Getting mulitiple certs from card applet
Sir
Actually i got some confusion in the java card applet. But now i want to also store the CA cert on the card.
But on the process () method i just getting the instruction of get data and it returns the user certificate to the java card.
case INS_GET_DATA:
case INS_GET_RESPONSE:
sendCertificate( apdu );
break;
Now i will have two certificates on the card. And i will have to retrieve them explicitly. What should i do now ???
storing code is:
case INS_PUT_DATA:
if ( buffer[ISO7816.OFFSET_P1] == 0x06)
storeUserCertificate(buffer, ISO7816.OFFSET_CDATA, offset[OFFSET_RECV], len);
if ((cla & 0x10) != 0x00)
offset[OFFSET_RECV] += len;
else
// last command in the chain
userCertSize = (short) (offset[OFFSET_RECV] + len);
offset[OFFSET_RECV] = 0;
if ( buffer[ISO7816.OFFSET_P1] == 0x07)
storeCACertificate(buffer, ISO7816.OFFSET_CDATA, offset[OFFSET_RECV], len);
if ((cla & 0x10) != 0x00)
offset[OFFSET_RECV] += len;
else
// last command in the chain
caCertSize = (short) (offset[OFFSET_RECV] + len);
offset[OFFSET_RECV] = 0;
break;
private void storeUserCertificate( byte[] source, short sourceOff, short destOff, short len )
if ((short) (destOff + len) > FILE_SIZE)
ISOException.throwIt(ISO7816.SW_FILE_FULL);
Util.arrayCopy(source, sourceOff, userCertBuffer, destOff, len);
private void storeCACertificate( byte[] source, short sourceOff, short destOff, short len )
if ((short) (destOff + len) > FILE_SIZE)
ISOException.throwIt(ISO7816.SW_FILE_FULL);
Util.arrayCopy(source, sourceOff, caCertBuffer, destOff, len);
/*********************************************************************/Getting code is:
case INS_GET_DATA:
if( buffer[ISO7816.OFFSET_P1] == 0x06)
sendCACertificate(apdu);
else if( buffer[ISO7816.OFFSET_P1] == 0x07)
sendUserCertificate(apdu);
break;
private void sendUserCertificate(APDU apdu)
try{
// work out how many bytes to send this time and how many will be left
short remain = (short) (userCertSize - offset[OFFSET_SENT]);
boolean chain = remain > MAX_APDU;
short sendLen = chain ? MAX_APDU : remain;
// Get ready to send
apdu.setOutgoing();
apdu.setOutgoingLength(sendLen);
apdu.sendBytesLong(userCertBuffer, offset[OFFSET_SENT], sendLen);
// Check to see if there are more APDU's to send
if (chain) {
offset[OFFSET_SENT] += sendLen; // count the bytes sent
ISOException.throwIt(ISO7816.SW_BYTES_REMAINING_00); // indicate there are more bytes to come
} else {
offset[OFFSET_SENT] = 0; // no more bytes to send
catch( APDUException ex)
ISOException.throwIt(ex.getReason());
private void sendCACertificate(APDU apdu)
try
// work out how many bytes to send this time and how many will be left
short remain = (short) (caCertSize - offset[OFFSET_SENT]);
boolean chain = remain > MAX_APDU;
short sendLen = chain ? MAX_APDU : remain;
// Get ready to send
apdu.setOutgoing();
apdu.setOutgoingLength(sendLen);
apdu.sendBytesLong(caCertBuffer, offset[OFFSET_SENT], sendLen);
// Check to see if there are more APDU's to send
if (chain)
offset[OFFSET_SENT] += sendLen; // count the bytes sent
ISOException.throwIt(ISO7816.SW_BYTES_REMAINING_00); // indicate there are more bytes to come
else
offset[OFFSET_SENT] = 0; // no more bytes to send
catch( APDUException ex)
ISOException.throwIt(ex.getReason());
}And the output is:
CA certificate Endoding before sending:
