifact/org.shredzone.acme4j/acme4j-client/latest) is the main module. It contains everything that is required to get certificates for domains. The Java module name is `org.shredzone.acme4j`. acme4j-smime : [`acme4j-smime`](https://mvnrepository.com/artifact/org.shredzone.acme4j/acme4j-smime/latest) contains the [RFC 8823](https://tools.ietf.org/html/rfc8823) implementation for ordering S/MIME certificates. It requires [Bouncy Castle](https://www.bouncycastle.org/java.html) and a `jakarta.mail` implementation. The Java module name is `org.shredzone.acme4j.smime`. acme4j-example : This module only contains [an example code](example.md) that demonstrates how to get a certificate with _acme4j_. It is not useful as a dependency in other projects. acme4j-it : [`acme4j-it`](https://mvnrepository.com/artifact/org.shredzone.acme4j/acme4j-it/latest) mainly serves as integration test suite for _acme4j_ itself. It is not really useful as a dependency in other projects. However, if you write own integration tests using [pebble](https://github.com/letsencrypt/pebble) and [pebble-challtestsrv](https://hub.docker.com/r/letsencrypt/pebble-challtestsrv), you may find the [`challtestsrv` configuration client](acme4j-it/apidocs/org.shredzone.acme4j.it/org/shredzone/acme4j/it/BammBammClient.html) useful in your project. The Java module name is `org.shredzone.acme4j.it`. ## Announcements Follow our Mastodon feed for release notes and other acme4j related news. * Mastodon: @acme4j@foojay.social * RSS: https://foojay.social/@acme4j.rss ## Contribute * Fork the [Source code at Codeberg](https://codeberg.org/shred/acme4j) or [GitHub](https://github.com/shred/acme4j). Feel free to send pull requests. * Found a bug? [File a bug report!](https://codeberg.org/shred/acme4j/issues) ([GitHub](https://github.com/shred/acme4j/issues)) ## License _acme4j_ is open source software. The source code is distributed under the terms of [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). ================================================ FILE: src/doc/docs/migration.md ================================================ # Migration Guide This document will help you migrate your code to the latest _acme4j_ version. ## Migration to Version 5.0.0 - `Login.getKeyPair()` has been removed. This is a security precaution. You can access the login's public key with the new method `Login.getPublicKey()`. Private keys that were passed in as parameters cannot be accessed with the _acme4j_ API anymore. - `Login.getAccountLocation()` has been removed. Use `Login.getAccount().getLocation()` instead. ## Migration to Version 4.0.0 - Removed all methods that were marked as deprecated. - _acme4j_ requires JRE 17 or higher now. - In order to keep the API consistent, the static method `Dns01Challenge.toRRName()` is replaced with a class method `Dns01Challenge.getRRName()`. So all you have to do is to invoke `challenge.getRRName()` instead of `Dns01Challenge.toRRName()`. - Default network timeout has been increased from 10 seconds to 30 seconds. If you require short timeouts, you can change the duration in the [network settings](usage/advanced.md#network-settings). - `Session` can now be shared between multiple threads. - [**Buypass terminates the issuance of GoSSL certificates.**](https://community.buypass.com/t/y4y130p) Starting October 15, 2025, no new certificates will be issued. On April 15, 2026, their ACME services will be terminated. For this reason, Buypass support has been completely removed from _acme4j_. If you use _acme4j_ for Buypass services (e.g. for revocation), use their directory URL instead of the `acme://buypass.com` URI when opening a session. ## Migration to Version 3.5.0 - If you use STAR auto-renewal certificates, you can now use `Order.getCertificate()` instead of `Order.getAutoRenewalCertificate()` to retrieve the STAR certificate. `Order.getAutoRenewalCertificate()` is marked as deprecated, but still functional. The new method `Order.isAutoRenewalCertificate()` can be used to check if the order resulted in a standard or auto-renewing certificate. ## Migration to Version 3.4.0 - To be future-proof, you should wait for your `Order` resource's state to become `READY` before invoking `Order.execute()`. Most CAs change to the `READY` state immediately, but this behavior is not specified in RFC8555. Future CA implementations may stay in `PENDING` state for a short while, and would return an error if `execute()` is invoked too early. Also see the [example](example.md#the-main-workflow) for how wait for the `READY` state. - There are new methods `waitForCompletion()` and `waitUntilReady()` that will do the synchronous busy wait for the resource state for you. It will remove a lot of boilerplate code that is also bug prone if implemented individually. If you use synchronous polling and waiting (like shown in the example code), I recommend to change to these methods instead of waiting for the correct state yourself. See the [example](example.md) for how to use the new methods. - Marked `update()` (and `AcmeRetryAfterException`) as deprecated now. Please use `fetch()` instead, it returns the retry-after time as `Optional` instead of throwing an `AcmeRetryAfterException`. ## Migration to Version 3.3.0 - This version is unable to deserialize resource objects that were serialized by a previous version using Java's serialization mechanism. This shouldn't be a problem, as [it was not allowed](usage/persistence.md#serialization) to share serialized data between different versions anyway. - _acme4j_ version 2 is now discontinued. Please migrate your code to version 3. For most clients, it is less work than it seems. 😉 ## Migration to Version 3.2.0 - Starting with this version, the `CSRBuilder` won't add the first domain as common name automatically. This permits the issuance of very long domain names, and should have no negative impact otherwise, as this field is usually ignored by CAs anyway. If you should encounter a problem here, you can use `CSRBuilder.setCommonName()` to set the first domain as common name manually. Discussion see [here](https://community.letsencrypt.org/t/questions-re-simplifying-issuance-for-very-long-domain-names/207925/11). - Instead of invoking `update()` and then handling an `AcmeRetryAfterException`, you should now prefer to invoke `fetch()`. It gives an optional retry-after `Instant` as return value, which makes the retry-after handling less complex. In a future version, `update()` will be fully replaced by `fetch()`, and `AcmeRetryAfterException` will be removed. - acme4j was updated to support the latest [draft-ietf-acme-ari-03](https://www.ietf.org/archive/id/draft-ietf-acme-ari-03.html) now. It is a breaking change! If you use ARI, make sure your server supports the latest draft before updating to this version of acme4j. - `Certificate.markAsReplace()` has been removed, because this method is not supported by [draft-ietf-acme-ari-03](https://www.ietf.org/archive/id/draft-ietf-acme-ari-03.html) anymore. To mark an existing certificate as replaced, use the new method `OrderBuilder.replaces()` now. - `Certificate.getCertID()` is not needed in the ACME context anymore. This method has been marked as deprecated. In a future version of acme4j, it will be removed without replacement. If you need the certificate ID, refer to the source code to see how it is computed, and add a similar method to your own project. ## Migration to Version 3.0.0 Although acme4j has made a major version bump, the migration of your code should be done in a few minutes for most of you. - The `acme4j-utils` module has been removed, and its classes moved into `acme4j-client` module. If you have used it before, just remove the dependency. If your project has a `module-info.java` file, remember to remove the `requires org.shredzone.acme4j.utils` line there as well. - All `@Nullable` return values have been removed where possible. Returned collections may now be empty, but are never `null`. Most of the other return values are now either `Optional`, or are throwing an exception if more reasonable. If your code fails to compile because the return type has changed to `Optional`, you could simply add `.orElse(null)` to emulate the old behavior. But often your code will reveal a better way to handle the former `null` pointer instead. - `acme4j-client` now depends on Bouncy Castle, so you might need to register it as security provider at the start of your code: `Security.addProvider(new BouncyCastleProvider())`. What you might also need to know: - A new `AcmeNotSupportedException` is thrown if a feature is not supported by the server. It is a subclass of the `AcmeProtocolException` runtime exception. - Starting with _acme4j_ v3, we will require the smallest Java SE LTS version that is still receiving premier support according to the [Oracle Java SE Support Roadmap](https://www.oracle.com/java/technologies/java-se-support-roadmap.html). At the time of writing, these are Java 11 and Java 17, so _acme4j_ requires Java 11 starting from now. With the prospected release of Java 21 (LTS) in September 2023, we will move to Java 17, and so on. If you still need Java 8, you can use _acme4j_ v2. However, it won't receive updates anymore, except of security related fixes. - _acme4j_ now uses the new `java.net.http` client. Due to limitations of the API, HTTP errors are only thrown with the error code, but the respective error message is missing. If you checked the error message in your unit tests, be prepared that they might fail now. - acme4j now accepts HTTP gzip compression. It is enabled by default, but if it causes problems or impedes debugging, it can be disabled in the `NetworkSettings` or by setting the `org.shredzone.acme4j.gzip_compression` system property to `false`. - All deprecated methods have been removed. ## Migration to Version 2.16 - In `acme4j-smime`, the `EmailProcessor.smimeMessage()` method