> getCborHeaders() {
69 | return headers;
70 | }
71 |
72 | @Override
73 | public PrivKey getCborSigningKey() {
74 | return new JvmPrivKey(privateKey);
75 | }
76 |
77 | @Override
78 | public PubKey getCborVerificationKey(byte[] bytes, VerificationResult verificationResult) {
79 | if (Arrays.compare(this.kid, kid) == 0) {
80 | return new JvmPubKey(cert.getPublicKey());
81 | } else {
82 | throw new IllegalArgumentException("unknown kid");
83 | }
84 | }
85 |
86 | @Override
87 | public CertificateAdapter getCertificate() {
88 | return new CertificateAdapter(cert);
89 | }
90 |
91 | @Override
92 | public String exportCertificateAsPem() {
93 | return null;
94 | }
95 |
96 | @Override
97 | public String exportPrivateKeyAsPem() {
98 | return null;
99 | }
100 |
101 | }
102 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/ExpirationService.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import ehn.techiop.hcert.kotlin.data.GreenCertificate;
4 | import eu.europa.ec.dgc.issuance.config.IssuanceConfigProperties;
5 | import eu.europa.ec.dgc.issuance.entity.GreenCertificateType;
6 | import java.time.Duration;
7 | import java.time.Instant;
8 | import java.time.ZoneOffset;
9 | import java.time.temporal.ChronoUnit;
10 | import lombok.Data;
11 | import lombok.RequiredArgsConstructor;
12 | import org.springframework.stereotype.Component;
13 |
14 | @Component
15 | @RequiredArgsConstructor
16 | public class ExpirationService {
17 |
18 | private final IssuanceConfigProperties issuanceConfigProperties;
19 |
20 | /**
21 | * expiration duration for given edgc type.
22 | * @param greenCertificateType edgc type
23 | * @return Duration
24 | */
25 | public Duration expirationForType(GreenCertificateType greenCertificateType) {
26 | Duration duration;
27 | if (issuanceConfigProperties.getExpiration() != null) {
28 | switch (greenCertificateType) {
29 | case Test:
30 | duration = issuanceConfigProperties.getExpiration().getTest();
31 | break;
32 | case Vaccination:
33 | duration = issuanceConfigProperties.getExpiration().getVaccination();
34 | break;
35 | case Recovery:
36 | duration = issuanceConfigProperties.getExpiration().getRecovery();
37 | break;
38 | default:
39 | throw new IllegalArgumentException("unsupported cert type for expiration: " + greenCertificateType);
40 | }
41 | } else {
42 | duration = null;
43 | }
44 | if (duration == null) {
45 | duration = Duration.of(365, ChronoUnit.DAYS);
46 | }
47 | return duration;
48 | }
49 |
50 | /**
51 | * calulate cbor web token expiration fields.
