path: root/security/src/test/impl/java/org/apache/harmony/security/tests/java/security/cert/CertificateFactory_ImplTest.java

/*
 *  Licensed to the Apache Software Foundation (ASF) under one or more
 *  contributor license agreements.  See the NOTICE file distributed with
 *  this work for additional information regarding copyright ownership.
 *  The ASF licenses this file to You under the Apache License, Version 2.0
 *  (the "License"); you may not use this file except in compliance with
 *  the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

/**
 * @author Alexander Y. Kleymenov
 */

package org.apache.harmony.security.tests.java.security.cert;

import java.io.ByteArrayInputStream;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PublicKey;
import java.security.cert.CertPath;
import java.security.cert.CertificateFactory;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.security.spec.X509EncodedKeySpec;
import java.util.Collection;
import java.util.Iterator;
import java.util.List;
import org.apache.harmony.luni.util.Base64;

import junit.framework.TestCase;

/**
 * X.509 CertificateFactory provider implementation test.<br>
 * See RFC 3280 (http://www.ietf.org/rfc/rfc3280.txt) for
 * more information on X.509, and
 * http://www.ietf.org/rfc/rfc2315.txt
 * for more information on PKCS #7.
 * The testing data was generated by use of classes from
 * org.apache.harmony.security.x509 package.
 */
public class CertificateFactory_ImplTest extends TestCase {

    /**
     * Base64 encoded PKCS7 SignedObject containing two X.509
     * Certificates and CRLs.
     */
    private static String pkcs7so =
            "MIIHDwYJKoZIhvcNAQcCoIIHADCCBvwCAQExADALBgkqhkiG9w0BBwGg"
                    + "ggUuMIICkzCCAlOgAwIBAgICAiswCQYHKoZIzjgEAzAdMRswGQYDVQQK"
                    + "ExJDZXJ0aWZpY2F0ZSBJc3N1ZXIwIxcNMDYwOTA1MDk1MzA2WhgSMjMz"
                    + "NjEwMTMwMjUxMjcuODFaMB0xGzAZBgNVBAoTEkNlcnRpZmljYXRlIElz"
                    + "c3VlcjCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu"
                    + "7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeB"
                    + "O4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD"
                    + "9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8VIwvM"
                    + "spK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX"
                    + "TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqL"
                    + "VHyNKOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4Vrl"
                    + "nwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQDyCA7AK6Kep2soxt8tIsWW"
                    + "kafbYdueAkeBNnm46H0OteFa80HMuJjKJ0LjlPrdjFMARKyW/GATtQhg"
                    + "hY/MrINAHmKcX5QjL1DkuJKDNggLHqj5D6efsWmLKwLvmviWLzWtjh7Y"
                    + "GBZeLt0ezu2q49aKcOzkkDsCSsMz09u9284L6qMeMBwwGgYDVR0RAQH/"
                    + "BBAwDoEMcmZjQDgyMi5OYW1lMAkGByqGSM44BAMDLwAwLAIUWo0C+R8P"
                    + "J8LGSLsCRqJ8SOOO0SoCFGvO6mpNdzOKiwlYwfpF/Xyi7s3vMIICkzCC"
                    + "AlOgAwIBAgICAiswCQYHKoZIzjgEAzAdMRswGQYDVQQKExJDZXJ0aWZp"
                    + "Y2F0ZSBJc3N1ZXIwIxcNMDYwOTA1MDk1MzA2WhgSMjMzNjEwMTMwMjUx"
                    + "MjcuODFaMB0xGzAZBgNVBAoTEkNlcnRpZmljYXRlIElzc3VlcjCCAbgw"
                    + "ggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3Ujzv"
                    + "RADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3"
                    + "a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQT"
                    + "WhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvw"
                    + "WBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlXTAs9B4JnUVlX"
                    + "jrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4r"
                    + "s6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtV"
                    + "JWQBTDv+z0kqA4GFAAKBgQDyCA7AK6Kep2soxt8tIsWWkafbYdueAkeB"
                    + "Nnm46H0OteFa80HMuJjKJ0LjlPrdjFMARKyW/GATtQhghY/MrINAHmKc"
                    + "X5QjL1DkuJKDNggLHqj5D6efsWmLKwLvmviWLzWtjh7YGBZeLt0ezu2q"
                    + "49aKcOzkkDsCSsMz09u9284L6qMeMBwwGgYDVR0RAQH/BBAwDoEMcmZj"
                    + "QDgyMi5OYW1lMAkGByqGSM44BAMDLwAwLAIUWo0C+R8PJ8LGSLsCRqJ8"
                    + "SOOO0SoCFGvO6mpNdzOKiwlYwfpF/Xyi7s3voYIBsjCB1jCBlwIBATAJ"
                    + "BgcqhkjOOAQDMBUxEzARBgNVBAoTCkNSTCBJc3N1ZXIXDTA2MDkwNTA5"
                    + "NTMwN1oXDTA2MDkwNTA5NTQ0N1owQTA/AgICKxcNMDYwOTA1MDk1MzA4"
                    + "WjAqMAoGA1UdFQQDCgEBMBwGA1UdGAQVGBMyMDA2MDkwNTA5NTMwNy43"
                    + "MThaoA8wDTALBgNVHRQEBAICEVwwCQYHKoZIzjgEAwMvADAsAhR/l5kI"
                    + "bTkuJe9HjcpZ4Ff4Ifv9xwIUIXBlDKsNFlgYdWWTxzrrJOHyMuUwgdYw"
                    + "gZcCAQEwCQYHKoZIzjgEAzAVMRMwEQYDVQQKEwpDUkwgSXNzdWVyFw0w"
                    + "NjA5MDUwOTUzMDdaFw0wNjA5MDUwOTU0NDdaMEEwPwICAisXDTA2MDkw"
                    + "NTA5NTMwOFowKjAKBgNVHRUEAwoBATAcBgNVHRgEFRgTMjAwNjA5MDUw"
                    + "OTUzMDcuNzE4WqAPMA0wCwYDVR0UBAQCAhFcMAkGByqGSM44BAMDLwAw"
                    + "LAIUf5eZCG05LiXvR43KWeBX+CH7/ccCFCFwZQyrDRZYGHVlk8c66yTh"
                    + "8jLlMQA=";