is now deprecated. Use either `EmailProcessor.signedMessage()`, or `EmailProcessor.builder()` if you need custom verification configuration (e.g. an own trust store). - In `acme4j-smime`, major parts of the S/MIME message verification have been rewritten. The verification is much stricter now, and also supports secured headers in the certificate. Verification might now fail while it was successful in v2.15. Also, exception messages might have changed. ## Migration to Version 2.15 - `acme4j-smime` requires BouncyCastle now. The `BouncyCastleProvider` must also be added as security provider. - In `acme4j-smime`, the `EmailProcessor` constructor is private now. Use `EmailProcessor.plainMessage()` as drop-in replacement. ## Migration to Version 2.13 - The `acme4j-smime` module has switched from _JavaMail_ to _Jakarta Mail_. Unfortunately, this is a breaking API change because classes like `javax.mail.internet.InternetAddress` have moved to respective `jakarta.mail` packages. I am aware that this change is going to cause a lot of headache, especially if your project still uses JavaEE instead of JakartaEE. However, JavaEE has been discontinued by Oracle, so all projects are going to have to do this migration sooner or later. Let's just get it over with. ## Migration to Version 2.10 - acme4j now provides real `module-info.java` definitions. It also means that for _building_ this project, Java 9 is the minimum requirement now. - In a preparation for Java 9 modules, the JSR305 null-safe annotations have been replaced by SpotBugs annotations. This _should_ have no impact on your code, as the method signatures themselves are unchanged. However, the compiler could now complain about some `null` dereferences that have been undetected before. Reason is that JSR305 uses the `javax.annotations` package, which leads to split packages in a Java 9 modular environment. - When fetching the directory, acme4j now evaluates HTTP caching headers instead of just caching the directory for 1 hour. However, Let's Encrypt explicitly forbids caching, which means that a fresh copy of the directory is now fetched from the server every time it is needed. I don't like it, but it is the RFC compliant behavior. It needs to be [fixed on Let's Encrypt side](https://github.com/letsencrypt/boulder/issues/4814). - `AcmeProvider.directory(Session, URI)` is now responsible for maintaining the cache. Implementations can use `Session.setDirectoryExpires()`, `Session.setDirectoryLastModified()`, and the respective getters, for keeping track of the local directory state. `AcmeProvider.directory(Session, URI)` may now return `null`, to indicate that the remote directory was unchanged, and the local copy is still valid. It's not permitted to return `null` if `Session.hasDirectory()` returns `false`, though! If your `AcmeProvider` is derived from `AbstractAcmeProvider`, and you haven't overridden the `directory()` method, no migration is necessary. ## Migration to Version 2.9 - In the ACME STAR draft 09, the term "recurring" has been changed to "auto-renewal". To reflect this change, all STAR related methods in the acme4j API have been renamed as well. If you are using the STAR extension, you are going to get a number of compile errors, but you will always find a corresponding new method. No functionality has been removed. I decided to do a hard API change because acme4j's STAR support is still experimental. ## Migration to Version 2.8 - Challenges can now be found by their class type instead of a type string, which makes finding a challenge type safe. I recommend migrating your code to this new way. The classic way is not deprecated and will not be removed though. Example: ```java Http01Challenge challenge = auth.findChallenge(Http01Challenge.TYPE); // old style: by name Http01Challenge challenge = auth.findChallenge(Http01Challenge.class); // new style: by type ``` - `Login.bindChallenge()` was documented, but missing. It is available now. If you used a custom solution to bind challenges, you can now use the official way. ## Migration to Version 2.7 - Note that _acme4j_ has an `Automatic-Module-Name` set in the acme-client and acme-utils modules now. If you have added _acme4j_ to your Java 9+ module dependencies, you'll need to fix your dependency declaration to `org.shredzone.acme4j` (acme-client) and `org.shredzone.acme4j.utils` (acme-utils). - There are no breaking API changes in this version, except of the removal of `CertificateUtils.createTlsAlpn01Certificate(KeyPair, String, byte[])` which has been marked as deprecated in v2.6. - The ACME draft has been finalized and is now called [RFC 8555](https://tools.ietf.org/html/rfc8555). For this reason, the _acme4j_ API is now stable. There won't be breaking changes to the public API in the future, unless absolutely necessary. ## Migration to Version 2.6 - If you use the `tls-alpn-01` challenge and `CertificateUtils.createTlsAlpn01Certificate()` for generating its test certificate, you need to pass the domain name as an `Identifier` object instead of a `String` now. You can use `Identifier.dns(subject)` for conversion. You can also use `Authorization.getIdentifier()` to get the `Identifier` object immediately. ## Migration to Version 2.5 - The GET compatibility mode has been removed. It also means that the `postasget=false` parameter is ignored from now on. If you need it to connect to your ACME server, do not update to this version until your ACME server has been fixed to support ACME draft 15. !!! warning _acme4j_ before version 2.5 will not work with providers like Let's Encrypt anymore! ## Migration to Version 2.4 - There was a major change in ACME draft 15. If you use _acme4j_ in a common way, it will transparently take care of everything in the background, so you won't even notice the change. However, if you connect to a different ACME server than Boulder (Let's Encrypt) or Pebble, you may now get strange errors from the server if it does not support the `POST-as-GET` requests of draft 15 yet. In that case, you can add a `postasget=false` parameter to the ACME server URI (e.g. `"https://localhost:15000/dir?postasget=false"`). Note that this is only a temporary workaround. It will be removed in a future version. Ask the server's CA to add support for ACME draft 15. - The `AcmeProvider.connect()` method now gets the ACME server URI as parameter. It allows adding query parameters to the server URI that change the behavior of the resulting connection. If you have implemented your own AcmeProvider, just change the method's signature to `Connection connect(URI serverUri)`, and ignore the parameter value. ## Migration to Version 2.3 - `Authorization.getDomain()`, `Order.getDomains()` and `Problem.getDomain()` are deprecated now, and will be removed in version 2.4. If you use these methods, use `getIdentifier()` (or `getIdentifiers()`) to get an `Identifier` object, then invoke `Identifier.getDomain()` to get the domain name. ## Migration to Version 2.2 - No migration steps are necessary. ## Migration to Version 2.1 - This version adds [JSR 305](https://jcp.org/en/jsr/detail?id=305) annotations. If you use a null-safe language like Kotlin, or tools like SpotBugs, your code may fail to compile because of detected possible null pointer dereferences and unclosed streams. These are potential bugs that need to be resolved. - In _acme4j_'s `JSON` class, all `as...()` getters now expect a value to be present. For optional values, use `JSON.Value.optional()` or `JSON.Value.map()`. This class is rarely used outside _acme4j_ itself, so you usually won't need to change anything. ## Migration to Version 2.0 _acme4j_ 2.0 fully supports the ACMEv2 protocol. Sadly, the ACMEv2 protocol is a major change. There is no easy recipe to migrate your code to _acme4j_ 2.0. I recommend taking a look at the example, and read this documentation. Altogether, it shouldn't be too much work to update your code, though. ================================================ FILE: src/doc/docs/usage/account.md ================================================ # Account and Login If it is the first time you interact with the CA, you will need to register an account first. Your account requires a key pair. The public key is used to identify your account, while the private key is used to sign the requests to the ACME server. !!! note The private key is never transmitted to the ACME server. You can use external tools like `openssl` or standard Java methods to create the key pair. A more convenient way is to use the `KeyPairUtils` class. This call generates an RSA key pair with a 2048-bit key: ```java KeyPair accountKeyPair = KeyPairUtils.createKeyPair(2048); ``` You can also create an elliptic curve key pair: ```java KeyPair accountKeyPair = KeyPairUtils.createECKeyPair("secp256r1"); ``` The key pair can be saved to a PEM file using `KeyPairUtils.writeKeyPair()`, and read back later using `KeyPairUtils.readKeyPair()`. !!! danger Your key pair is the only way to access your account. **If you should lose it, you will be locked out from your account and certificates.