52 | * It depends partly on configuration and for test and recovery also from DGC Json data
53 | * @param eudgc json data of dgc
54 | * @return the times
55 | */
56 | public CwtTimeFields calculateCwtExpiration(GreenCertificate eudgc) {
57 | CwtTimeFields result = new CwtTimeFields();
58 | GreenCertificateType greenCertificateType;
59 | long expirationTime;
60 | long issueTime = Instant.now().getEpochSecond();
61 | long expirationStartTime = issueTime;
62 |
63 | if (eudgc.getTests() != null && eudgc.getTests().length > 0) {
64 | greenCertificateType = GreenCertificateType.Test;
65 | expirationStartTime = extractTimesSec(eudgc.getTests()[0].getDateTimeSample(),expirationStartTime);
66 | expirationTime = expirationStartTime + expirationForType(greenCertificateType).get(ChronoUnit.SECONDS);
67 | } else if (eudgc.getRecoveryStatements() != null && eudgc.getRecoveryStatements().length > 0) {
68 | greenCertificateType = GreenCertificateType.Recovery;
69 | expirationTime = expirationStartTime + expirationForType(greenCertificateType).get(ChronoUnit.SECONDS);
70 | expirationTime = extractTimesSec(eudgc.getRecoveryStatements()[0].getCertificateValidUntil(),
71 | expirationTime);
72 | } else if (eudgc.getVaccinations() != null && eudgc.getVaccinations().length > 0) {
73 | greenCertificateType = GreenCertificateType.Vaccination;
74 | expirationStartTime = extractTimesSec(eudgc.getVaccinations()[0].getDate(),expirationStartTime);
75 | expirationTime = expirationStartTime + expirationForType(greenCertificateType).get(ChronoUnit.SECONDS);
76 | } else {
77 | greenCertificateType = GreenCertificateType.Vaccination;
78 | expirationTime = expirationStartTime + expirationForType(greenCertificateType).get(ChronoUnit.SECONDS);
79 | }
80 | result.setIssuedAt(issueTime);
81 | result.setExpiration(expirationTime);
82 | return result;
83 | }
84 |
85 | private long extractTimesSec(kotlinx.datetime.Instant date, long defaultTimeSec) {
86 | long timeSec;
87 | if (date != null) {
88 | timeSec = date.getEpochSeconds();
89 | } else {
90 | timeSec = defaultTimeSec;
91 | }
92 | return timeSec;
93 | }
94 |
95 | private long extractTimesSec(kotlinx.datetime.LocalDate localDate, long defaultTimeSec) {
96 | long timeSec;
97 | if (localDate != null) {
98 | timeSec = localDate.getValue$kotlinx_datetime().atStartOfDay().toEpochSecond(ZoneOffset.UTC);
99 | } else {
100 | timeSec = defaultTimeSec;
101 | }
102 | return timeSec;
103 | }
104 |
105 |
106 | @Data
107 | public static class CwtTimeFields {
108 | long issuedAt;
109 | long expiration;
110 | }
111 | }
112 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/SigningService.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import java.security.PrivateKey;
4 |
5 | public interface SigningService {
6 | /**
7 | * continue signing on already SHA256 generated content hash.
8 | * The it is only the Part of regular signing functionality.
9 | * Do not use regular Signing API because it will cause to hash the data twice and produce wrong
10 | * signature
11 | * @param hash SHA256 hash of content
12 | * @param privateKey RSA or EC
13 | * @return signature as raw byte array
14 | */
15 | byte[] signHash(byte[] hash, PrivateKey privateKey);
16 | }
17 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/Tan.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import eu.europa.ec.dgc.issuance.utils.HashUtil;
4 | import java.security.SecureRandom;
5 | import org.apache.commons.lang3.RandomStringUtils;
6 |
7 | public final class Tan {
8 |
9 | private static final int TAN_LENGTH = 8;
10 | private static final String HASH_ALGORITHM = "SHA-256";
11 | private static final char[] CHAR_SET_FOR_TAN = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".toCharArray();
12 |
13 | private String rawTan;
14 | private String hashedTan;
15 |
16 | private Tan() {
17 | }
18 |
19 | /**
20 | * Create new TAN object with a TAN and the hash of the TAN. The TAN is constructed from a charset consisting
21 | * of A-Z (exclcuding I and O) and 2-9.