    /**
     * Base64 encoded PkiPath object containing 2 X.509 certificates.
     */
    private static String pkiPath =
            "MIIFMDCCApQwggJToAMCAQICAgIrMAkGByqGSM44BAMwHTEbMBkGA1UE"
                    + "ChMSQ2VydGlmaWNhdGUgSXNzdWVyMCMXDTA2MDkwNTExMDAyM1oYEjIz"
                    + "MzYxMDEzMTQwNDE4LjEyWjAdMRswGQYDVQQKExJDZXJ0aWZpY2F0ZSBJ"
                    + "c3N1ZXIwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qc"
                    + "Luzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzX"
                    + "gTuAHTRv8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7"
                    + "g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZndFIAccCFQCXYFCPFSML"
                    + "zLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSvu/o66oL5"
                    + "V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6"
                    + "i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa"
                    + "5Z8GkotmXoB7VSVkAUw7/s9JKgOBhQACgYEA8ggOwCuinqdrKMbfLSLF"
                    + "lpGn22HbngJHgTZ5uOh9DrXhWvNBzLiYyidC45T63YxTAESslvxgE7UI"
                    + "YIWPzKyDQB5inF+UIy9Q5LiSgzYICx6o+Q+nn7FpiysC75r4li81rY4e"
                    + "2BgWXi7dHs7tquPWinDs5JA7AkrDM9PbvdvOC+qjHjAcMBoGA1UdEQEB"
                    + "/wQQMA6BDHJmY0A4MjIuTmFtZTAJBgcqhkjOOAQDAzAAMC0CFQCAUA72"
                    + "3BIXNluugYcScXeb9vx5vAIUYreCA5ljANvzSsD0ofI+xph4//IwggKU"
                    + "MIICU6ADAgECAgICKzAJBgcqhkjOOAQDMB0xGzAZBgNVBAoTEkNlcnRp"
                    + "ZmljYXRlIElzc3VlcjAjFw0wNjA5MDUxMTAwMjNaGBIyMzM2MTAxMzE0"
                    + "MDQxOC4xMlowHTEbMBkGA1UEChMSQ2VydGlmaWNhdGUgSXNzdWVyMIIB"
                    + "uDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdS"
                    + "PO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/Jm"
                    + "YLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1"
                    + "VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuE"
                    + "C/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdR"
                    + "WVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOu"
                    + "HiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6A"
                    + "e1UlZAFMO/7PSSoDgYUAAoGBAPIIDsArop6nayjG3y0ixZaRp9th254C"
                    + "R4E2ebjofQ614VrzQcy4mMonQuOU+t2MUwBErJb8YBO1CGCFj8ysg0Ae"
                    + "YpxflCMvUOS4koM2CAseqPkPp5+xaYsrAu+a+JYvNa2OHtgYFl4u3R7O"
                    + "7arj1opw7OSQOwJKwzPT273bzgvqox4wHDAaBgNVHREBAf8EEDAOgQxy"
                    + "ZmNAODIyLk5hbWUwCQYHKoZIzjgEAwMwADAtAhUAgFAO9twSFzZbroGH"
                    + "EnF3m/b8ebwCFGK3ggOZYwDb80rA9KHyPsaYeP/y";