** The API does not offer a way to recover access after a key loss. The only way is to contact the CA's support and hope for assistance. For this reason, it is strongly recommended to keep a copy of the key pair in a safe place! ## Creating an Account The `AccountBuilder` will take care for creating a new account. Instantiate a builder, optionally add some contact information, agree to the terms of service, set the key pair, then invoke `create()`: ```java Account account = new AccountBuilder() .addContact("mailto:acme@example.com") .agreeToTermsOfService() .useKeyPair(keyPair) .create(session); URL accountLocationUrl = account.getLocation(); ``` !!! note Even if it is tempting to do so, you should not invoke `agreeToTermsOfService()` automatically, but let the user confirm the terms of service first. To get a link to the current terms of service, you can invoke `session.getMetadata().getTermsOfService()`. If the account was successfully created, you will get an `Account` object in return. Invoking its `getLocation()` method will return the location URL of your account. It is recommended to store the location URL along with your key pair. While this is not strictly necessary, it will make it much easier to log into the account later. Unlike your key pair, the location does not need security precautions. The location can [easily be recovered if lost](#login-without-account-url). ## External Account Binding At some CAs, you need to create a customer account on their website first, and associate it with your ACME account and key pair later. The CA indicates that this process is required if `session.getMetadata().isExternalAccountRequired()` returns `true`. In this case, your CA provides you a _Key Identifier_ (or _KID_) and a _MAC Key_ (or _HMAC Key_). You can pass these credentials to the builder using the `withKeyIdentifier()` method: ```java String kid = ... // Key Identifier SecretKey macKey = ... // MAC Key Account account = new AccountBuilder() .agreeToTermsOfService() .withKeyIdentifier(kid, macKey) .useKeyPair(keyPair) .create(session); URL accountLocationUrl = account.getLocation(); ``` For your convenience, you can also pass a base64 encoded MAC Key as `String`. !!! note The MAC algorithm is automatically derived from the size of the MAC key. If a different algorithm is required, it can be set using `withMacAlgorithm()`. ## Login After creating an account, you need to log in into it. You get a `Login` object by providing your account information to the session: ```java KeyPair accountKeyPair = ... // account's key pair URL accountLocationUrl = ... // account's URL Login login = session.login(accountLocationUrl, accountKeyPair); ``` Creating a `Login` object is very cheap. You can always create and dispose them as needed. There is no need to cache or pool them. !!! tip It is possible to have multiple parallel `Login`s into different accounts in a single session. This is useful if your software handles the certificates of more than one account. ## Login on Creation If it is more convenient, you can also get a ready to use `Login` object from the `AccountBuilder` when creating a new account: ```java Login login = new AccountBuilder() .addContact("mailto:acme@example.com") .agreeToTermsOfService() .useKeyPair(keyPair) .createLogin(session); URL accountLocationUrl = login.getAccountLocation(); ``` ## Login without Account URL As mentioned above, you will need your account key pair and the account URL for logging in. If you do not know the URL, you can log into your account by creating a new account with the same key pair. The CA will detect that an account with that key is already present, and return the existing one instead. To avoid that an actual new account is created by accident, you can use the `AccountBuilder.onlyExisting()` method: ```java Login login = new AccountBuilder() .onlyExisting() // Do not create a new account .agreeToTermsOfService() .useKeyPair(keyPair) .createLogin(session); URL accountLocationUrl = login.getAccountLocation(); ``` It will return a `Login` object just from your key pair, or throw an error if the key was not known to the server. Remember that there is no way to log into your account without the key pair! ## Updating the Contacts At some point, you may want to update your account. For example your contact address might have changed. To do so, invoke `Account.modify()`, perform the changes, and invoke `commit()` to make them permanent. The following example adds another email address. ```java Account account = login.getAccount(); account.modify() .addContact("mailto:acme2@example.com") .commit(); ``` You can also get the list of contacts via `getContacts()`, and modify or remove contact `URI`s there. However, some CAs do not allow removing all contacts. !!! note `AccountBuilder` only accepts contact addresses when a _new account_ is created. To modify an existing account, use `Account.modify()` as described in this section. It is not possible to modify the account using the `AccountBuilder` on an existing account. ## Changing the Account Key It is recommended to change the account key from time to time, e.g. if you suspect that your key has been compromised, or if a staff member with knowledge of the key has left the company. To change the key pair that is associated with your account, you can use the `Account.changeKey()` method: ```java KeyPair newKeyPair = ... // new KeyPair to be used Account account = login.getAccount(); account.changeKey(newKeyPair); ``` After a successful change, all subsequent calls related to this account must use the new key pair. The key is automatically updated on the `Login` that was bound to this `Account` instance, so it can be used further. Other existing `Login` instances to the account need to be recreated. The old key pair can be disposed of after that. However, better keep a backup of the old key pair until the key change was proven to be successful, by making a subsequent call with the new key pair. Otherwise, you might lock yourself out from your account if the key change should have failed silently, for whatever reason. ## Account Deactivation You can deactivate your account if you don't need it anymore: ```java account.deactivate(); ``` Depending on the CA, the related authorizations may be automatically deactivated as well. If you want to be on the safe side, you can deactivate all authorizations manually, using `Authorization.deactivate()`. The issued certificates may still be valid until expiration or explicit revocation. If you want to make sure the certificates are invalidated as well, [revoke](revocation.md) them prior to deactivation of your account. !!! danger There is no way to reactivate the account once it has been deactivated! ================================================ FILE: src/doc/docs/usage/advanced.md ================================================ # Advanced Topics ## Change of TOS If the CA changes the terms of service and requires an explicit agreement to the new terms, an `AcmeUserActionRequiredException` will be thrown. Its `getInstance()` method returns the URL of a human-readable web document that gives instructions about how to agree to the new terms of service (e.g. by clicking on a confirmation button). Unfortunately, the `AcmeUserActionRequiredException` can be thrown at any time _acme4j_ is contacting the CA, and won't go away by itself. There is no way to automatize this process. It requires human interaction, even on a Saturday night. Note that this is a limitation of the ACME protocol, not _acme4j_. ## Custom CSR Usually _acme4j_ takes the hassle of creating a simple CSR for you. If you need more control over the CSR file, you can provide a PKCS#10 CSR file, either as `PKCS10CertificationRequest` instance or as DER formatted binary. The CSR must provide exactly the domains that you had passed to the `order()`, otherwise the finalization will fail on server side. To create a CSR, you can use command like tools like `openssl` or Java frameworks like [Bouncy Castle](http://www.bouncycastle.org/java.html). For your convenience, there is a [`CSRBuilder`](../acme4j-client/apidocs/org.shredzone.acme4j/org/shredzone/acme4j/util/CSRBuilder.html) that simplifies the CSR generation and should be sufficient for most use cases. ```java KeyPair domainKeyPair = ... // KeyPair to be used for HTTPS encryption CSRBuilder csrb = new CSRBuilder(); csrb.addDomain("example.org"); csrb.addDomain("www.example.org"); csrb.addDomain("m.example.org"); csrb.setOrganization("The Example Organization") csrb.sign(domainKeyPair); csrb.write(new FileWriter("example.csr")); // Write to file byte[] csr = csrb.getEncoded(); // Get a binary representation ``` The `CSRBuilder` also accepts IP addresses and `Identifier` for generating the CSR: ```java CSRBuilder csrb = new CSRBuilder(); csrb.addIP(InetAddress.getByName("192.0.2.2")); csrb.addIdentifier(Identifier.ip("192.0.2.3")); csrb.sign(domainKeyPair); ``` The `CSRBuilder` is used internally for creating the CSR, and you can take influence on the generated CSR by using the `Order.execute(KeyPair domainKeyPair, Consumer builderConsumer)` method. ## Domain Pre-Authorization It is possible to proactively authorize a domain, without ordering a certificate yet. This can be useful to find out what challenges are requested by the CA to authorize a domain. It may also help to speed up the ordering process, as already completed authorizations do not need to be completed again when ordering the certificate in the near future. ```java Account account = ... // your Account object String domain = ... // Domain name to authorize Authorization auth = account.preAuthorize(Identifier.dns(domain)); ``` !!! note Some CAs may not offer domain pre-authorization, `preAuthorizeDomain()` will then fail and throw an `AcmeNotSupportedException`. Some CAs may limit pre-authorization to certain domain types (e.g. non-wildcard) and throw an `AcmeServerException` otherwise. To pre-authorize a domain for subdomain certificates as specified in [RFC 9444](https://tools.ietf.org/html/rfc9444), flag the `Identifier` accordingly using `allowSubdomainAuth()`: ```java Account account = ... // your Account object String domain = ... // Domain name to authorize Authorization auth = account.preAuthorize(Identifier.dns(domain).allowSubdomainAuth()); ``` ## Localized Error Messages By default, _acme4j_ will send your system's default locale as `Accept-Language` header to the CA (with a fallback to any other language). If the language is supported by the CA, it will return localized error messages. To select another language, use `Session.setLocale()`. The change will only affect that session, so you can have multiple sessions with different