22 | *
23 | * @return the newly created TAN object
24 | */
25 | public static Tan create() {
26 | Tan retVal = new Tan();
27 | retVal.rawTan = retVal.generateNewTan();
28 | retVal.hashedTan = HashUtil.sha256Base64(retVal.rawTan);
29 | return retVal;
30 | }
31 |
32 | private String generateNewTan() {
33 | SecureRandom random = new SecureRandom();
34 | long rnd = random.nextLong();
35 | int radixLen = CHAR_SET_FOR_TAN.length;
36 | StringBuilder tan = new StringBuilder();
37 | while (tan.length() < TAN_LENGTH) {
38 | if (rnd == 0) {
39 | rnd = random.nextLong();
40 | continue;
41 | }
42 | tan.append(CHAR_SET_FOR_TAN[Math.abs((int) (rnd % radixLen))]);
43 | rnd /= radixLen;
44 | }
45 | return tan.toString();
46 | }
47 |
48 | public String getRawTan() {
49 | return rawTan;
50 | }
51 |
52 | public String getHashedTan() {
53 | return hashedTan;
54 | }
55 | }
56 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/WrongRequest.java:
--------------------------------------------------------------------------------
1 | /*-
2 | * ---license-start
3 | * EU Digital Green Certificate Issuance Service / dgca-issuance-service
4 | * ---
5 | * Copyright (C) 2021 T-Systems International GmbH and all other contributors
6 | * ---
7 | * Licensed under the Apache License, Version 2.0 (the "License");
8 | * you may not use this file except in compliance with the License.
9 | * You may obtain a copy of the License at
10 | *
11 | * http://www.apache.org/licenses/LICENSE-2.0
12 | *
13 | * Unless required by applicable law or agreed to in writing, software
14 | * distributed under the License is distributed on an "AS IS" BASIS,
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 | * See the License for the specific language governing permissions and
17 | * limitations under the License.
18 | * ---license-end
19 | */
20 |
21 | package eu.europa.ec.dgc.issuance.service;
22 |
23 | public class WrongRequest extends RuntimeException {
24 | public WrongRequest(String message, Throwable inner) {
25 | super(message, inner);
26 | }
27 |
28 | public WrongRequest(String message) {
29 | super(message);
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/BtpAbstractKeyProvider.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service.impl;
2 |
3 | import eu.europa.ec.dgc.issuance.service.CertificatePrivateKeyProvider;
4 | import eu.europa.ec.dgc.issuance.utils.btp.CredentialStore;
5 | import eu.europa.ec.dgc.issuance.utils.btp.SapCredential;
6 | import java.io.ByteArrayInputStream;
7 | import java.security.KeyFactory;
8 | import java.security.NoSuchAlgorithmException;
9 | import java.security.PrivateKey;
10 | import java.security.cert.Certificate;
11 | import java.security.cert.CertificateException;
12 | import java.security.cert.CertificateFactory;
13 | import java.security.spec.InvalidKeySpecException;
14 | import java.security.spec.PKCS8EncodedKeySpec;
15 | import java.util.ArrayList;
16 | import java.util.Arrays;
17 | import java.util.Base64;
18 | import java.util.List;
19 | import org.slf4j.Logger;
20 | import org.slf4j.LoggerFactory;
21 |
22 | /**
23 | * Abstract class with interfaces to the SAP BTP {@link CredentialStore}. It provides methods to get certificates
24 | * as well as private keys from the credential store. Implementations of {@link CertificatePrivateKeyProvider}
25 | * inheriting from this abstract class do not have to implement a connection to the credential store themselves.
26 | * Note: Keys in the credential store are supposed to be in X.509 or RSA format and base64 encoded. Raw keys
27 | * will be stripped off line breaks and -----BEGIN / END KEY----- phrases.
