Extract keyUsage extension from a certificate using bouncy castle

Question

I am writing a small CA implementation. It is possible to bootstrap this CA from an existing certificate. Upon doing this, I want to verify that the input has the correct extensions:

private static final Set<String> REQUIRED_CA_EXTENSIONS = Set.of(
        Extension.keyUsage.getId(),
        Extension.subjectKeyIdentifier.getId());

private static void validateExtensions(final X509Certificate certificate) {
    if (!CertificateExtensions.getAll(certificate).containsAll(REQUIRED_CA_EXTENSIONS)) {
        throw new RuntimeException("Attempted to create a CA from a certificate without required extensions");
    }
}

// Util method
public static Set<String> getAll(final X509Certificate certificate) {
    final Set<String> extensions = new HashSet<>();
    extensions.addAll(certificate.getCriticalExtensionOIDs());
    extensions.addAll(certificate.getNonCriticalExtensionOIDs());
    return extensions;
}

However, this only verifies the extensions are present. I also need to verify that the keyUsage extension contains both keyCertSign and cRLSign to be able to sign certificates.

How can I do this using bouncy castle and/or JCA?

Answer 1

There is a method available on a JCA X509Certificate to return the bits of the keyUsage extension, called simply getKeyUsage(). The individual bits of the key usage represented by boolean values in the returned array, per the Java documentation.

It is also possible to do a little more work using the Bouncycastle libraries to accomplish the same result. I show both methods because the Bouncycastle libraries offer much more complete support for examining an X509Certificate, so it's useful to have an example illustrating something easy in case you want to do something more difficult.

Note that this requires two Bouncycastle libraries as of this writing, the main provider/crypto library and also the PKIX/CMS library.

import org.bouncycastle.asn1.ASN1Primitive;
import org.bouncycastle.asn1.x509.KeyUsage;
import org.bouncycastle.cert.X509CertificateHolder;

import java.io.FileInputStream;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public class X509CheckKeyUsage {

    public static void main(String[] args) throws Exception {
        FileInputStream fis = new FileInputStream("DST_X3_CA.pem"); // for example
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509Certificate cert = (X509Certificate) cf.generateCertificate(fis);

        // check with simple JCA methods

        boolean [] keyUsageBools = cert.getKeyUsage();
        final int KEY_CERT_SIGN = 5;
        final int CRL_SIGN = 6;
        boolean usagesVerified = keyUsageBools[KEY_CERT_SIGN] && keyUsageBools[CRL_SIGN];
        System.out.println("key usage bits verified? " + usagesVerified);

        // Convert the jca x.509 cert to a bouncycastle x.509 cert, in two steps

        org.bouncycastle.asn1.x509.Certificate bcCert = org.bouncycastle.asn1.x509.Certificate
                .getInstance(ASN1Primitive.fromByteArray(cert.getEncoded())); // step 1
        X509CertificateHolder bcX509Cert = new X509CertificateHolder(bcCert); // step 2

        // now verify keyUsage bits

        final int requiredKeyUsageBits = KeyUsage.keyCertSign | KeyUsage.cRLSign;
        usagesVerified = KeyUsage.fromExtensions(bcX509Cert.getExtensions()).hasUsages(requiredKeyUsageBits);
        System.out.println("key usage bits verified? " + usagesVerified);
    }
}