locale settings. ## Network Settings You can use `Session.networkSettings()` to change some network parameters for the session. * If a proxy must be used for internet connections, you can set a `ProxySelector` instance via `setProxySelector()`. * To change network timeouts, use `setTimeout()`. The default timeout is 30 seconds. You can either increase the timeout for poor network connections, or reduce it to fail early on network errors. The change affects connection and read timeouts. * If you need authentication (e.g. for the proxy), you can set an `Authenticator` via `setAuthenticator()`. Be careful here! Most code snippets I have found on the internet will send out the full proxy credentials to anyone who is asking. You should check `Authenticator.getRequestorType()` and make sure it is `RequestorType.PROXY` before sending the proxy credentials. * _acme4j_ accepts HTTP `gzip` compression by default. If it should impede debugging, it can be disabled via `setCompressionEnabled(false)`. ================================================ FILE: src/doc/docs/usage/connecting.md ================================================ # Session and Connection Central part of the communication with the CA is a [`Session`](../acme4j-client/apidocs/org.shredzone.acme4j/org/shredzone/acme4j/Session.html) object. It is used to track the communication with the ACME server. The first step is to create such a `Session` instance. ## Standard URIs The `Session` constructor expects the URI of the ACME server's _directory_, as it is documented by the CA. This is how to connect to a fictional example staging server: ```java Session session = new Session("https://acme-staging-v02.api.example.org/directory"); ``` The Session now knows where to locate the service endpoints. However, no actual connection to the server is done yet. The connection to the CA is handled later by a generic provider. ## ACME URIs Such a URI is hard to remember and might even change in the future. For this reason, special ACME connection URIs should be preferred. These special ACME URIs look like this: ```java Session session = new Session("acme://example.org/staging"); ``` Instead of a generic provider, this call uses a provider that is specialized to the CA. !!! note **→ [Find the ACME Connection URI of your CA here!](../ca/index.md) ←** If your CA is not listed there, it might still provide a JAR file with a proprietary provider that you can add to the classpath. **You can always use the standard URI (as mentioned above) to connect to any [RFC 8555](https://tools.ietf.org/html/rfc8555) compliant CA.** A staging server is meant to be used for testing purposes only. The issued certificates are functional, but as the issuer certificate is not known to browsers, it will lead to an error if the certificate is validated. To use the production server, you only need to change the ACME URI: ```java Session session = new Session("acme://example.org"); ``` ## Metadata CAs can provide metadata related to their ACME server. They are evaluated with the `session.getMetadata()` method. ```java Metadata meta = session.getMetadata(); Optional tos = meta.getTermsOfService(); Optional website = meta.getWebsite(); ``` ================================================ FILE: src/doc/docs/usage/debugging.md ================================================ # Debugging The code base of _acme4j_ is mature and in active use for many years. There are frequent automatic integration tests running against a testing server that cover the entire process of ordering a certificate. For this reason, it is rather unlikely that _acme4j_ has an undetected major bug if used in a standard environment. However, problems **may** occur if _acme4j_ is used in a non-standard environment. This can be (but is not limited to): - Compatibility issues when connecting to other CA implementations than [Boulder](https://github.com/letsencrypt/boulder) and [Pebble](https://github.com/letsencrypt/pebble). - Using other means for creating key pairs and CSRs than given in the [example](example.md). - Using features of _acme4j_ that are declared as experimental. - Running _acme4j_ on a different Java runtime environment than OpenJDK. - Using _acme4j_ in a complex network architecture. _acme4j_ offers extensive debug logging that logs the client-server communication and every important aspect of the workflow. If you are stuck with a strange behavior, the first thing you should do is to enable debug logging, and check if the client-server communication gives a hint about the problem. ## Enable Debug Logging _acme4j_ uses the [SLF4J](https://www.slf4j.org/) framework for logging. SLF4J is a logging _facade_. The actual logging is done by other logging frameworks, and depends on your local configuration. To enable debug logging, lower the minimum log level of the `org.shredzone.acme4j` package to `debug`. If you use the SLF4J simple logger, which just logs to `System.err`, this can be accomplished with a simple Java command line option: ```sh java -Dorg.slf4j.simpleLogger.log.org.shredzone.acme4j=debug ... ``` For other logging frameworks, please check the framework documentation. Android does not log SLF4J output by default. To enable debug logging to logcat, you can add [Noveo Group's android-logger](https://noveogroup.github.io/android-logger/) to your app dependencies. !!! warning _acme4j_'s debug log level never logs information that might compromise your account or your certificates, like private keys. What it **does** log though are public keys, resource location URLs, nonces, contact URIs, domain names, challenges (and their responses), CSRs, certificates, and other sensitive data. For this reason, it is recommended to keep debug logging disabled on production machines. **Do not blindly post debug logs to public bug reports or questions!** Understanding the debug log output requires some basic knowledge about the [RFC 8555](https://tools.ietf.org/html/rfc8555) protocol. If you need assistance with your problem, don't hesitate to [open an issue](https://codeberg.org/shred/acme4j/issues). ## Example Log Output This is an example debug log output for creating a new account. This example connects to a [Pebble](https://github.com/letsencrypt/pebble) test server instance running locally on port 14000, so the CA's base URL is `https://localhost:14000`. Usually _acme4j_ first logs the action that is taken: ```text [main] DEBUG org.shredzone.acme4j.AccountBuilder - create ``` If there is no cached copy of the CA's directory, it is fetched now. ```text [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - GET https://localhost:14000/dir [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Cache-Control: public, max-age=0, no-cache [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Content-Length: 406 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Date: Wed, 27 Apr 2022 17:42:43 GMT [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Content-Type: application/json; charset=utf-8 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Result JSON: {"keyChange":"https://localhost:14000/rollover-account-key","meta":{"externalAccountRequired":false,"termsOfService":"data:text/plain,Do%20what%20thou%20wilt"},"newAccount":"https://localhost:14000/sign-me-up","newNonce":"https://localhost:14000/nonce-plz","newOrder":"https://localhost:14000/order-plz","revokeCert":"https://localhost:14000/revoke-cert"} ``` You can see that a `GET` request to the directory `https://localhost:14000/dir` was sent, and you see the `HEADER`s that were returned by the server, and the `Result JSON` that was found in the response body. If _acme4j_ has no current nonce, it will fetch a new one from the `newNonce` endpoint found in the directory. A `HEAD` request is sufficient for that. ```text [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEAD https://localhost:14000/nonce-plz [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Cache-Control: public, max-age=0, no-cache [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Replay-Nonce: Os_sBjfWzVZenwwjvLrwXA [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Date: Wed, 27 Apr 2022 17:42:43 GMT [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Link: ;rel="index" [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Replay Nonce: Os_sBjfWzVZenwwjvLrwXA ``` In the bottom line, the `Replay Nonce` is repeated that was found in the response header. Now _acme4j_ sends a `POST` request to the `newAccount` endpoint. As `Payload`, it will consent to the terms of service, and give optional account information (like the account e-mail address if given). You can also see the `JWS Header` that was sent with the request. It contains the target URL, the *public* JWK of your new account, the nonce from above, and the key algorithm. ```text [main] DEBUG org.shredzone.acme4j.toolbox.JoseUtils - POST https://localhost:14000/sign-me-up [main] DEBUG org.shredzone.acme4j.toolbox.JoseUtils - Payload: {"termsOfServiceAgreed":true} [main] DEBUG org.shredzone.acme4j.toolbox.JoseUtils - JWS Header: {"url":"https://localhost:14000/sign-me-up","jwk":{"kty":"RSA","n":"jyTwiSJACtW_SW-aiihQS5Y5QR704zUwjhlevY0oK-y5wP7SlIc2hq2OPVRarCzjhOxZl2AQFzM5VCR7xRDcnIn9t_pl7Mgsnx9hKDS9yQ24YXzhQ4cMEVVuqwcHvXqPdWDSoCZ1ccMqiiPyBSNGQTXMPY5PBxMOR47XwOb4eNMOPqnzVio3MEtL2wphtEonP3MY6pxJJzzel04wSCRZ4n06reqwER3KwRFPnRpRxAgmSEot5IBLIT3jj-amT5sD7YoUDbPmLk23zgDBIhX88fkClilg1W-fUi1XxYZomEPGvV7OrE1yszt4YDPqKgjJT8t2JPy__1ri-8rZgSxn5Q","e":"AQAB"},"nonce":"Os_sBjfWzVZenwwjvLrwXA","alg":"RS256"} ``` This is a possible response of the server: ```text [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Cache-Control: public, max-age=0, no-cache [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Replay-Nonce: mmnKF6lBuisPWhj9kkFMRA [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Content-Length: 491 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Date: Wed, 27 Apr 2022 17:42:43 GMT [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Link: ;rel="index" [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Location: https://localhost:14000/my-account/1 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Content-Type: application/json; charset=utf-8 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Replay Nonce: mmnKF6lBuisPWhj9kkFMRA [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Location: https://localhost:14000/my-account/1 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Result JSON: {"status":"valid","orders":"https://localhost:14000/list-orderz/1","key":{"kty":"RSA","n":"jyTwiSJACtW_SW-aiihQS5Y5QR704zUwjhlevY0oK-y5wP7SlIc2hq2OPVRarCzjhOxZl2AQFzM5VCR7xRDcnIn9t_pl7Mgsnx9hKDS9yQ24YXzhQ4cMEVVuqwcHvXqPdWDSoCZ1ccMqiiPyBSNGQTXMPY5PBxMOR47XwOb4eNMOPqnzVio3MEtL2wphtEonP3MY6pxJJzzel04wSCRZ4n06reqwER3KwRFPnRpRxAgmSEot5IBLIT3jj-amT5sD7YoUDbPmLk23zgDBIhX88fkClilg1W-fUi1XxYZomEPGvV7OrE1yszt4YDPqKgjJT8t2JPy__1ri-8rZgSxn5Q","e":"AQAB"}} ``` In the `HEADER` section, you can find a new replay nonce and the location of your new account. This information is repeated in the `Replay Nonce` and `Location` lines. You can also read the response body as `Result JSON`. It contains the account `status`, further links (e.g. for ordering), and other information. ## Example Error Log Output Errors are usually sent as JSON problem structure. In the next example we have tried to create a new account, but used a bad nonce. Again, we see the `POST` request to the `newAccount` endpoint. It uses the nonce `I6rXikEqxJ0aRwu1RvspNw` in the `JWS Header`. That nonce might have already been used in a previous request and is invalid now. ```text [main] DEBUG org.shredzone.acme4j.toolbox.JoseUtils - POST https://localhost:14000/sign-me-up [main] DEBUG org.shredzone.acme4j.toolbox.JoseUtils - Payload: {"contact":["mailto:acme@example.com"],"termsOfServiceAgreed":true} [main] DEBUG org.shredzone.acme4j.toolbox.JoseUtils - JWS Header: {"url":"https://localhost:14000/sign-me-up","jwk":{"kty":"RSA","n":"y5i_8yG9IlL8ra2UWSK12Zy-dS0BYFvu2lerAoJQmYBwtPreOXu4OoIU6ZySAsMxlu2gMLaib62DFAFckEwQP4Bu8yJ4MWdSsiPu6pEs0SAvC61e3lYyDPbSG7FMykhWg5pjbK_NJ4Ysk64DrSA4kc0vxo54YKgxZfzObr4CHBZDaJmkTVtRndI7a8mNFO9pDlfHyb3UyZZPsg3kAUbnI9n3pZatdlGrv6eonbNAREjLvplGEI0_8B08S5fDcm6MqNarxNQIXlEhGDNoYLMGi5tM6CzsfXosHz42Umcym0EXvT1VjfoZMacSDsXleSRwjgewz486LDMErZSc0aUPSQ","e":"AQAB"},"nonce":"I6rXikEqxJ0aRwu1RvspNw","alg":"RS256"} ``` The server responds with a `400 Bad Request` and an `application/problem+json` document: ```text [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Cache-Control: public, max-age=0, no-cache [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Replay-Nonce: LDDZAGcBuKYpuNlFTCxPYw [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Content-Length: 147 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Date: Wed, 27 Apr 2022 17:42:43 GMT [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Link: ;rel="index" [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - HEADER Content-Type: application/problem+json; charset=utf-8 [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Replay Nonce: LDDZAGcBuKYpuNlFTCxPYw [main] DEBUG org.shredzone.acme4j.connector.DefaultConnection - Result JSON: {"type":"urn:ietf:params:acme:error:badNonce","detail":"JWS has an invalid anti-replay nonce: I6rXikEqxJ0aRwu1RvspNw","status":400} ``` In the `Result JSON`, you can see a JSON problem document. The `type` and `detail` fields gives further information about the error. Fortunately, bad nonces are handled by _acme4j_ internally. It will just resend the request with a new nonce. ```text [main] INFO org.shredzone.acme4j.connector.DefaultConnection - Bad Replay Nonce, trying again (attempt 1/10) ``` ================================================ FILE: src/doc/docs/usage/errors.md ================================================ # Errors The CA will send all errors as [RFC7807](https://datatracker.ietf.org/doc/html/rfc7807) problem documents. _acme4j_ parses these documents and provides a `Problem` representation of them. The simplest way to handle the problem is to log the result of its `.toString()` method. It contains a summary of all important fields. There are other methods that return machine- and human-readable details and subproblems. With `.asJSON()` you can also get a JSON representation of the full problem document, in case there are non-standard fields. ## Errors while Ordering If your challenge has failed, you can retrieve the cause of the failure with `Challenge.getError()` or `Order.getError()`. It returns an `Optional` containing further details why the challenge has failed. ## Exceptions `AcmeServerException` and its subclasses provide a `getProblem()` method that returns the `Problem` that caused the exception. The exception message also contains a summary of the problem. ================================================ FILE: src/doc/docs/usage/exceptions.md ================================================ # Exceptions _acme4j_ methods can throw a number of exceptions. All exceptions are derived from `AcmeException` and are checked exceptions. Only `AcmeLazyLoadingException` and `AcmeProtocolException` are runtime exceptions. ```text Exception ├ AcmeException │ ├ AcmeNetworkException │ ├ AcmeRetryAfterException │ └ AcmeServerException │ ├ AcmeRateLimitedException │ ├ AcmeUnauthorizedException │ └ AcmeUserActionRequiredException └ RuntimeException ├ AcmeLazyLoadingException └ AcmeProtocolException └ AcmeNotSupportedException ``` ## AcmeException This is the root class of all checked _acme4j_ exceptions. ## AcmeNetworkException This is an `AcmeException` that is thrown on generic network errors during communication (e.g. network timeout). The exception provides the causing `IOException`. ## AcmeRetryAfterException This `AcmeException` shows that a server-side process has not been completed yet, and gives an estimation when the process might be completed. It can only be thrown when invoking `update()`. However, it is preferred to invoke `fetch()`, which returns the retry-after instant directly, instead of throwing this exception. !!! note The internal state of the resource is still updated. The given estimation is only a proposal. This exception can be safely ignored. However, an earlier attempt to update the state will likely throw this exception again. ## AcmeServerException An `AcmeException` that is thrown when the server responded with an error. The cause of the error is returned as `Problem` object. A few special cases are throwing a subclass exception, which is easier to handle. ## AcmeRateLimitedException This `AcmeServerException` shows that the client has exceeded a rate limit of the server, and the request was denied because of that. The exception provides a `Problem` instance that further explains what rate limit has been exceeded. Optionally it also provides an `Instant` when the request is expected to succeed again. It also provides `URL`s to human-readable documents with further information about the rate limit. ## AcmeUnauthorizedException An `AcmeServerException` that indicates that the client has insufficient permissions for the attempted request. For example, this exception is thrown when an account tries to access a resource that belongs to a different account. ## AcmeUserActionRequiredException This `AcmeServerException` is thrown when a user action is required. The most likely reason is that the Terms of Service have been changed and must be confirmed before proceeding. The exception provides a `Problem` object with a detailed reason, a link to a web page with further instructions to be taken by a human, and an optional link to the new Terms of Service. ## AcmeLazyLoadingException This is a runtime exception that is thrown when an `AcmeException` occurs while a resource lazily tries to update its current state from the server. After construction, all [resources](persistence.md) do not hold the state of the resource yet. For this reason, it is cheap to construct resources, as it does not involve network traffic. To fetch the current state of the resource, `update()` can be invoked. In case of an error, the `update()` method throws a checked `AcmeException`. All getter methods of a resource invoke `update()` implicitly if the current state is unknown. However, it would make usage much more complex if every getter could throw the checked `AcmeException`. For this reason, the getters wrap the `AcmeException` into a runtime `AcmeLazyLoadingException`. If you want to avoid this exception to be thrown, you can invoke `update()` on the resource, and handle the `AcmeException` there in a single place. After that, the getters won't throw an `AcmeLazyLoadingException` anymore. The exception returns the resource type, the resource location, and the `AcmeException` that was thrown. ## AcmeProtocolException This is a runtime exception that is thrown if the server response was unexpected and violates the RFC. _acme4j_ was unable to parse the response properly. An example would be that the server returned an invalid JSON structure that could not be parsed. ## AcmeNotSupportedException This is an `AcmeProtocolException` that is thrown if the server does not support the requested feature. This can be because the feature is optional, or because the server is not fully RFC compliant. The exception provides a description of the feature that was missing. ================================================ FILE: src/doc/docs/usage/index.md ================================================ # How to Use acme4j _acme4j_ is a client library that helps to connect to ACME servers without worrying about specification details. This is the main part of the documentation about how to use _acme4j_. * [Session and Connection](connecting.md): How to connect to an ACME server * [Account and Login](account.md): How