28 | */
29 | public abstract class BtpAbstractKeyProvider implements CertificatePrivateKeyProvider {
30 |
31 | private static final Logger log = LoggerFactory.getLogger(BtpAbstractKeyProvider.class);
32 |
33 | private static final List ALLOWED_ALGORITHMS = Arrays.asList("EC", "RSA");
34 |
35 | protected final CredentialStore credentialStore;
36 |
37 | public BtpAbstractKeyProvider(CredentialStore credentialStore) {
38 | this.credentialStore = credentialStore;
39 | }
40 |
41 | protected Certificate getCertificateFromStore(String certName) {
42 | SapCredential cert = credentialStore.getKeyByName(certName);
43 | String certContent = cleanKeyString(cert.getValue());
44 |
45 | try {
46 | byte[] certDecoded = Base64.getDecoder().decode(certContent);
47 | CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
48 | return certFactory.generateCertificate(new ByteArrayInputStream(certDecoded));
49 | } catch (CertificateException e) {
50 | log.error("Error building certificate: {}.", e.getMessage());
51 | throw new RuntimeException(e);
52 | }
53 | }
54 |
55 | protected PrivateKey getPrivateKeyFromStore(String keyName) {
56 | SapCredential key = credentialStore.getKeyByName(keyName);
57 | if (!ALLOWED_ALGORITHMS.contains(key.getFormat())) {
58 | throw new IllegalArgumentException("Key Format not supported: " + key.getFormat());
59 | }
60 |
61 | try {
62 | KeyFactory kf = KeyFactory.getInstance(key.getFormat());
63 | PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(Base64.getDecoder()
64 | .decode(cleanKeyString(key.getValue())));
65 | return kf.generatePrivate(pkcs8EncodedKeySpec);
66 | } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
67 | log.error("Error building private key: {}", e.getMessage());
68 | throw new RuntimeException(e);
69 | }
70 | }
71 |
72 | private String cleanKeyString(String rawKey) {
73 | return rawKey.replaceAll("\\n", "")
74 | .replace("-----BEGIN PRIVATE KEY-----", "")
75 | .replace("-----BEGIN PUBLIC KEY-----", "")
76 | .replace("-----END PUBLIC KEY-----", "")
77 | .replace("-----END PRIVATE KEY-----", "");
78 | }
79 | }
80 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/BtpCertKeyPublisherServiceImpl.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service.impl;
2 |
3 | import com.sap.cloud.sdk.cloudplatform.connectivity.DestinationAccessor;
4 | import com.sap.cloud.sdk.cloudplatform.connectivity.HttpClientAccessor;
5 | import com.sap.cloud.sdk.cloudplatform.connectivity.HttpDestination;
6 | import eu.europa.ec.dgc.issuance.service.CertKeyPublisherService;
7 | import eu.europa.ec.dgc.issuance.service.CertificatePrivateKeyProvider;
8 | import eu.europa.ec.dgc.signing.SignedCertificateMessageBuilder;
9 | import eu.europa.ec.dgc.utils.CertificateUtils;
10 | import java.io.IOException;
11 | import java.nio.charset.StandardCharsets;
12 | import java.security.cert.CertificateEncodingException;
13 | import java.security.cert.X509Certificate;
14 | import lombok.extern.slf4j.Slf4j;
15 | import org.apache.http.HttpResponse;
16 | import org.apache.http.HttpStatus;
17 | import org.apache.http.client.HttpClient;
18 | import org.apache.http.client.methods.HttpUriRequest;
19 | import org.apache.http.client.methods.RequestBuilder;
20 | import org.apache.http.entity.StringEntity;
21 | import org.bouncycastle.cert.X509CertificateHolder;
22 | import org.springframework.beans.factory.annotation.Qualifier;
23 | import org.springframework.context.annotation.Profile;
24 | import org.springframework.stereotype.Component;
25 |
26 | /**
27 | * Publishes the issuer's public certificate to the DGC gateway. The public certificate will be signed with the upload
28 | * key provided by the upload key provider.
29 | *
30 | * @see BtpUploadKeyProviderImpl
31 | */
32 | @Component
33 | @Profile("btp")
34 | @Slf4j
35 | public class BtpCertKeyPublisherServiceImpl implements CertKeyPublisherService {
36 |
37 | private static final String DGCG_DESTINATION = "dgcg-destination";
38 | private static final String DGCG_UPLOAD_ENDPOINT = "/signerCertificate";
39 |
40 | private final CertificatePrivateKeyProvider uploadKeyProvider;
41 | private final CertificatePrivateKeyProvider issuerKeyProvider;
42 | private final CertificateUtils certificateUtils;
43 |
44 | /**
45 | * Initializes the publisher service with all key provider and utilities needed for uploading certificates to
46 | * the gateway.