    /**
     * Base64 encoded X.509 CRL.
     */
    private static String x509crl =
            "MIHWMIGWAgEBMAkGByqGSM44BAMwFTETMBEGA1UEChMKQ1JMIElzc3Vl"
                    + "chcNMDYwOTA1MDk1MzA4WhcNMDYwOTA1MDk1NDQ4WjBAMD4CAgIrFw0w"
                    + "NjA5MDUwOTUzMDhaMCkwCgYDVR0VBAMKAQEwGwYDVR0YBBQYEjIwMDYw"
                    + "OTA1MDk1MzA4Ljg5WqAPMA0wCwYDVR0UBAQCAhFcMAkGByqGSM44BAMD"
                    + "MAAwLQIUJ1KAJumw8mOpGXT/FS5K9WwOBRICFQCR+ez59x9GH3sKoByC"
                    + "IooeR20Q3Q==";

    /**
     * Base64 encoded X.509 Certificate.
     */
    private static String x509cert =
            "MIICkzCCAlOgAwIBAgICAiswCQYHKoZIzjgEAzAdMRswGQYDVQQKExJD"
                    + "ZXJ0aWZpY2F0ZSBJc3N1ZXIwIxcNMDYwOTA4MDU1NzUxWhgSMjMzNjEx"
                    + "MTAxMTM4NTUuNjJaMB0xGzAZBgNVBAoTEkNlcnRpZmljYXRlIElzc3Vl"
                    + "cjCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn"
                    + "9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4Ad"
                    + "NG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPF"
                    + "HsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5"
                    + "gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlXTAs9"
                    + "B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyN"
                    + "KOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaS"
                    + "i2ZegHtVJWQBTDv+z0kqA4GFAAKBgQDyCA7AK6Kep2soxt8tIsWWkafb"
                    + "YdueAkeBNnm46H0OteFa80HMuJjKJ0LjlPrdjFMARKyW/GATtQhghY/M"
                    + "rINAHmKcX5QjL1DkuJKDNggLHqj5D6efsWmLKwLvmviWLzWtjh7YGBZe"
                    + "Lt0ezu2q49aKcOzkkDsCSsMz09u9284L6qMeMBwwGgYDVR0RAQH/BBAw"
                    + "DoEMcmZjQDgyMi5OYW1lMAkGByqGSM44BAMDLwAwLAIUO+JWKWai/8Si"
                    + "2oEfhKSobLttYeYCFFO5YVDvtnmVVnvQTtUvrPpsaxJR";

    /**
     * Base64 encoded Private Key used for data signing.
     * This data is not directly used in the test, but it could be
     * useful in future in case of implementation of additional
     * testing data structures.
     */
    private static String b64PrivateKeySpec =
            "MIIBSwIBADCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s"
                    + "5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7"
                    + "gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P2"
                    + "08UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yy"
                    + "krmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdM"
                    + "Cz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotU"
                    + "fI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWf"
                    + "BpKLZl6Ae1UlZAFMO/7PSSoEFgIUS24w346zv1ic3wsLOHzxQnf9aX0=";