to create an account and login * [Certificate Ordering](order.md): How to order a certificate for your domain * [Certificate Renewal](renewal.md): How to renew a certificate in time before expiration * [Certificate Revocation](revocation.md): How to revoke a certificate * [Resources and Persistence](persistence.md): How to persist ACME resources * [Exceptions](exceptions.md): About all _acme4j_ exceptions * [Advanced Topics](advanced.md): Advanced topics about _acme4j_ and ACME * [Debugging](debugging.md): Enabling and reading the debug log output The first three chapters are essential, as they describe all necessary steps for getting a signed certificate. ================================================ FILE: src/doc/docs/usage/order.md ================================================ # Certificate Ordering Once you have your account set up, you are ready to order certificates. ## Creating an Order Use `Account.newOrder()` to start ordering a new certificate. It returns an `OrderBuilder` object that helps you to collect the parameters of the order. You can give one or more domain names. Optionally you can also give your desired `notBefore` and `notAfter` dates for the generated certificate, but it is at the discretion of the CA to use (or ignore) these values. ```java Account account = ... // your Account object Order order = account.newOrder() .domains("example.org", "www.example.org", "m.example.org") .notAfter(Instant.now().plus(Duration.ofDays(20L))) // optional .create(); ``` !!! note The number of domains per certificate may be limited. See your CA's documentation for the limits. ## Authorization The `Order` resource contains a collection of `Authorization` objects that can be read from the `getAuthorizations()` method. Each `Authorization` is associated with one of the domains in your order. `Authorization.getIdentifier()` returns that identifier. Before you can retrieve your certificate, you must process _all_ authorizations that are in a `PENDING` state. ```java for (Authorization auth : order.getAuthorizations()) { if (auth.getStatus() == Status.PENDING) { log.info("Authorizing " + auth.getIdentifier()); // process auth by performing a challenge, see below : : } } ``` If all `Authorization` objects are in status `VALID`, you are ready to [finalize your order](#finalizing-the-order). ## Challenge The `Authorization` instance contains further details about how you can prove the ownership of your domain. An ACME server offers one or more authorization methods, called `Challenge`. `Authorization.getChallenges()` returns a collection of all `Challenge`s offered by the CA for domain ownership validation. You only need to complete _one_ of them to successfully authorize your domain. You would usually pick the challenge that is best suited for your infrastructure. !!! tip See [here](../challenge/index.md) for a description of all standard challenges. However, your CA may not offer all the standard types, and may offer additional, proprietary challenge types. The simplest way is to invoke `findChallenge()`, stating the challenge type your system is able to provide (either as challenge name or challenge class type): ```java Optional challenge = auth.findChallenge(Http01Challenge.TYPE); // by name Optional challenge = auth.findChallenge(Http01Challenge.class); // by type ``` It returns a properly cast `Challenge` object, or _empty_ if your challenge type was not offered by the CA. In this example, your system chooses `Http01Challenge` because it is able to respond to an [http-01](../challenge/http-01.md) challenge. !!! tip Passing the challenge type is preferred over the challenge name, as type checks are performed at compile time here. Passing in the challenge name might result in a `ClassCastException` at runtime. The returned `Challenge` resource provides all the data that is necessary for a successful verification of your domain ownership (see the documentation of the individual challenges). After you have performed the necessary steps to set up the response to the challenge (e.g. configuring your web server or modifying your DNS records), you tell the ACME server that you are ready for validation: ```java challenge.trigger(); ``` Now you have to wait for the server to check your response. If the checks are completed, the CA will set the authorization status to `VALID` or `INVALID`. The easiest (but admittedly also the ugliest) way is to poll the status: ```java while (!EnumSet.of(Status.VALID, Status.INVALID).contains(auth.getStatus())) { Thread.sleep(3000L); auth.fetch(); } ``` This is a very simple example which can be improved in many ways: * Limit the number of checks, to avoid endless loops if an authorization is stuck on server side. * Wait with the status checks until the CA has accessed the response for the first time (e.g. after an incoming HTTP request to the response file). * Use an asynchronous architecture instead of a blocking `Thread.sleep()`. * Check if `auth.fetch()` returns a retry-after `Instant`, and wait for the next update at least until this moment is reached. See the [example](../example.md) for a simple way to do that. The CA server may start with the validation immediately after `trigger()` is invoked, so make sure your server is ready to respond to requests before invoking `trigger()`. Otherwise, the challenge might fail instantly. Also keep your response available until the status has changed to `VALID` or `INVALID`. The ACME server may check your response multiple times, and from different IPs! If the status gets `VALID` or `INVALID`, the response you have set up before is not needed anymore. It can (and should) be removed. !!! tip A common mistake is that the server infrastructure is not completely ready when `trigger()` is invoked (e.g. caches are not purged, services are still restarting, synchronization between instances is still in progress). Also, do not tear down the challenge response too early, as the CA might perform multiple checks. If your authorization status turned to `VALID`, you have successfully authorized your domain, and you are ready for the next step. ## Finalizing the Order After successfully completing all authorizations, the order needs to be finalized. First, you will need to generate a key pair that is used for certification and encryption of the domain. Similar to the account key pair, you can either use external tool, Java's own crypto framework, or use the [`KeyPairUtils`](../acme4j-client/apidocs/org.shredzone.acme4j.utils/org/shredzone/acme4j/util/KeyPairUtils.html). !!! tip Never use your account key pair as domain key pair, but always generate separate key pairs! After that, the order can be finalized: ```java KeyPair domainKeyPair = ... // KeyPair to be used for HTTPS encryption order.execute(domainKeyPair); ``` _acme4j_ will automatically take care of creating a minimal CSR for this order internally. If you need to expand this CSR (e.g. with your company name), you can do so: ```java order.execute(domainKeyPair, csr -> { csr.setOrganization("ACME Corp."); }); ``` It depends on the CA if other CSR properties (like _Organization_, _Organization Unit_) are accepted. Some may even require these properties to be set, while others may ignore them when generating the certificate. You can also create a custom CSR, and pass it to the order with either `execute(PKCS10CertificationRequest csr)` or `execute(byte[] csr)`. !!! note Some CAs may take a considerable amount of time (30 seconds or more) for finalizing an order. As this call is synchronous, be prepared that the process is blocked for that time. If you experience frequent timeouts with your CA, you can increase the timeout duration in the [network settings](advanced.md#network-settings). !!! note According to RFC-8555, the correct technical term is _finalization_ of an order. However, Java has a method called `Object.finalize()` which is problematic and should not be used. To avoid confusion with that method, the finalization methods are intentionally called `execute` in _acme4j_. ## Retrieving the Certificate Once you completed all the previous steps, it is finally time to download the signed certificate. But first we need to wait until the certificate is available for download. Again, a primitive way is to poll the status: ```java Order order = ... // your Order object from the previous step while (!EnumSet.of(Status.VALID, Status.INVALID).contains(order.getStatus())) { Thread.sleep(3000L); order.fetch(); } ``` This is a very simple example which can be improved in many ways: * Limit the number of checks, to avoid endless loops if the order is stuck on server side. * Use an asynchronous architecture instead of a blocking `Thread.sleep()`. * Check if `order.fetch()` returns a retry-after `Instant`, and wait for the next update at least until this moment is reached. See the [example](../example.md) for a simple way to do that. !!! tip If the status is `PENDING`, you have not completed all authorizations yet. !!! note Always check the status before downloading the certificate, even if it seems that the CA sets the status to `VALID` immediately. As soon as the status turns `VALID`, you can retrieve a `Certificate` object: ```java Certificate cert = order.getCertificate(); ``` The `Certificate` object offers methods to get the certificate or the certificate chain. ```java X509Certificate cert = cert.getCertificate(); List chain = cert.getCertificateChain(); ``` `cert` only contains your leaf certificate. However, most servers require the certificate `chain` that also contains all intermediate certificates up to the root CA. You can write the certificate chain to disk using the `Certificate.writeCertificate()` method. It will create a `.crt` file that is accepted by most servers (like _Apache_, _nginx_, _postfix_, _dovecot_, etc.). **Congratulations! You have just created your first certificate via _acme4j_.