47 | *
48 | * @param uploadKeyProvider the upload certificate needed to sign the request
49 | * @param issuerKeyProvider the issuer certificate beeing uploaded
50 | * @param certificateUtils utilities to convert different certificate formats
51 | */
52 | public BtpCertKeyPublisherServiceImpl(
53 | @Qualifier("uploadKeyProvider") CertificatePrivateKeyProvider uploadKeyProvider,
54 | @Qualifier("issuerKeyProvider") CertificatePrivateKeyProvider issuerKeyProvider,
55 | CertificateUtils certificateUtils) {
56 | this.uploadKeyProvider = uploadKeyProvider;
57 | this.issuerKeyProvider = issuerKeyProvider;
58 | this.certificateUtils = certificateUtils;
59 | }
60 |
61 | @Override
62 | public void publishKey() {
63 | log.debug("Uploading key to gateway.");
64 | HttpDestination httpDestination = DestinationAccessor.getDestination(DGCG_DESTINATION).asHttp();
65 | HttpClient httpClient = HttpClientAccessor.getHttpClient(httpDestination);
66 |
67 | try {
68 | X509CertificateHolder issuerCertHolder = certificateUtils
69 | .convertCertificate((X509Certificate) issuerKeyProvider.getCertificate());
70 | X509CertificateHolder uploadCertHolder = certificateUtils
71 | .convertCertificate((X509Certificate) uploadKeyProvider.getCertificate());
72 |
73 | String payload = new SignedCertificateMessageBuilder()
74 | .withPayloadCertificate(issuerCertHolder)
75 | .withSigningCertificate(uploadCertHolder, uploadKeyProvider.getPrivateKey()).buildAsString();
76 |
77 | HttpUriRequest postRequest = RequestBuilder.post(DGCG_UPLOAD_ENDPOINT)
78 | .addHeader("Content-type", "application/cms")
79 | .setEntity(new StringEntity(payload, StandardCharsets.UTF_8))
80 | .build();
81 |
82 | HttpResponse response = httpClient.execute(postRequest);
83 | if (response.getStatusLine().getStatusCode() == HttpStatus.SC_CREATED) {
84 | log.info("Successfully upload certificate to gateway.");
85 | } else {
86 | log.warn("Gateway returned 'HTTP {}: {}'.", response.getStatusLine().getStatusCode(),
87 | response.getStatusLine().getReasonPhrase());
88 | }
89 |
90 | } catch (CertificateEncodingException | IOException e) {
91 | log.error("Error while upload certificate to gateway: '{}'.", e.getMessage());
92 | throw new RuntimeException(e);
93 | }
94 | }
95 |
96 | }
97 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/BtpIssuerKeyProviderImpl.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service.impl;
2 |
3 | import eu.europa.ec.dgc.issuance.utils.btp.CredentialStore;
4 | import java.security.PrivateKey;
5 | import java.security.cert.Certificate;
6 | import lombok.extern.slf4j.Slf4j;
7 | import org.springframework.beans.factory.annotation.Autowired;
8 | import org.springframework.context.annotation.Profile;
9 | import org.springframework.stereotype.Component;
10 |
11 | @Slf4j
12 | @Component("issuerKeyProvider")
13 | @Profile("btp")
14 | public class BtpIssuerKeyProviderImpl extends BtpAbstractKeyProvider {
15 |
16 | private static final String ISSUER_KEY_NAME = "issuer-key";
17 | private static final String ISSUER_CERT_NAME = "issuer-cert";
18 |
19 | @Autowired
20 | public BtpIssuerKeyProviderImpl(CredentialStore credentialStore) {
21 | super(credentialStore);
22 | }
23 |
