Всем, привет,

впервые сталкиваюсь с сертификатами, а тут работа привалила. Смотрел ваши сообщения на форуме и понял, что есть люди, кто  разбирается в этом. Есть программа, в ней используются сертификаты, мне нужно описать работу с ними, а также продемонстрировать работоспособность. Хотел бы, спросить не могли бы Вы помочь с более-менее подробным описанием кода. Если нет, то не обижусь.  

Вот сам код:

import java.io.IOException;
import java.io.PrintWriter;
import java.net.URI;
import java.util.Properties;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.http.HttpSession;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.valves.ValveBase;
import java.io.BufferedOutputStream;
import java.io.DataOutputStream;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.math.BigInteger;
import java.net.HttpURLConnection;
import java.net.URL;
import java.security.Security;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Vector;
import org.bouncycastle.asn1.DEROctetString;
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
import org.bouncycastle.asn1.x509.X509Extension;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.ocsp.BasicOCSPResp;
import org.bouncycastle.ocsp.CertificateID;
import org.bouncycastle.ocsp.CertificateStatus;
import org.bouncycastle.ocsp.OCSPException;
import org.bouncycastle.ocsp.OCSPReq;
import org.bouncycastle.ocsp.OCSPReqGenerator;
import org.bouncycastle.ocsp.OCSPResp;
import org.bouncycastle.ocsp.SingleResp;



public class LoginValve extends ValveBase {

    @Override
    public void invoke(Request arg0, Response arg1) throws IOException, ServletException {
        X509Certificate[] certs = (X509Certificate[]) arg0
                        .getAttribute("javax.servlet.request.X509Certificate");

        if (!"https".equals(arg0.getScheme())) {
//            returnError(arg1, "Доступ РїРѕ протоколу " + arg0.getScheme() + "  Р·Р°РїСЂРµС‰РµРЅ.");
            getNext().invoke(arg0, arg1);
            return;
        }

        if (certs != null) {
            //getNext().invoke(arg0, arg1);
            if (certs[0] != null) {
                HttpSession session = arg0.getSession();

                if (session == null) {
                    //Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Ошибка! Сессия не найдена");
                    Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Error! The session is not found");
                    //if (!verifyCertificate(certs[0])) returnError(arg1, "Доступ запрещён. Сессия не найдена");
                    if (!verifyCertificate(certs[0])) returnError(arg1, "Access denied. The session is not found");
                    else getNext().invoke(arg0, arg1);
                } else {
                    String ClientNameCN = certs[0].getSubjectDN().getName();
                    ClientNameCN = ClientNameCN.substring(ClientNameCN.indexOf("CN=") + 3);
                    ClientNameCN = ClientNameCN.substring(0, ClientNameCN.indexOf(","));
                    session.setAttribute("ClientNameCN", ClientNameCN);
                    //Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Внимание2!!!!!" + ClientNameCN);
                    Object obj = session.getAttribute("isVerifyCertificate");
                    if (obj != null) {
                        String str = (String)obj;
                        if (str.equals("true")) {
                            getNext().invoke(arg0, arg1);
                            return;
                        }
                    }

                    if (!verifyCertificate(certs[0])) {
                        //Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Ошибка! Неверный сертификат");
                        Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Error! Invalid certificate");
                        session.setAttribute("isVerifyCertificate", "false");
                        //returnError(arg1, "Доступ запрещён. Неверный сертификат");
                        returnError(arg1, "Access denied. Invalid certificate");
                    } else {
                        session.setAttribute("isVerifyCertificate", "true");
                        getNext().invoke(arg0, arg1);
                    }
                }
            }
            else {
                //Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Ошибка! Сертификат не получен");
                Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Error! The certificate has not been obtained");
                //returnError(arg1, "Доступ запрещён. Сертификат не получен");
                returnError(arg1, "Access denied. The certificate has not been obtained");
            }
        } else {
            //Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Ошибка! Сертификат не получен");
            Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Error! The certificate has not been obtained");
            //returnError(arg1, "Доступ запрещён. Сертификат не получен");
            returnError(arg1, "Access denied. The certificate has not been obtained");
        }
    }

    private boolean verifyCertificate(X509Certificate curCertificate) {
        try
        {
          //Read user Certificate
       //InputStream inStream = new FileInputStream("C:\\Documents and Settings\\Alibek\\Desktop\\Для HTTPS\\certs\\client1.cer");
       CertificateFactory cf = CertificateFactory.getInstance("X.509");
       //X509Certificate interCert = (X509Certificate)cf.generateCertificate(inStream);
       //inStream.close();
          Properties p = getProps();
          String CertPath = "";
          String serviceAddr = "";
          try {
              CertPath = p.getProperty("CertPath");
              serviceAddr = p.getProperty("serviceAddr");
          } catch (Exception e) {
              //Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Ошибка! Не найден ключ 'CertPath' или 'serviceAddr'");
              Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Error! Not found the key 'CertPath' or 'serviceAddr'");
          }