** ## List all Orders To get a list of all current orders of your account, invoke `Account.getOrders()`. Note that for reasons lying in the ACME protocol, the result is an `Iterator` and not a list. Also, any invocation of `Iterator.next()` can initiate a network call to the CA, and may throw an `AcmeProtocolException` if there was an error. !!! important This method is a mandatory part of RFC-8555. Still, as of now, this functionality has not been implemented in all [Boulder](https://github.com/letsencrypt/boulder) based CAs (like Let's Encrypt) and will throw an `AcmeNotSupportedException`. Also see [this issue](https://github.com/letsencrypt/boulder/issues/3335). At the moment, the only workaround is to store `Order` location URLs (or other resource URLs) locally along with the certificates, see the [Resources and Persistence](./persistence.md) chapter. ## Wildcard Certificates If supported by the CA, you can also generate a wildcard certificate that is valid for all subdomains of a domain, by prefixing the domain name with `*.` (e.g. `*.example.org`). The domain itself is not covered by the wildcard certificate and also needs to be added to the order if necessary. !!! note _acme4j_ accepts all kind of wildcard notations (e.g. `www.*.example.org`, `*.*.example.org`). However, those notations are not specified. They may be rejected by the CA, or may not work as expected. You must be able to prove ownership of the domain that you want to order a wildcard certificate for (i.e. for `*.example.org` ownership of `example.org` needs to be proven). The corresponding `Authorization` resource only refers to that domain, and does not contain the wildcard notation. However, the `Authorization.isWildcard()` method will reveal that this authorization is related to a wildcard certificate. The following example creates an `Order` for `example.org` and `*.example.org`: ```java KeyPair domainKeyPair = ... // KeyPair to be used for HTTPS encryption Order order = account.newOrder() .domains("example.org", "*.example.org") .create(); order.execute(domainKeyPair); ``` In the subsequent authorization process, you would only have to prove ownership of the `example.org` domain. !!! note Some CAs may reject wildcard certificate orders at all, may only offer a limited set of challenge types, or may require special challenge types that are not documented here. Refer to your CA's documentation to find out about the wildcard certificate policy. ## IP Identifiers Besides domains, _acme4j_ also supports IP identifier validation as specified in [RFC 8738](https://tools.ietf.org/html/rfc8738). If your CA offers ACME IP support, you can add IP `Identifier` objects to the order: ```java Order order = account.newOrder() .identifier(Identifier.ip(InetAddress.getByName("192.0.2.2"))) .identifier(Identifier.ip("192.0.2.3")) // for your convenience .identifier(Identifier.dns("example.org")) .create(); ``` The example also shows how to add domain names as DNS `Identifier` objects. Adding domain names via `domain()` is just a shortcut notation for it. ## Subdomains Ordering certificates for subdomains is not different to ordering certificates for domains. You prove ownership of that subdomain, and then get a certificate for it. If your CA supports [RFC 9444](https://tools.ietf.org/html/rfc9444), you can also get certificates for all subdomains only by proving ownership of an ancestor domain. To do so, add the ancestor domain to your `Identifier` when creating the order: ```java Order order = account.newOrder() .identifier( Identifier.dns("foo.bar.example.org") .withAncestorDomain("example.org") ) .create(); ``` The CA can then choose to issue challenges for any of `foo.bar.example.org`, `bar.example.org`, or `example.org`. For each challenge, the related domain can be got via `Authorization.getIdentifier()`. `Authorization.isSubdomainAuthAllowed()` will return `true` if that `Authorization` is used to issue subdomain certificates. To check if your CA supports RFC 9444, read `Metadata.isSubdomainAuthAllowed()`. ## Profiles If your CA supports [draft-ietf-acme-profiles-01](https://datatracker.ietf.org/doc/draft-ietf-acme-profiles/), you can select a profile when ordering a certificate: ```java Order order = account.newOrder() .profile("tlsserver") .create(); ``` You can use `Metadata` to check if profiles are supported, and which ones: * `Metadata.isProfileAllowed()`: `true` if profiles are supported * `Metadata.isProfileAllowed(String)`: `true` if the given profile is supported * `Metadata.getProfiles()`: returns a `Set` of all profile names * `Metadata.getProfileDescription(String)`: returns a human-readable profile description ================================================ FILE: src/doc/docs/usage/persistence.md ================================================ # Resources and Persistence All CA related resources are derived from the `AcmeResource` class: * `Account`: Represents your account * `Authorization`: Authorization of a domain or identifier * `Certificate`: A certificate * `Challenge` (and subclasses): Challenge to proof domain ownership * `Order`: A certificate order * `RenewalInfo`: Renewal information These classes reflect the state of the corresponding resource on the ACME server side. They also keep a copy of the current resource state that can be updated via `update()`. The only exception is the `Certificate` resource, which will never change its state and thus does not need to be updated. ## Resource Location All resources possess a unique resource URL on the CA server. To get that URL, invoke the `getLocation()` method. This is the best way to retrieve a permanent resource reference for local persistence (e.g. in a database). ## Resource Binding To revive an `AcmeResource` object from its location URL, you can bind it to your `Login` by using the resource location URL and the corresponding method: * `Login.bindAuthorization()` takes an authorization URL and returns the corresponding `Authorization` object. * `Login.bindCertificate()` takes a certificate URL and returns the corresponding `Certificate` object. * `Login.bindOrder()` takes an order URL and returns the corresponding `Order` object. * `Login.bindRenewalInfo()` takes a renewal info URL and returns the corresponding `RenewalInfo` object. There are two methods for binding a `Challenge`: * `Login.bindChallenge(URL location)` binds to a challenge URL and returns a `Challenge` instance. You will need to check yourself if the `Challenge` is of the expected type, and eventually cast it to the correct type. * `bindChallenge(URL location, Class type)` is similar to the method above, but will do the casting for you. You will get the challenge object in your expected type. If the challenge at the location is of a different type, an `AcmeProtocolException` will be thrown. There is no way to bind an `Account`. To retrieve your account resource, simply invoke `Login.getAccount()`. !!! note You can only bind resources that belong to your account. ## Serialization All resource objects are serializable, so the current state of the object can also be frozen by Java's serialization mechanism. However, the `Login` that the object is bound to is _not_ serialized! This is because in addition to volatile data, the `Login` object also holds a copy of your private key. Not serializing it prevents you from accidentally exposing your private key in a place with lowered access restrictions. After deserialization, an object is not bound to a `Login` yet. It is required to rebind it by invoking the `rebind()` method of the resource object. !!! note Serialization is only meant for short term storage at runtime, not for long term persistence. For long term persistence, always store the location URL of the resource, then bind it at later time like mentioned above. !!! warning Do not share serialized data between different versions of _acme4j_. ================================================ FILE: src/doc/docs/usage/renewal.md ================================================ # Certificate Renewal Certificates are only valid for a limited time, and need to be renewed before expiry. To read the expiration date of your certificate, use `X509Certificate.getNotAfter()`. The certificate is eligible to be renewed a few days or weeks before its expiry. Check the documentation of your CA about a recommended time window. Also do not postpone the renewal to the last minute, as there can always be unexpected network issues that delay the issuance of a renewed certificate. !!! tip Some CAs send a notification mail to your account's mail addresses in time before expiration. However, you should not rely on those mails, and only use them as an ultimate warning. ## How to Renew There is no special path for renewing a certificate. To renew it, just [order](order.md) the certificate again. ## Renewal Information _acme4j_ supports [RFC 9773](https://tools.ietf.org/html/rfc9773) for renewal information. You can check if the CA offers renewal information by invoking `Certificate.hasRenewalInfo()`. If it does, you can get a suggested time window for certificate renewal by invoking `Certificate.getRenewalInfo()`. When renewing a certificate, you can use `OrderBuilder.replaces()` to mark your current certificate as the one being replaced. This step is optional though. ## Short-Term Automatic Renewal _acme4j_ supports [RFC 8739](https://tools.ietf.org/html/rfc8739) for Short-Term Automatic Renewal (STAR) of certificates. To find out if the CA supports the STAR extension, check the metadata: ```java if (session.getMetadata().isAutoRenewalEnabled()) { // CA supports STAR! } ``` If STAR is supported, you can enable automatic renewals by adding `autoRenewal()` to the order parameters: ```java Order order = account.newOrder() .domain("example.org") .autoRenewal() .create(); ``` You can also use `autoRenewalStart()`, `autoRenewalEnd()`, `autoRenewalLifetime()` and `autoRenewalLifetimeAdjust()` to change the time span and frequency of automatic renewals. You cannot use `notBefore()` and `notAfter()` in combination with `autoRenewal()` though. The `Metadata` object also holds the accepted renewal limits (see `Metadata.getAutoRenewalMinLifetime()` and `Metadata.getAutoRenewalMaxDuration()`). The STAR certificates are automatically renewed by the CA. You will always find the latest certificate at the certificate location URL. To download the latest certificate issue, you can bind the certificate URL to your `Login` and then use the `Certificate` object. ```java URL certificateUrl = ... // URL of the certificate Certificate cert = login.bindCertificate(certificateUrl); X509Certificate latestCertificate = cert.getCertificate(); ``` !!! note STAR based certificates cannot be revoked. However, as it is the nature of these certs to be very short-lived, this does not pose an actual security issue. ### Fetching STAR certificates via GET Usually the STAR certificate must be fetched from the location URL by an authorized `POST-as-GET` request. If supported by the CA, it is possible to change the method to a plain `GET` request, so the certificate can be fetched by a simple HTTP client (like curl) without authentication. To enable this `GET` method, first check if it is offered by the CA, by invoking `Metadata.isAutoRenewalGetAllowed()`. If it is true, add `autoRenewalEnableGet()` to the order options. After the order was finalized, the certificate will be available via both `GET` and `POST-as-GET` methods. ### Cancelling Auto-Renewals Use `Order.cancelAutoRenewal()` to terminate automatic certificate renewals. ================================================ FILE: src/doc/docs/usage/revocation.md ================================================ # Certificate Revocation To revoke a certificate, just invoke the respective method: ```java cert.revoke(); ``` Optionally, you can provide a revocation reason that the ACME server may use when generating OCSP responses and CRLs. ```java cert.revoke(RevocationReason.KEY_COMPROMISE); ``` There are different reasons for a certificate revocation. If you have sold or deleted the associated domain, you should also deactivate the respective `Authorization` using `Authorization.deactivate()`. Otherwise, the new owner of the domain might have problems to get a certificate because the domain name is still associated with your account. !!! tip It is not documented if the deactivation of an authorization also revokes the related certificate automatically. If in doubt, revoke the certificate yourself before deactivation. ## Without Certificate URL If you cannot create a `Certificate` object because you don't know the certificate's location URL, you can also use an alternative method that only requires a `Login` and the certificate itself: ```java Login login = ... // login to your account X509Certificate cert = ... // certificate to revoke Certificate.revoke(login, cert, RevocationReason.KEY_COMPROMISE); ``` ## Without Account Key If you have lost your account key, you can still revoke a certificate as long as you still own the domain key pair that was used for the order. `Certificate` provides a special method for this case. ```java KeyPair domainKeyPair = ... // the key pair used for order (not your account key pair) X509Certificate cert = ... // certificate to revoke Certificate.revoke(session, domainKeyPair, cert, RevocationReason.KEY_COMPROMISE); ``` !!! warning There is no automatized way to revoke a certificate if you have lost both your account's key pair and your domain's key pair. ================================================ FILE: src/doc/mkdocs.yml ================================================ site_name: acme4j site_author: Richard Körber site_url: https://acme4j.shredzone.org site_dir: target/site/ repo_url: https://codeberg.org/shred/acme4j edit_uri: '' use_directory_urls: false theme: name: readthedocs custom_dir: theme/ highlightjs: false markdown_extensions: - admonition - codehilite - def_list - toc: permalink: true nav: - 'index.md' - 'example.md' - JavaDocs: - 'acme4j-client': acme4j-client/apidocs/index.html - 'acme4j-smime': acme4j-smime/apidocs/index.html - 'acme4j-it': acme4j-it/apidocs/index.html - Usage: - 'usage/index.md' - 'usage/connecting.md' - 'usage/account.md' - 'usage/order.md' - 'usage/renewal.md' - 'usage/revocation.md' - 'usage/persistence.md' - 'usage/errors.md' - 'usage/exceptions.md' - 'usage/advanced.md' - 'usage/debugging.md' - 'faq.md' - Challenges: - 'challenge/index.md' - 'challenge/dns-01.md' - 'challenge/dns-account-01.md' - 'challenge/dns-persist-01.md' - 'challenge/email-reply-00.md' - 'challenge/http-01.md' - 'challenge/tls-alpn-01.md' - CA: - 'ca/index.md' - 'ca/actalis.md' - 'ca/google.md' - 'ca/letsencrypt.md' - 'ca/pebble.md' - 'ca/sslcom.md' - 'ca/zerossl.md' - Development: - 'development/index.md' - 'development/provider.md' - 'development/challenge.md' - 'development/testing.md' - 'migration.md' ================================================ FILE: src/doc/theme/breadcrumbs.html ================================================ ================================================ FILE: src/doc/theme/css/font.css ================================================ /* * Lato * Copyright 2010-2011 tyPoland Lukasz Dziedzic * SIL Open Font License, 1.1 */ @font-face { font-family: 'Lato'; font-style: normal; font-weight: 400; src: local('Lato Regular'), local('Lato-Regular'), url('../fonts/lato-v15-latin-regular.woff') format('woff'); } /* * Roboto Slab * Copyright 2013 Google * Apache License, version 2.0 */ @font-face { font-family: 'Roboto Slab'; font-style: normal; font-weight: 400; src: local('Roboto Slab Regular'), local('RobotoSlab-Regular'), url('../fonts/roboto-slab-v8-latin-regular.woff') format('woff'); } /* * Inconsolata * Copyright 2006 The Inconsolata Project Authors * SIL Open Font License, 1.1 */ @font-face { font-family: 'Inconsolata'; font-style: normal; font-weight: 400; src: local('Inconsolata Regular'), local('Inconsolata-Regular'), url('../fonts/inconsolata-v17-latin-regular.woff') format('woff'); } ================================================ FILE: src/doc/theme/css/theme_custom.css ================================================ .wy-nav-content { max-width: none; } .codehilite pre code { font-size: 15px; } .wy-menu-vertical p.caption { padding: 0 1rem; font-size: 100%; border-bottom: 1px solid #555; } .wy-menu-vertical ul { margin-bottom: .7rem; } p { margin-bottom: .5rem; } h2 { margin-top: 2rem; } table { margin-bottom: 2rem; } footer { margin-top: 2rem; } ================================================ FILE: src/doc/theme/css/theme_pygments.css ================================================ /* github pygments theme by @jwarby, https://github.com/jwarby/jekyll-pygments-themes */ .codehilite .hll { background-color: #ffffcc } .codehilite .c { color: #999988; font-style: italic } .codehilite .err { color: #a61717; background-color: #e3d2d2 } .codehilite .k { color: #000000; font-weight: bold } .codehilite .o { color: #000000; font-weight: bold } .codehilite .cm { color: #999988; font-style: italic } .codehilite .cp { color: #999999; font-weight: bold; font-style: italic } .codehilite .c1 { color: #999988; font-style: italic } .codehilite .cs { color: #999999; font-weight: bold; font-style: italic } .codehilite .gd { color: #000000; background-color: #ffdddd } .codehilite .ge { color: #000000; font-style: italic } .codehilite .gr { color: #aa0000 } .codehilite .gh { color: #999999 } .codehilite .gi { color: #000000; background-color: #ddffdd } .codehilite .go { color: #888888 } .codehilite .gp { color: #555555 } .codehilite .gs { font-weight: bold } .codehilite .gu { color: #aaaaaa } .codehilite .gt { color: #aa0000 } .codehilite .kc { color: #000000; font-weight: bold } .codehilite .kd { color: #000000; font-weight: bold } .codehilite .kn { color: #000000; font-weight: bold } .codehilite .kp { color: #000000; font-weight: bold } .codehilite .kr { color: #000000; font-weight: bold } .codehilite .kt { color: #445588; font-weight: bold } .codehilite .m { color: #009999 } .codehilite .s { color: #d01040 } .codehilite .na { color: #008080 } .codehilite .nb { color: #0086B3 } .codehilite .nc { color: #445588; font-weight: bold } .codehilite .no { color: #008080 } .codehilite .nd { color: #3c5d5d; font-weight: bold } .codehilite .ni { color: #800080 } .codehilite .ne { color: #990000; font-weight: bold } .codehilite .nf { color: #990000; font-weight: bold } .codehilite .nl { color: #990000; font-weight: bold } .codehilite .nn { color: #555555 } .codehilite .nt { color: #000080 } .codehilite .nv { color: #008080 } .codehilite .ow { color: #000000; font-weight: bold } .codehilite .w { color: #bbbbbb } .codehilite .mf { color: #009999 } .codehilite .mh { color: #009999 } .codehilite .mi { color: #009999 } .codehilite .mo { color: #009999 } .codehilite .sb { color: #d01040 } .codehilite .sc { color: #d01040 } .codehilite .sd { color: #d01040 } .codehilite .s2 { color: #d01040 } .codehilite .se { color: #d01040 } .codehilite .sh { color: #d01040 } .codehilite .si { color: #d01040 } .codehilite .sx { color: #d01040 } .codehilite .sr { color: #009926 } .codehilite .s1 { color: #d01040 } .codehilite .ss { color: #990073 } .codehilite .bp { color: #999999 } .codehilite .vc { color: #008080 } .codehilite .vg { color: #008080 } .codehilite .vi { color: #008080 } .codehilite .il { color: #009999 } ================================================ FILE: src/doc/theme/footer.html ================================================
================================================ FILE: src/doc/theme/main.html ================================================ {% extends "base.html" %} {% block styles %} {%- for path in config['extra_css'] %} {%- endfor %} {% endblock %} {% block repo %} API javadocs {% endblock %}