24 | @Override
25 | public Certificate getCertificate() {
26 | return this.getCertificateFromStore(ISSUER_CERT_NAME);
27 | }
28 |
29 | @Override
30 | public PrivateKey getPrivateKey() {
31 | return getPrivateKeyFromStore(ISSUER_KEY_NAME);
32 | }
33 |
34 | }
35 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/BtpUploadKeyProviderImpl.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service.impl;
2 |
3 | import eu.europa.ec.dgc.issuance.utils.btp.CredentialStore;
4 | import java.security.PrivateKey;
5 | import java.security.cert.Certificate;
6 | import lombok.extern.slf4j.Slf4j;
7 | import org.springframework.beans.factory.annotation.Autowired;
8 | import org.springframework.context.annotation.Profile;
9 | import org.springframework.stereotype.Component;
10 |
11 | @Component("uploadKeyProvider")
12 | @Profile("btp")
13 | @Slf4j
14 | public class BtpUploadKeyProviderImpl extends BtpAbstractKeyProvider {
15 |
16 | private static final String UPLOAD_KEY_NAME = "upload-key";
17 | private static final String UPLOAD_CERT_NAME = "upload-cert";
18 |
19 | @Autowired
20 | public BtpUploadKeyProviderImpl(CredentialStore credentialStore) {
21 | super(credentialStore);
22 | }
23 |
24 | @Override
25 | public Certificate getCertificate() {
26 | return getCertificateFromStore(UPLOAD_CERT_NAME);
27 | }
28 |
29 | @Override
30 | public PrivateKey getPrivateKey() {
31 | return getPrivateKeyFromStore(UPLOAD_KEY_NAME);
32 | }
33 |
34 | }
35 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/CertificatePrivateKeyProviderImpl.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service.impl;
2 |
3 | import eu.europa.ec.dgc.issuance.config.IssuanceConfigProperties;
4 | import eu.europa.ec.dgc.issuance.service.CertificatePrivateKeyProvider;
5 | import eu.europa.ec.dgc.issuance.service.DgciNotFound;
6 | import eu.europa.ec.dgc.utils.CertificateUtils;
7 | import java.io.File;
8 | import java.io.FileInputStream;
9 | import java.io.IOException;
10 | import java.io.InputStream;
11 | import java.security.KeyStore;
12 | import java.security.KeyStoreException;
13 | import java.security.NoSuchAlgorithmException;
14 | import java.security.PrivateKey;
15 | import java.security.PublicKey;
16 | import java.security.Security;
17 | import java.security.UnrecoverableEntryException;
18 | import java.security.cert.Certificate;
19 | import java.security.cert.CertificateException;
20 | import java.security.cert.X509Certificate;
21 | import javax.annotation.PostConstruct;
22 | import lombok.RequiredArgsConstructor;
23 | import lombok.extern.slf4j.Slf4j;
24 | import org.bouncycastle.jce.provider.BouncyCastleProvider;
25 | import org.springframework.context.annotation.Profile;
26 | import org.springframework.stereotype.Component;
27 |
28 | @Component("issuerKeyProvider")
29 | @Profile("!btp")
30 | @Slf4j
31 | @RequiredArgsConstructor
32 | public class CertificatePrivateKeyProviderImpl implements CertificatePrivateKeyProvider {
33 | private Certificate cert;
34 | private final IssuanceConfigProperties issuanceConfigProperties;
35 | private PublicKey publicKey;
36 | private PrivateKey privateKey;
37 |
38 | /**
39 | * PostConstruct method to load KeyStore for issuing certificates.