In HEX (30820283308201ec020900f730a523693d4eeb300d06092a864886f70d0101050500308185310b300906035504061302504b310f300d06035504080c0650756e6a61623112301006035504070c0949736c616d61626164310e300c060355040a0c055345454353310b3009060355040b0c0249543110300e06035504030c0769766f69746e673122302006092a864886f70d01090116136d2e756d65724073656563732e6564752e706b301e170d3131303332353130313031315a170d3132303332343130313031315a308185310b300906035504061302504b310f300d06035504080c0650756e6a61623112301006035504070c0949736c616d61626164310e300c060355040a0c055345454353310b3009060355040b0c0249543110300e06035504030c0769766f69746e673122302006092a864886f70d01090116136d2e756d65724073656563732e6564752e706b30819f300d06092a864886f70d010101050003818d0030818902818100c72ee8ae34047681fa90e150c7f9ba36c6165cba6d907f7ce1ff29c810661b04b6e531d866842dceac910e969e84eabe5083d635e6fe91a0417e44971c30771ac051a6853fdbb090635d6063081ac8228f7b9bfdf8eb7622403bc5a15425f71307af75b56f27b5f51a1a88c9d43e3b1012b41e0d5e472df17a79b7d486fb707d0203010001300d06092a864886f70d0101050500038181005df2b166258a0af02aa816045be159d8072fe19a4cd2780dbe235220c6328c6ee5540d12720f0a797ea0cb86ca343bf64fb35c1d733e394421209f8a49192046199b321aa17042c34f90947f2a142dd637fbc3c812bdcfc95f6eeee32fa6712c5296781e2398c85b5fcd69010a86bf1e9321fa7b40a5dc1adeef8bf0367426c3)
total size of the CA certificate is: 647
In HEX (30820283308201ec020900f730a523693d4eeb300d06092a864886f70d0101050500308185310b300906035504061302504b310f300d06035504080c0650756e6a61623112301006035504070c0949736c616d61626164310e300c060355040a0c055345454353310b3009060355040b0c0249543110300e06035504030c0769766f69746e673122302006092a864886f70d01090116136d2e756d65724073656563732e6564752e706b301e170d3131303332353130313031315a170d3132303332343130313031315a308185310b300906035504061302504b310f300d06035504080c0650756e6a61623112301006035504070c0949736c616d61626164)255 bytes received::Response from card (cert):28416::6f00
java.security.cert.CertificateException: Could not parse certificate: java.io.EOFException
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:109)
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:305)
at smarcard.host.app.SmartCardHostApp.getCACertificate(SmartCardHostApp.java:571)
at smarcard.host.app.SmartCardHostApp.main(SmartCardHostApp.java:676)
Caused by: java.io.EOFException
at java.io.DataInputStream.readFully(DataInputStream.java:180)
at java.io.DataInputStream.readFully(DataInputStream.java:152)
at sun.security.util.DerValue.init(DerValue.java:374)
at sun.security.util.DerValue.<init>(DerValue.java:302)
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:104)
... 3 moreEdited by: Muhammad Umer on Apr 29, 2011 3:16 PM
Similar Messages
-
Getting current directory from an applet
Hi. How can I get the current directory of my applet running on web without having to worry about permissin. I used the one below:
curDir = System.getProperty("user.dir");
but I get this error:
ava.security.AccessControlException: access denied (java.util.PropertyPermission user.dir read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
any substiture for this? Thanks.You should be using URLs or similar approaches, and avoiding File, which will
never work with an ordinary applet.
InputStream in = this.getClass().getResourceAsStream("file.txt");That assumes the txt file is in the same place as the current classes .class file.
For example, the same folder or that they are jarred in the same "folder" in the jar.
You can also use a URL directly:
URL url = ...
