Статус: Новичок
Группы: Участники
Зарегистрирован: 17.11.2014(UTC) Сообщений: 5  Откуда: Москва Сказал(а) «Спасибо»: 1 раз
|
Добрый день. На клиенте создаю присоединенную подпись таким образом: Код:
var CADESCOM_CADES_BES = 1;
var CAPICOM_CURRENT_USER_STORE = 2;
var CAPICOM_MY_STORE = "My";
var CAPICOM_STORE_OPEN_MAXIMUM_ALLOWED = 2;
var CAPICOM_CERTIFICATE_FIND_SUBJECT_NAME = 1;
var CADESCOM_BASE64_TO_BINARY = 1;
function SignCreate(certSubjectName, dataToSign) {
var oStore = CreateObject("CAPICOM.Store");
oStore.Open(CAPICOM_CURRENT_USER_STORE, CAPICOM_MY_STORE,
CAPICOM_STORE_OPEN_MAXIMUM_ALLOWED);
var oCertificates = oStore.Certificates.Find(
CAPICOM_CERTIFICATE_FIND_SUBJECT_NAME, certSubjectName);
if (oCertificates.Count == 0) {
alert("Certificate not found: " + certSubjectName);
return;
}
var oCertificate = oCertificates.Item(1);
var oSigner = CreateObject("CAdESCOM.CPSigner");
oSigner.Certificate = oCertificate;
var oSignedData = CreateObject("CAdESCOM.CadesSignedData");
oSignedData.Content = dataToSign;
try {
var sSignedMessage = oSignedData.SignCades(oSigner, CADESCOM_CADES_BES, false);
} catch (err) {
alert("Failed to create signature. Error: " + GetErrorMessage(err));
return;
}
oStore.Close();
return sSignedMessage;
}
верификация на клиенте успешна: Код: function Verify(sSignedMessage, dataToVerify) {
var oSignedData = CreateObject("CAdESCOM.CadesSignedData");
try {
oSignedData.Content = dataToVerify;
oSignedData.VerifyCades(sSignedMessage, CADESCOM_CADES_BES, false);
} catch (err) {
alert("Failed to verify signature. Error: " + GetErrorMessage(err));
return false;
}
return true;
}
Теперь хочу проверить подпись на стороне сервере: Код:
public static void loadConfiguration(String storeType, String storeFile,
char[] storePassword, String alias, Collection<X509Certificate>
chain) throws KeyStoreException, NoSuchAlgorithmException, CertificateException,
IOException, UnrecoverableKeyException {
KeyStore keyStore = KeyStore.getInstance(storeType);
keyStore.load(storeFile == null ? null : new FileInputStream(storeFile),
storePassword);
// Получаем цепочку сертификатов.
List<Certificate> lChain =
Arrays.asList(keyStore.getCertificate(alias));
// Конвертируем цепочку в X509Certificate.
Collection<X509Certificate> xChain =
Arrays.asList((lChain).toArray(new X509Certificate[lChain.size()]));
chain.addAll(xChain);
}
private void cadesVerify(String cms) throws CAdESException, CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException, UnrecoverableKeyException {
Collection<X509Certificate> chain = new ArrayList<X509Certificate>();
Configuration.loadConfiguration("CertStore", "jcpcert.store", "1".toCharArray(), "testcert.cer", chain);
byte[] decodedCMS = org.bouncycastle.util.encoders.Base64.decode(cms);
CAdESSignature cadesSignature = new CAdESSignature(decodedCMS, null, null);
cadesSignature.verify(chain);
}
в логе: Код:17.11.2014 10:50:59 ru.CryptoPro.CAdES.CAdESSigner a
INFO: *** Signer signature type: CAdES-BES ***
17.11.2014 10:50:59 ru.CryptoPro.CAdES.CAdESSigner a
INFO: Current signature cryptographic provider: JCP
17.11.2014 10:50:59 ru.CryptoPro.CAdES.b.d.b a
INFO: Built chain contains next certificates:
17.11.2014 10:50:59 ru.CryptoPro.CAdES.b.d.b a
INFO: [1] certificate
serial number: 12000087bdb6ee3bddf405b8b70000000087bd
subject: C=RU, L=1, O=1, OU=1, CN=testcert, EMAILADDRESS=1
issuer: CN=CRYPTO-PRO Test Center 2, O=CRYPTO-PRO LLC, L=Moscow, C=RU, EMAILADDRESS=support@cryptopro.ru
17.11.2014 10:50:59 ru.CryptoPro.CAdES.b.d.b a
INFO: [T] Chain trusted certificate
serial number: 2b6e3351fd6eb2ad48200203cb5ba141
subject: CN=CRYPTO-PRO Test Center 2, O=CRYPTO-PRO LLC, L=Moscow, C=RU, EMAILADDRESS=support@cryptopro.ru
17.11.2014 10:50:59 ru.CryptoPro.CAdES.b.d.a a
INFO: Verify certificate chain for target certificate
serial number: 12000087bdb6ee3bddf405b8b70000000087bd
subject: C=RU, L=1, O=1, OU=1, CN=testcert, EMAILADDRESS=1
issuer: CN=CRYPTO-PRO Test Center 2, O=CRYPTO-PRO LLC, L=Moscow, C=RU, EMAILADDRESS=support@cryptopro.ru
signature provider: JCP
PKIX validator: CPPKIX of RevCheck
revocation enabled: false
online: false
17.11.2014 10:50:59 ru.CryptoPro.CAdES.b.d.a a
INFO: Certificate chain built correctly.
17.11.2014 10:50:59 ru.CryptoPro.CAdES.b.d.a a
INFO: Verify certificate chain for target certificate
serial number: 12000087bdb6ee3bddf405b8b70000000087bd
subject: C=RU, L=1, O=1, OU=1, CN=testcert, EMAILADDRESS=1
issuer: CN=CRYPTO-PRO Test Center 2, O=CRYPTO-PRO LLC, L=Moscow, C=RU, EMAILADDRESS=support@cryptopro.ru
signature provider: JCP
PKIX validator: CPPKIX of RevCheck
revocation enabled: true
online: true
17.11.2014 10:50:59 ru.CryptoPro.CAdES.exception.CAdESException <init>
SEVERE: Parameters 'ru.CryptoPro.reprov.enableCRLDP', 'com.sun.security.enableCRLDP' and 'com.ibm.security.enableCRLDP' must be set 'true'
17.11.2014 10:50:59 ru.CryptoPro.CAdES.CAdESSigner a
INFO: Signer certificate chain is invalid.
17.11.2014 10:50:59 ru.CryptoPro.CAdES.exception.CAdESException <init>
SEVERE: Wrong certificate chain
Wrong certificate chain, errors: 'Wrong certificate chain' (1)
at ru.CryptoPro.CAdES.CAdESSigner.a(Unknown Source)
at ru.CryptoPro.CAdES.CAdESSignature.a(Unknown Source)
at ru.CryptoPro.CAdES.CAdESSignature.verify(Unknown Source)
at ru.tsc.HelloW.cadesVerify(HelloW.java:83)
at ru.tsc.HelloW.doPost(HelloW.java:66)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:647)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:931)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1004)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:312)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Окружение: jdk16.0.26 КриптоПро Рутокен CSP jcp_plus_jtls_1.0.54 Подскажите, что я делаю не так?
|