40 | */
41 | @PostConstruct
42 | public void loadKeyStore() throws KeyStoreException, IOException,
43 | CertificateException, NoSuchAlgorithmException, UnrecoverableEntryException {
44 | final char[] keyStorePassword = issuanceConfigProperties.getKeyStorePassword().toCharArray();
45 | final String keyName = issuanceConfigProperties.getCertAlias();
46 |
47 | Security.addProvider(new BouncyCastleProvider());
48 | Security.setProperty("crypto.policy", "unlimited");
49 |
50 | KeyStore keyStore = KeyStore.getInstance("JKS");
51 |
52 | File keyFile = new File(issuanceConfigProperties.getKeyStoreFile());
53 | if (!keyFile.isFile()) {
54 | log.error("keyfile not found on: {} please adapt the configuration property: issuance.keyStoreFile",
55 | keyFile);
56 | throw new DgciNotFound("keyfile not found on: " + keyFile
57 | + " please adapt the configuration property: issuance.keyStoreFile");
58 | }
59 | try (InputStream is = new FileInputStream(issuanceConfigProperties.getKeyStoreFile())) {
60 | final char[] privateKeyPassword = issuanceConfigProperties.getPrivateKeyPassword().toCharArray();
61 | keyStore.load(is, privateKeyPassword);
62 | KeyStore.PasswordProtection keyPassword =
63 | new KeyStore.PasswordProtection(keyStorePassword);
64 |
65 | KeyStore.PrivateKeyEntry privateKeyEntry =
66 | (KeyStore.PrivateKeyEntry) keyStore.getEntry(keyName, keyPassword);
67 | cert = keyStore.getCertificate(keyName);
68 | publicKey = cert.getPublicKey();
69 | privateKey = privateKeyEntry.getPrivateKey();
70 | CertificateUtils certificateUtils = new CertificateUtils();
71 | String kidBase64 = certificateUtils.getCertKid((X509Certificate) cert);
72 | }
73 | }
74 |
75 | @Override
76 | public Certificate getCertificate() {
77 | return cert;
78 | }
79 |
80 | @Override
81 | public PrivateKey getPrivateKey() {
82 | return privateKey;
83 | }
84 | }
85 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/CopyDigest.java:
--------------------------------------------------------------------------------
1 | /*-
2 | * ---license-start
3 | * EU Digital Green Certificate Issuance Service / dgca-issuance-service
4 | * ---
5 | * Copyright (C) 2021 T-Systems International GmbH and all other contributors
6 | * ---
7 | * Licensed under the Apache License, Version 2.0 (the "License");
8 | * you may not use this file except in compliance with the License.
9 | * You may obtain a copy of the License at
10 | *
11 | * http://www.apache.org/licenses/LICENSE-2.0
12 | *
13 | * Unless required by applicable law or agreed to in writing, software
14 | * distributed under the License is distributed on an "AS IS" BASIS,
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 | * See the License for the specific language governing permissions and
17 | * limitations under the License.
18 | * ---license-end
19 | */
20 |
21 | package eu.europa.ec.dgc.issuance.service.impl;
22 |
23 |
24 | import java.io.ByteArrayOutputStream;
25 | import org.bouncycastle.crypto.Digest;
26 | import org.bouncycastle.crypto.digests.SHA256Digest;
27 | import org.bouncycastle.util.Arrays;
28 |
29 | public class CopyDigest implements Digest {
30 | private final OpenByteArrayOutputStream binaryOut = new OpenByteArrayOutputStream();
31 | private final SHA256Digest sha256Digest = new SHA256Digest();
32 | private boolean wasReset = false;
33 |
34 | public String getAlgorithmName() {
35 | return "NULL";
36 | }
37 |
38 | public int getDigestSize() {
39 | return 32;
40 | }
41 |
42 | /**
43 | * Updates the Message Digest with one byte.
44 | *
45 | * @param in byte to update.
46 | */
47 | public void update(byte in) {
48 | if (wasReset) {
49 | sha256Digest.update(in);
50 | } else {
51 | binaryOut.write(in);
52 | }
53 | }
54 |
55 | /**
56 | * Updates the Message Digest with a byte array.
57 | *
58 | * @param in byte array to insert
59 | * @param offset Offset
60 | * @param length length
61 | */
62 | public void update(byte[] in, int offset, int length) {
63 | if (wasReset) {
64 | sha256Digest.update(in, offset, length);
65 | } else {
66 | binaryOut.write(in, offset, length);
67 | }
68 | }
69 |
70 | /**
71 | * close the digest, producing the final digest value. The doFinal
72 | * call leaves the digest reset.