    /**
     * Base64 encoded Public Key for signature verification.
     */
    private static String b64PublicKeySpec =
            "MIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2"
                    + "EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00"
                    + "b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208Ue"
                    + "wwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmC"
                    + "ouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0H"
                    + "gmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o"
                    + "4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKL"
                    + "Zl6Ae1UlZAFMO/7PSSoDgYUAAoGBAPIIDsArop6nayjG3y0ixZaRp9th"
                    + "254CR4E2ebjofQ614VrzQcy4mMonQuOU+t2MUwBErJb8YBO1CGCFj8ys"
                    + "g0AeYpxflCMvUOS4koM2CAseqPkPp5+xaYsrAu+a+JYvNa2OHtgYFl4u"
                    + "3R7O7arj1opw7OSQOwJKwzPT273bzgvq";

    /**
     * The name of the algorithm used for Certificate/CRL signing.
     */
    private static String publicKeyAlgorithm = "DSA";

    /**
     * The public key to verify generated Certificates and CRLs.
     */
    private static PublicKey publicKey;

    static {
        try {
            X509EncodedKeySpec publicKeySpec =
                    new X509EncodedKeySpec(
                            Base64.decode(b64PublicKeySpec.getBytes("UTF-8")));
            KeyFactory keyFactory =
                    KeyFactory.getInstance(publicKeyAlgorithm);
            publicKey = keyFactory.generatePublic(publicKeySpec);
        } catch (NoSuchAlgorithmException e) {
            // provider is not installed, will not verify the generated data
            publicKey = null;
        } catch (Exception e) {
            // problems with a representation of the key
            e.printStackTrace();
            publicKey = null;
        }
    }

    // array contains allowed PEM delimiters
    private static String[][] good = {
            { "-----BEGIN\n", "\n-----END" },
            { "-----BEGIN-----\n", "\n-----END-----" },
            { "-----BEGIN PEM ENCODED DATA STRUCTURE-----\n", "\n-----END-----" },
            { "-----BEGIN MEANINGLESS SEPARATOR\n", "\n-----END PEM" },
    };

    // array contains not allowed PEM delimiters
    private static String[][] bad = {
            { "----BEGI\n", "\n-----END" },
            { "-----BEGI\n", "\n----END" },
            { "-----BEGI\n", "\n-----END" },
            { "-----BEGIN\n", "\n-----EN" },
            { "-----BEGIN", "\n-----END" },
            { "-----BEGIN\n", "-----END" },
    };

    // array contains bad PEM encoded content.
    private static String[] bad_content = {
            "MIIHDwYJ", "ABCD", "\r\n\r\n", "\n\r", ""
    };

    /**
     * generateCRLs method testing.
     * Generates CRLs on the base of PKCS7 SignedData Object
     */
    public void testGenerateCRLs() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        // Testing the CRLs generation on the base of PKCS7 SignedData object
        ByteArrayInputStream bais = new ByteArrayInputStream(
                Base64.decode(pkcs7so.getBytes("UTF-8")));

        Collection crls = factory.generateCRLs(bais);
        assertNotNull("Factory returned null on correct PKCS7 data", crls);
        assertEquals("The size of collection differs from expected",
                2, crls.size());

        if (publicKey != null) {
            // verify the signatures
            for (Iterator i = crls.iterator(); i.hasNext(); ) {
                ((X509CRL) i.next()).verify(publicKey);
            }
        }
    }

    /**
     * generateCRL/generateCertificate method testing.
     * Tries to generates single CRL/Certificate
     * on the base of PKCS7 SignedData Object.
     */
    public void testGenerateCRL() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        ByteArrayInputStream bais = new ByteArrayInputStream(
                Base64.decode(pkcs7so.getBytes("UTF-8")));
        try {
            factory.generateCRL(bais);
            fail("Expected exception was not thrown");
        } catch (Exception e) {
        }
        bais = new ByteArrayInputStream(Base64.decode(pkcs7so.getBytes("UTF-8")));
        try {
            factory.generateCertificate(bais);
            fail("Expected exception was not thrown");
        } catch (Exception e) {
        }
    }

    /**
     * Generates CRLs on the base of PEM encoding.
     */
    public void testGenerateBase64CRL() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");
        ByteArrayInputStream bais;

        for (int i = 0; i < good.length; i++) {
            bais = new ByteArrayInputStream(
                    (good[i][0] + x509crl + good[i][1]).getBytes("UTF-8"));