       InputStream inStreamRoot = new FileInputStream(CertPath);
       X509Certificate rootCert = (X509Certificate)cf.generateCertificate(inStreamRoot);
       inStreamRoot.close();

       OCSPReq request = generateOCSPRequest(rootCert, curCertificate.getSerialNumber());

         
          byte[] array = request.getEncoded();

          
          HttpURLConnection con = null;
          URL url = new URL((String) serviceAddr);
          con = (HttpURLConnection) url.openConnection();
          con.setRequestProperty("Content-Type", "application/ocsp-request");
          con.setRequestProperty("Accept", "application/ocsp-response");
          con.setDoOutput(true);
          con.setDoInput(true);
          con.setRequestMethod("POST");

          OutputStream out = con.getOutputStream();
          DataOutputStream dataOut = new DataOutputStream(new BufferedOutputStream(out));
          

          dataOut.write(array);

          dataOut.flush();
          dataOut.close();

          
          int ret = con.getResponseCode();
          if (ret / 100 != 2) {
            throw new Exception("***Error " + Integer.toString(ret) + "***");
          }

          
          InputStream in = (InputStream) con.getContent();
          OCSPResp ocspResponse = new OCSPResp(in);

          
          int ocspRespStatus = ocspResponse.getStatus();
          Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "OCSP response status " + String.valueOf(ocspRespStatus) + ":");
              switch (ocspRespStatus) {
                  case 0: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Response has valid confirmations"); break;
                  case 1: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Illegal confirmation request"); break;
                  case 2: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Internal error in issuer"); break;
                  case 3: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Try again later"); break;
                  case 4: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "is not used"); break;
                  case 5: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Must sign the request"); break;
                  case 6: Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Request unauthorized"); break;
              }
          if (OCSPResponseStatus.SUCCESSFUL != ocspRespStatus) {
              return false;
          }


          BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject();
                    if (basicResponse != null) {
                        SingleResp[] responses = basicResponse.getResponses();
                        if (responses.length == 1) {
                            SingleResp resp = responses[0];
                            Object status = resp.getCertStatus();
                            if (status == CertificateStatus.GOOD) {
                                return true;
                            } else if (status instanceof org.bouncycastle.ocsp.RevokedStatus) {
                                return false;
                            }  else if (status instanceof org.bouncycastle.ocsp.UnknownStatus) {
                                return false;
                            }
                        }
                    }

        }
        catch (Exception e) {
            Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, null, e);
            return false;
        }
        return false;
    }
    
    public OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber)
        throws OCSPException
    {
     //Add provider BC
     Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

        // Generate the id for the certificate we are looking for
        CertificateID   id = new CertificateID(CertificateID.HASH_SHA1, issuerCert, serialNumber);

        // basic request generation with nonce
        OCSPReqGenerator    gen = new OCSPReqGenerator();

        gen.addRequest(id);

        // create details for nonce extension
        BigInteger nonce = BigInteger.valueOf(System.currentTimeMillis());
        Vector     oids = new Vector();
        Vector     values = new Vector();

        oids.add(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
        values.add(new X509Extension(false, new DEROctetString(nonce.toByteArray())));

        gen.setRequestExtensions(new X509Extensions(oids, values));

        return gen.generate();
    }

    private void returnError(Response response, String errorString) throws IOException {
        response.setContentType("text/html;charset=UTF-8");

        PrintWriter out = response.getWriter();
        try {
            out.println("<html>");
            out.println("<head>");
            out.println("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"/>");
            out.println("<title>Проверка пользовательского сертификата</title>");
            out.println("</head>");
            out.println("<body>");
            out.println("<h1>" + errorString + "</h1>");
            out.println("</body>");
            out.println("</html>");
        } finally {
            out.close();
        }
    }

    private Properties getProps() {

        Properties p = new Properties();

        StringBuffer path = new StringBuffer(getClass().getProtectionDomain().getCodeSource().getLocation().toString());
        int idx = path.indexOf("lib/KLoginApplication.jar");
        path.replace(idx, path.length(), "conf/KLoginApplication.properties");
        try {
            p.load(new java.io.FileInputStream(new java.io.File(new URI(path.toString()))));
        } catch (Exception ex) {
            Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, "Error! File not found: " + path.toString());
            Logger.getLogger(LoginValve.class.getName()).log(Level.SEVERE, null, ex);
            return null;
        }
        return p;
    }

}