InputStream in = url.openStream();and you can construct that URL with the help of Applet methods getDocumentBase or getCodeBase:
URL url = new URL(this.getDocumentBase(), "file.txt");That assumes the txt file is in the same folder as the html file in which the applet is embedded. -
Getting a String from an applet method
I'm writing a page where a user enters the location of a local file and lets an applet calculate a binary hash of the file contents. I want the applet to give the hash string back to an empty textfield.
The code I'm using is:
<script language="JavaScript">
function hash() {
var test;
test = document.FtpApplet.hash('E:\downloadz\mysql-4.0.12-win.zip');
document.form.hash.value = test;
</script>
<FORM name="FTForm" method="post" action="#">
<input type="button" value="Send" onClick="document.FtpApplet.upload();"><br>
<input type="button" value="Hash" onClick="hash()"><br>
<input type="text" name="hash"> ...
My applet contains a ordinary public method giving back a string.
In IE6 I get a runtime error pointing to the hash() function. In Netscape7/Mozilla 1.3 nothing happens at all. I'm using the latest version of the java plug-in in all my browsers.
Could anyone help me out?You should try to find a javascript forum.
-
How to get IP address from java applet
is there anyway to find the IP address of a person who is on java applet on some chatting website (not me, but the other users)...... well, this question may sound stupid, but am actually new to this, so please help.
:)>
is there anyway to find the IP address of a person who is on java applet on some chatting website (not me, but the other users)...... >Sure. Ask whoever it is you are chatting to.. "wots ur ip?". Do not be surprised when they 'tell you where to go'. -
Sumwun mus no !! Getting NT domain from within applet
You can get the NT users name using System.getProperty("user.name") but is there a way of getting the NT domain that the user is logged on to ?
Yo my brother, dont ya think dis is not da right plaze 4 using ghetto slang ?
Anyway, i dont think you can do this for security reasons - you have to use JNI to call system properites out of a win32 dll. -
Can someone tell me how to export Server certs from Sun One Directory Server 5.2 P6. There are options for Details, renew request, install and delete. But i dont find one for exporting the certificate. Any help on this would be greatly appreciated.
Thanks!Outside of the tools you'd have with a 5.2 instance, including certutil (certutil -L -d /your/cert/path cert-alias) you can also use openssl to get the cert from any server. You'd run openssl s_client -connect yourhostname.domain.com:636 and it would make a connection to the server on the LDAPS port and returned in the output would be they SSL cert in ascii format you could then move somewhere else or just have it around for safe keeping. Hope that helps.
-
Aud2 ZS platnm I get I/O from front panel, but no output from REAR OF CA
I had a Audigy2 in my Dell, worked fine. I needed MORE I/O ports. I got a Audigy2 ZS platinum for the front panel (extra I/O) front panel works fine, sound card sounds fine, all is well - except I get no output from the back of the card. (certainly this isn't a "front OR rear" sort of thing?)
About ready to return it.I DO get digital output from the front and back (front panel on front of Dell) and back of card. I don't get ANALOG output from card. I thought I recall a selecti've click box in the software that said "digital only" where is that. (I HATE creatives software - SO MANY LITTLE UTIL PROGRAMS THAT DO LITTLE OR NOTHING EACH) you have to HUNT through them all to find the option you need.
-
Applet does not get client certificate from browser (Firefox, IE7)
I'm writing a web service which runs Tomcat through Apache. One critical requirement is that the service be able to invoke certain device drivers on the end user's machine. Fortunately, there is a Java API for this, so this requirement can be fulfilled using an applet.
Here's the problem. This is a B2B application, so we're using SSL and requiring client authentication. I'm no web security guru, but I managed to get SSL set up through Apache (with a self-signed certificate for now; we'll get a real one from a real CA when we're ready to go to production). I also managed to set up client authentication by creating my own CA and generating a client certificate, which I then copied to my test client (Win XPSP2) and imported into both Firefox (2.0.0.15) and IE (6.0.2900). The applet is signed with a real certificate, and that causes no problems. And all of the pages for my web service work as expected.