            X509CRL crl = (X509CRL) factory.generateCRL(bais);
            assertNotNull("Factory returned null on correct data", crl);

            if (publicKey != null) {
                // verify the signatures
                crl.verify(publicKey);
            }
        }

        for (int i = 0; i < bad_content.length; i++) {
            bais = new ByteArrayInputStream(
                    (good[0][0] + bad_content[i] + good[0][1]).getBytes("UTF-8"));
            try {
                factory.generateCRL(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
                // e.printStackTrace();
            }
        }

        for (int i = 0; i < bad.length; i++) {
            bais = new ByteArrayInputStream(
                    (bad[i][0] + x509crl + bad[i][1]).getBytes("UTF-8"));
            try {
                factory.generateCRL(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
        }
    }

    private void verifyCRLs(Collection crls) throws Exception {
        if (publicKey != null) {
            // verify the signatures
            for (Iterator it = crls.iterator(); it.hasNext(); ) {
                ((X509CRL) it.next()).verify(publicKey);
            }
        }
    }

    ;

    private void verifyCertificates(Collection certs) throws Exception {
        if (publicKey != null) {
            // verify the signatures
            for (Iterator it = certs.iterator(); it.hasNext(); ) {
                ((X509Certificate) it.next()).verify(publicKey);
            }
        }
    }

    ;

    /**
     * generateCRLs method testing.
     * Generates CRLs on the base of consequent
     * PEM X.509(ASN.1)/X.509(ASN.1)/PKCS7 forms.
     */
    public void testGenerateBase64CRLs() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        // ------------------------ Test Data -----------------------------
        // encoding describing codes
        int pem_x509 = 0, asn_x509 = 1, pem_pkcs = 2, asn_pkcs = 3,
                bad = 4, npe_bad = 5, npe_bad2 = 6, num_of_variants = 7;
        // error code, marks sequences as throwing exceptions
        int error = 999;
        // test sequences
        int[][] sequences = {
                { pem_x509, pem_x509 },
                { pem_x509, asn_x509 },
                { pem_x509, asn_x509, pem_x509 },
                { asn_x509, asn_x509 },
                { asn_x509, pem_x509 },
                { asn_x509, pem_x509, asn_x509 },
                // -1 means that only 1 (-(-1)) CRL will be generated
                // on the base of this encodings sequence
                { -1, pem_x509, pem_pkcs },
                { -1, pem_x509, bad },
                // {-1/*-error*/, pem_x509, npe_bad2},
                // {-1/*-error*/, pem_x509, npe_bad},
                { -2, pem_pkcs, pem_x509 }, // 2 CRLs are expected
                { -2, pem_pkcs, bad },
                { -2, pem_pkcs, npe_bad },
                { -2, pem_pkcs, npe_bad2 },
                { -1, asn_x509, pem_pkcs },
                { -1, asn_x509, bad },
                // {-1/*-error*/, asn_x509, npe_bad},
                // {-1/*-error*/, asn_x509, npe_bad2},
                // exception is expected
                { -error, bad },
                { -error, bad, asn_x509 },
                { -error, npe_bad },
                { -error, npe_bad2 },
        };
        // actual encodings
        byte[][] data = new byte[num_of_variants][];
        data[pem_x509] = (good[0][0] + x509crl + good[0][1] + "\n").getBytes("UTF-8");
        data[asn_x509] = Base64.decode(x509crl.getBytes("UTF-8"));
        data[pem_pkcs] = (good[0][0] + pkcs7so + good[0][1] + "\n").getBytes("UTF-8");
        data[asn_pkcs] = Base64.decode(pkcs7so.getBytes("UTF-8"));
        data[bad] = new byte[] { 0, 1, 1, 1, 1, 1, 0, 1 };
        data[npe_bad] = new byte[] { 0, 1, 1, 1, 1, 1, 1, 0 };
        data[npe_bad2] = new byte[] { 48, 0, 3, 4, 5, 6, 7 };

        // -------------------------- Test --------------------------------
        // Tests CRL generation on the base of sequences of heterogeneous
        // data format
        for (int i = 0; i < sequences.length; i++) { // for each of the sequences..
            // expected size og generated CRL collection
            int expected_size = (sequences[i][0] < 0)
                    ? -sequences[i][0]
                    : sequences[i].length;
            // compute the size of the encoding described by sequence
            int encoding_size = 0;
            //System.out.print("Sequence:");
            for (int j = 0; j < sequences[i].length; j++) {
                //System.out.print(" "+sequences[i][j]);
                if (sequences[i][j] >= 0) {
                    encoding_size += data[sequences[i][j]].length;
                }
            }
            //System.out.println("");
            // create the encoding of described sequence
            byte[] encoding = new byte[encoding_size];
            int position = 0;
            for (int j = 0; j < sequences[i].length; j++) {
                if (sequences[i][j] >= 0) {
                    System.arraycopy(
                            data[sequences[i][j]], 0, // from
                            encoding, position, // to
                            data[sequences[i][j]].length); // length
                    position += data[sequences[i][j]].length;
                }
            }

            if (expected_size == error) { // exception throwing test
                try {
                    factory.generateCRLs(new ByteArrayInputStream(encoding));
                    fail("Expected exception was not thrown");
                } catch (Exception e) {
                }
            } else {
                Collection crls =
                        factory.generateCRLs(new ByteArrayInputStream(encoding));
                assertNotNull("Factory returned null on correct data", crls);
                assertEquals("The size of collection differs from expected",
                        expected_size, crls.size());
                verifyCRLs(crls);
            }
        }
    }

    /**
     * generateCertificates method testing.
     * Generates Certificates on the base of consequent
     * PEM X.509(ASN.1)/X.509(ASN.1)/PKCS7 forms.
     */
    public void testGenerateBase64Certificates() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        // ------------------------ Test Data -----------------------------
        // encoding describing codes
        int pem_x509 = 0, asn_x509 = 1, pem_pkcs = 2, asn_pkcs = 3,
                bad = 4, bad1 = 5, bad2 = 6, num_of_variants = 7;
        // error code, marks sequences as throwing exceptions
        int error = 999;
        // test sequences
        int[][] sequences = {
                { pem_x509, pem_x509 },
                { pem_x509, asn_x509 },
                { pem_x509, asn_x509, pem_x509 },
                { asn_x509, asn_x509 },
                { asn_x509, pem_x509 },
                { asn_x509, pem_x509, asn_x509 },
                // -1 means that only 1 (-(-1)) Certificate will be generated
                // on the base of this encodings sequence
                // {-1/*-error*/, pem_x509, pem_pkcs},
                // {-1/*-error*/, pem_x509, bad},
                { -2, pem_pkcs, pem_x509 }, // 2 Certificates are expected
                { -2, pem_pkcs, bad },
                { -2, pem_pkcs, bad1 },
                { -2, pem_pkcs, bad2 },
                // {-1/*-error*/, asn_x509, pem_pkcs},
                // {-1/*-error*/, asn_x509, bad},
                // {-1/*-error*/, asn_x509, bad1},
                // {-1/*-error*/, pem_x509, bad1},
                // {-1/*-error*/, asn_x509, bad2},
                // {-1/*-error*/, pem_x509, bad2},
                // exception is expected
                { -error, bad },
                { -error, bad, asn_x509 },
                { -error, bad1 },
                { -error, bad2 },
        };
        // actual encodings
        byte[][] data = new byte[num_of_variants][];
        data[pem_x509] = (good[0][0] + x509cert + good[0][1] + "\n").getBytes("UTF-8");
        data[asn_x509] = Base64.decode(x509cert.getBytes("UTF-8"));
        data[pem_pkcs] = (good[0][0] + pkcs7so + good[0][1] + "\n").getBytes("UTF-8");
        data[asn_pkcs] = Base64.decode(pkcs7so.getBytes("UTF-8"));
        data[bad] = new byte[] { 0, 1, 1, 1, 1, 1, 0, 1 };
        data[bad1] = new byte[] { 0, 1, 1, 1, 1, 1, 1, 0 };
        data[bad2] = new byte[] { 48, 0, 3, 4, 5, 6, 7 };