All except one. The page which is supposed to load the applet pops a dialog stating 'Identification required. Please select certificate to be used for authentication', and presents a list of zero certificates.
Actually, I get this dialog in Firefox on my XPSP2 box, and also when I test on a Vista Home Premium box running IE 7.0.6000. Puzzlingly, this behavior does NOT occur on my XPSP2 box when running through IE 6.0. It seems that with XPSP2 and IE 6.0, the JVM can manage to obtain the required client certificate from the browser and pass it along to Apache, but the JVM can't do this when running in Firefox or in IE 7.0 on Vista.
I have gone to the Java Control Panel and verified that the 'Use certificates and keys in browser keystore' option is selected on both boxes.
I've done a fair amount of research for this (including in this forum) and see that this appears to be a chronic difficulty with applets. What makes it worse is that I don't think I can use the standard workaround, which is to download the applet from a different host/virtual host, because the applet needs to communicate with the web service. Since we have the additional layer of Tomcat container-managed user authentication, the applet needs to be communicating with the server using the same session token as everything else.
So at this point, I'm stuck. Does anyone know a solution to this problem? Two thoughts (I'm reaching at straws here):
1) I have the certificate imported in both Firefox and IE as a 'personal' certificate. Is there someplace else I can put it so the JVM will know how to find it? A rather old thread in this forum mentioned something about setting properties in the Java Control Panel, but I see no place in the JCP to specify such properties, so I'm guessing that solution is no longer operative.
2) I'm using a trick I found on the internet to make the applet load cleanly with both Firefox and IE, namely, I'm using the <OBJECT> tag to specify the applet class and codebase for IE, and then using <COMMENT><EMBED ... /></COMMENT> within the <OBJECT> declaration to specify the information for Firefox. Is there some other way of doing the markup that will give the JVM a hint that it should get a certificate from the browser?
BTW . . . I would hate to drop support for Firefox, but if someone has an IE-only solution, I'll take it. Unfortunately, I reckon a Firefox-only solution would not fly.
Thanks all.My applet is also signed by a valid certificate. The question of whether the applet is signed/self-signed/unsigned >isn't an issue --- I just wanted you to make sure the Applet runs because it is a know valid Java2 Applet that is 100% signed properly and verified to run.
This eliminates the possibility that it is a JVM issue. However after reading your message further I am afraid
it is not relevant to your issue.
due to the client authentication, my browser (Firefox, IE7) refuses to even download the applet.
I went to your site, and I can see your applet in both Firefox and IE6. However, I don't believe your site is set up >quite like mine, because it appears I can run your applet whether I have imported your X509 certificate or not. What I >did was:If that is true we are all dead :) No I think you just missed the cert in the IE databse. It doesn't have to be in the
Applet database to function. Surprise!
Check your IE/tools/internet options/content tab/certificates/trusted root certification authorities.
I then opened the Java control panel and verified that the certificate isn't listed there, either. So unless the certificate >is being cached/read from some other location (which could be, this certificate stuff is largely black magic to me), >then your server isn't requiring client authentication, either accidentally or by design.No HyperView is a valid java2 Applet and actually writes to a file "hyperview.dat" though it is probably empty.
If you click on a component in the view and then on the view and type "dumpgobs" it shoud write out some data about the current graphics objects so you can see it has complete read/write access..
Further it opens up a complete NIO server ands starts listening for connections on a random port
(Echoed in your java console) You can connect to it with telnet and watch impressive ping messages all day :)
This all goes back to a few years BTW back before there was a plugin and there was only Netscape & IE.
There are actually 2 certificate databases and what loads where depends on which type of cert you are using. Now self signed or not doesn't matter but what does matter is the type of certificate. IE: is it RSA/DSA/Sha1
etc. The Netscape DB was a Berkley DB and MS used whatever they use. The Cert is a DSA/Sha1 cert
which I like the best ATM as it (X fingers it stays so) always has worked.
Sadly that tidbit doesn't help you either I am afraid.
What I'm trying to do is require client authentication through Apache by including the following markup in a virtual >host definition:
SSLCACertificateFile D:/Certificates/ca.crt
SSLVerifyClient require
SSLVerifyDepth 1You got me there I avoid markup at all costs and only code in C java and assembler :)
Now unless I am wrong I think you are saying that you want the Applet to push the certificate to the server
automatically and I don't think this happens. Least I have never heard of this happening from an Applet automatically.
On my client machine, I have a certificate which was generated using OpenSSL and the ca.crt file listed. Testing >shows that the server is requiring a certificate from the client, and the web browser is always providing it.
The problem is that when the browser fires up the Java plugin to run an applet, there is not sufficient communication >between the browser and the plugin so that the plugin can obtain the certificate from the browser and provide it to >the server.
So the server refuses to send the applet bytecode to the JVM, and we're stuck.In terms of implementation ease I think you may have the cart before the horse because I think it would be far easier to run an Applet in the first place to do the authentication, and then send, for example, a jar file to bootstrap and run
(or some classes) in the event the connection is valid. Then again one never knows it all and there may be some classes which enables the plugin as you wish. I have never heard of this being done with the plugin the way you suggest.
I am thinking maybe there is another method of doing this I do not know.
Did you try pushing the cert via JavaScript/LIveConnect?? That way it could run before the Applet and do the authentication.
Maybe someone else has other ideas; did you try the security forum??
Sorry but I am afraid that is not much help.
I did snarf this tidbit which may have some relevance
The current fix for this bug in Mantis and 1.4.1_02 is using JSSE API, Here are the step:
In Java control panel, Advanced tab -> Java Runtime Parameters, specify:
-Djavax.net.ssl.keyStore=<name and path to client keystore file>
-Djavax.net.ssl.keyStorePassword=<password to access this client keystore file>
If it is a PKCS12 format keystore, specify:
-Djavax.net.ssl.keyStoreType=PKCS12
In our future JRE release 1.5, we will create our own client authentication keystore file for JPI and use that for client authentication, for detail info, please see RFE 4797512.
Dennis
Posted Date : 2005-07-28 19:55:50.0Good Luck!
Sincerely:
(T)
Edited by: tswain on 23-Jul-2008 10:07 AM -
I create my apple id from my boyfriend macbook and its says that I have to review my itunes information , when I get to the credit card number info etc. Its keep asking me for that I dont have any credit card and I dont want to put any , what should I do?
You cannot use that ID without a credit card. You did not create your account correctly. There is very specific way in which you must create your account if you do not want to use a credit card. If you don't have a credit card, you will have to start all over again.
1. You will have to sign out of that ID before you can create a new one. Settings>iTunes & App Store>Apple ID>Sign out.
2. You cannot use the email address that you used for the first ID that you created. You will need to use another email address now
3. You have to download a free app in order to start the new Apple ID process.
Read this before proceeding.
http://support.apple.com/kb/HT2534 -
I just upgraded to Snow Leopard, and I have Aperture 3.1.3. Now after I import pics from my camera I get a dialogue box so large that I can't see the eject card button. Consequently, I can't get rid of the dialogue box without having to do a force quit on Aperture. How do I fix?
I can drag the dialog box, but I can't move it up far enough to get to the eject card button. The dialogue box contains all the jpeg Numbers I am trying to upload. It has never done that before. It used to be just a smal dialogue box with no jpeg numbers in it.
It is even difficult to get to the Finder with the Dialague box is open. I have to force quit aperture.