        // -------------------------- Test --------------------------------
        // Tests Certificate generation on the base of sequences of heterogeneous
        // data format
        for (int i = 0; i < sequences.length; i++) { // for each of the sequences..
            // expected size og generated Certificate collection
            int expected_size = (sequences[i][0] < 0)
                    ? -sequences[i][0]
                    : sequences[i].length;
            // compute the size of the encoding described by sequence
            int encoding_size = 0;
            //System.out.print("Sequence:");
            for (int j = 0; j < sequences[i].length; j++) {
                //System.out.print(" "+sequences[i][j]);
                if (sequences[i][j] >= 0) {
                    encoding_size += data[sequences[i][j]].length;
                }
            }
            //System.out.println("");
            // create the encoding of described sequence
            byte[] encoding = new byte[encoding_size];
            int position = 0;
            for (int j = 0; j < sequences[i].length; j++) {
                if (sequences[i][j] >= 0) {
                    System.arraycopy(
                            data[sequences[i][j]], 0, // from
                            encoding, position, // to
                            data[sequences[i][j]].length); // length
                    position += data[sequences[i][j]].length;
                }
            }

            if (expected_size == error) { // exception throwing test
                try {
                    factory.generateCertificates(new ByteArrayInputStream(encoding));
                    fail("Expected exception was not thrown");
                } catch (Exception e) {
                }
            } else {
                Collection certs =
                        factory.generateCertificates(new ByteArrayInputStream(encoding));
                assertNotNull("Factory returned null on correct data", certs);
                assertEquals("The size of collection differs from expected",
                        expected_size, certs.size());
                verifyCertificates(certs);
            }
        }
    }

    /**
     * Generates CRLs/Certificates on the base of PEM PKCS7 encoding.
     */
    public void testGenerateBase64PKCS7() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        ByteArrayInputStream bais;
        for (int i = 0; i < good.length; i++) {
            bais = new ByteArrayInputStream(
                    (good[i][0] + pkcs7so + good[i][1]).getBytes("UTF-8"));
            Collection crls = factory.generateCRLs(bais);
            assertNotNull("Factory returned null on correct PKCS7 data", crls);
            assertEquals("The size of collection differs from expected",
                    2, crls.size());
            if (publicKey != null) {
                // verify the signatures
                for (Iterator it = crls.iterator(); it.hasNext(); ) {
                    ((X509CRL) it.next()).verify(publicKey);
                }
            }
            bais = new ByteArrayInputStream(
                    (good[i][0] + pkcs7so + good[i][1]).getBytes("UTF-8"));
            Collection certs = factory.generateCertificates(bais);
            assertNotNull("Factory returned null on correct PKCS7 data", certs);
            assertEquals("The size of collection differs from expected",
                    2, certs.size());
            if (publicKey != null) {
                // verify the signatures
                for (Iterator it = certs.iterator(); it.hasNext(); ) {
                    ((X509Certificate) it.next()).verify(publicKey);
                }
            }
        }

        for (int i = 0; i < bad_content.length; i++) {
            bais = new ByteArrayInputStream(
                    (good[0][0] + bad_content[i] + good[0][1]).getBytes("UTF-8"));
            try {
                factory.generateCertificates(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
            bais = new ByteArrayInputStream(
                    (good[0][0] + bad_content[i] + good[0][1]).getBytes("UTF-8"));
            try {
                factory.generateCRLs(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
        }

        for (int i = 0; i < bad.length; i++) {
            bais = new ByteArrayInputStream(
                    (bad[i][0] + pkcs7so + bad[i][1]).getBytes("UTF-8"));
            try {
                factory.generateCRLs(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
            bais = new ByteArrayInputStream(
                    (bad[i][0] + pkcs7so + bad[i][1]).getBytes("UTF-8"));
            try {
                factory.generateCertificates(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
        }
    }

    /**
     * Generates CertPaths on the base of PEM PkiPath/PKCS7 encoding.
     */
    public void testGenerateBase64CertPath() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        ByteArrayInputStream bais;
        List certificates;
        for (int i = 0; i < good.length; i++) {
            bais = new ByteArrayInputStream(
                    (good[i][0] + pkiPath + good[i][1]).getBytes("UTF-8"));

            certificates = factory.generateCertPath(bais).getCertificates();
            assertEquals("The size of the list differs from expected",
                    2, certificates.size());

            if (publicKey != null) {
                // verify the signatures
                for (Iterator it = certificates.iterator(); it.hasNext(); ) {
                    ((X509Certificate) it.next()).verify(publicKey);
                }
            }

            bais = new ByteArrayInputStream(
                    (good[i][0] + pkiPath + good[i][1]).getBytes("UTF-8"));

            certificates =
                    factory.generateCertPath(bais, "PkiPath").getCertificates();
            assertEquals("The size of the list differs from expected",
                    2, certificates.size());