Any ideas would be appreciated. -
I spilled some red wine on my keyboard and i cannot connect to the internet any more. it says on the internet icon: Wi-fi: no harware installes. so i guess i need to get a new wifi card for my mac air. do i have to buy this from a apple store? i live fare away from an apple store. Also, I do have a macbook with software system:
System Version: Mac OS X 10.6.8 (10K549). can I take out the wifi card from that mack and use that one for my mac air?Welcome to Apple Support Communities
Consider yourself lucky that your MacBook is still working. Now, turn it off. Wine may have damaged other parts of your computer.
Then, take the MacBook to an Apple Store or reseller. It will be a very expensive repair, as it's not covered by warranty and the logic board has to be replaced. In some cases, it may be better to get a new MacBook.
If you can't take it to an Apple Store, contact with Apple > http://support.apple.com/kb/HE57 -
How to get input from card reader
hi, everyone,
I have a project, which needs me to get input from card reader. My terminal input is IBM POS system, but it didnot provide the API to get the input. How can I get the input? Need your help so much! and thanks a lotNow this is a wild idea.... how about searching the IBM site for technical information ?
-
Getting list of cert from browser
Hello,
I would like to get the list of certificate in the different stores of my web browser (internet explorer, firefox, ...). I know how to get the list of certs from a java keystore, but I have no idea about getting list of cert from browser.
Please help!
ThanksA little tough.
On Windows, you can use Windows-MY and Windows-Root storetypes to access those 2 stores in IE.
For Firefox keystores, you can use the PKCS11 storetype to access the NSS keystore.
Google yourself for details. -
What is the process of the SunMSCAPI getting a cert's alias from windows?
Hi:
This problem comes from a older problem ( http://forums.sun.com/thread.jspa?threadID=5374874&tstart=0 ) .
Unfortunately, this problem seems like not a popular problem :-(
Is there anybody can access the souce code of SunMSCAPI, and give me some hint about the process of SunMSCAPI getting a cert's alias from windows's keystore by calling CryptoAPI? So, I can simulate the process to find out the problem's reason.
Thanks a lot.http://hg.openjdk.java.net/jdk7/tl/jdk/file/2dae30c4d687/src/windows/native/sun/security/mscapi/
http://hg.openjdk.java.net/jdk7/tl/jdk/file/2dae30c4d687/src/windows/classes/sun/security/mscapi/ -
How to get hold of the JavaFX applet in some java code called from it
I have a scenario where I am trying to reuse some java libraries that existed before and used the Applet API. In order to give a new UI to these APIs I am redesigning the front end using JavaFX. I can create instances of java classes from these old libraries. Methods on these old classes take java.applet.Applet as an argument.
When the JavaFX applet is deployed as an applet, how can one get hold of the corresponding Applet object?
Thanks in advance.When run as an applet, FX.getArgument("javafx.applet") will return the JApplet instance.
Maybe you are looking for
-
PS3 Freezing and can't connect the wifi
First of all I was playing Minecraft then I had a error code (forgot which one) and I was signed out of PSN and I my wifi could not connect to my PS3 and i did the connection test all over Youtube and for hours I was sitting in front of the T.V. don'
-
Can I access icloud with more than one Apple ID account on an ipod touch?
I just bought a new ipod touch and would like to know if I can download past purchases from my fiances Apple ID account using icloud on the ipod touch we are going to share because I am having a problem with being unable to authorize the one macbook
-
so my old laptop was a HP pavilion Vista. And my new laptop is a samsung windows 7. I pluged my ipod in as usual, transfered all purchases, yet all that got moved into my library was just what was stored on my ipod at the time, I had authorised my ne
-
Officejet Pro 8600 won't print PDF's
Just bought a new OJP 8600 (3rd HP printer in a year, starting to get VERY frustrated). I've searched through all of the forums, all over the internet and cannot find a solution. I'm on a Mac OSX 10.9.3. I can't print any PDF files either through Ac
-
I have a new iPhone - 5c, if I back my info onto iCloud is that enough so I don't loose my info when switching phones?