            if (publicKey != null) {
                // verify the signatures
                for (Iterator it = certificates.iterator(); it.hasNext(); ) {
                    ((X509Certificate) it.next()).verify(publicKey);
                }
            }

            bais = new ByteArrayInputStream(
                    (good[i][0] + pkcs7so + good[i][1]).getBytes("UTF-8"));

            certificates =
                    factory.generateCertPath(bais, "PKCS7").getCertificates();
            assertEquals("The size of the list differs from expected",
                    2, certificates.size());

            if (publicKey != null) {
                // verify the signatures
                for (Iterator it = certificates.iterator(); it.hasNext(); ) {
                    ((X509Certificate) it.next()).verify(publicKey);
                }
            }
        }

        // testing empty PkiPath structure (ASN.1 such as 0x30, 0x00)
        bais = new ByteArrayInputStream(
                (good[0][0] + "MAB=" + good[0][1]).getBytes("UTF-8")); // "MABCDEFG"
        assertEquals("The size of the list differs from expected",
                0, factory.generateCertPath(bais, "PkiPath")
                .getCertificates().size());

        // testing with bad PEM content
        for (int i = 0; i < bad_content.length; i++) {
            bais = new ByteArrayInputStream(
                    (good[0][0] + bad_content[i] + good[0][1]).getBytes("UTF-8"));
            try {
                factory.generateCertPath(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
            bais = new ByteArrayInputStream(
                    (good[0][0] + bad_content[i] + good[0][1]).getBytes("UTF-8"));
            try {
                factory.generateCertPath(bais, "PkiPath");
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
            bais = new ByteArrayInputStream(
                    (good[0][0] + bad_content[i] + good[0][1]).getBytes("UTF-8"));
            try {
                factory.generateCertPath(bais, "PKCS7");
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
        }

        for (int i = 0; i < bad.length; i++) {
            bais = new ByteArrayInputStream(
                    (bad[i][0] + pkiPath + bad[i][1]).getBytes("UTF-8"));
            try {
                factory.generateCertPath(bais);
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
            bais = new ByteArrayInputStream(
                    (bad[i][0] + pkiPath + bad[i][1]).getBytes("UTF-8"));
            try {
                factory.generateCertPath(bais, "PkiPath");
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
            bais = new ByteArrayInputStream(
                    (bad[i][0] + pkcs7so + bad[i][1]).getBytes("UTF-8"));
            try {
                factory.generateCertPath(bais, "PKCS7");
                fail("Expected exception was not thrown");
            } catch (Exception e) {
            }
        }
    }

    /**
     * generateCertificates method testing.
     */
    public void testGenerateCertificates() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        // Testing the Certificates generation
        // on the base of PKCS7 SignedData object
        ByteArrayInputStream bais = new ByteArrayInputStream(
                Base64.decode(pkcs7so.getBytes("UTF-8")));

        Collection certs = factory.generateCertificates(bais);
        assertNotNull("Factory returned null on correct PKCS7 data", certs);
        assertEquals("The size of collection differs from expected",
                2, certs.size());

        if (publicKey != null) {
            // verify the signatures
            for (Iterator i = certs.iterator(); i.hasNext(); ) {
                ((X509Certificate) i.next()).verify(publicKey);
            }
        }
    }

    /**
     * generateCertificates method testing.
     */
    public void testGenerateCertPath() throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        // Testing the CertPath generation
        // on the base of PKCS7 SignedData object
        ByteArrayInputStream bais = new ByteArrayInputStream(
                Base64.decode(pkcs7so.getBytes("UTF-8")));

        Collection certPath =
                factory.generateCertPath(bais, "PKCS7").getCertificates();
        assertEquals("The size of collection differs from expected",
                2, certPath.size());

        if (publicKey != null) {
            // verify the signatures
            for (Iterator i = certPath.iterator(); i.hasNext(); ) {
                ((X509Certificate) i.next()).verify(publicKey);
            }
        }

        // testing empty PkiPath structure (ASN.1 such as 0x30, 0x00)
        bais = new ByteArrayInputStream(new byte[] { (byte) 0x30, 0x00 });
        assertEquals("The size of the list differs from expected",
                0, factory.generateCertPath(bais, "PkiPath")
                .getCertificates().size());
    }

}