73 | *
74 | * @param out the array the digest is to be copied into.
75 | * @param offset the offset into the out array the digest is to start at.
76 | * @return size of output
77 | */
78 | public int doFinal(byte[] out, int offset) {
79 | if (wasReset) {
80 | return sha256Digest.doFinal(out, offset);
81 | } else {
82 | int size = binaryOut.size();
83 | binaryOut.copy(out, offset);
84 | reset();
85 | return size;
86 | }
87 | }
88 |
89 | /**
90 | * Resets the Message Digest.
91 | */
92 | public void reset() {
93 | if (wasReset) {
94 | sha256Digest.reset();
95 | } else {
96 | if (binaryOut.size() > 0) {
97 | wasReset = true;
98 | binaryOut.reset();
99 | }
100 | }
101 | }
102 |
103 | private static class OpenByteArrayOutputStream
104 | extends ByteArrayOutputStream {
105 | public synchronized void reset() {
106 | super.reset();
107 |
108 | Arrays.clear(buf);
109 | }
110 |
111 | void copy(byte[] out, int outOff) {
112 | System.arraycopy(buf, 0, out, outOff, this.size());
113 | }
114 | }
115 | }
116 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/service/impl/SigningServiceImpl.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service.impl;
2 |
3 | import eu.europa.ec.dgc.issuance.service.SigningService;
4 | import java.math.BigInteger;
5 | import java.security.PrivateKey;
6 | import java.security.interfaces.RSAPrivateCrtKey;
7 | import org.bouncycastle.crypto.CryptoException;
8 | import org.bouncycastle.crypto.Digest;
9 | import org.bouncycastle.crypto.digests.SHA256Digest;
10 | import org.bouncycastle.crypto.engines.RSABlindedEngine;
11 | import org.bouncycastle.crypto.params.ECDomainParameters;
12 | import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
13 | import org.bouncycastle.crypto.params.RSAPrivateCrtKeyParameters;
14 | import org.bouncycastle.crypto.signers.ECDSASigner;
15 | import org.bouncycastle.crypto.signers.PSSSigner;
16 | import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
17 | import org.bouncycastle.jce.spec.ECParameterSpec;
18 | import org.springframework.stereotype.Component;
19 |
20 | @Component
21 | public class SigningServiceImpl implements SigningService {
22 | @Override
23 | public byte[] signHash(byte[] hashBytes, PrivateKey privateKey) {
24 | byte[] signature;
25 | try {
26 | if (privateKey instanceof RSAPrivateCrtKey) {
27 | signature = signRsapss(hashBytes, privateKey);
28 | } else {
29 | signature = signEc(hashBytes, privateKey);
30 | }
31 | } catch (CryptoException e) {
32 | throw new IllegalArgumentException("error during signing ", e);
33 | }
34 | return signature;
35 | }
36 |
37 | private byte[] signRsapss(byte[] hashBytes, PrivateKey privateKey) throws CryptoException {
38 | Digest contentDigest = new CopyDigest();
39 | Digest mgfDigest = new SHA256Digest();
40 | RSAPrivateCrtKey k = (RSAPrivateCrtKey) privateKey;
41 | RSAPrivateCrtKeyParameters keyparam = new RSAPrivateCrtKeyParameters(k.getModulus(),
42 | k.getPublicExponent(), k.getPrivateExponent(),
43 | k.getPrimeP(), k.getPrimeQ(), k.getPrimeExponentP(), k.getPrimeExponentQ(), k.getCrtCoefficient());
44 | RSABlindedEngine rsaBlindedEngine = new RSABlindedEngine();
45 | rsaBlindedEngine.init(true, keyparam);
46 | PSSSigner pssSigner = new PSSSigner(rsaBlindedEngine, contentDigest, mgfDigest, 32, (byte) (-68));
47 | pssSigner.init(true, keyparam);
48 | pssSigner.update(hashBytes, 0, hashBytes.length);
49 | return pssSigner.generateSignature();
50 | }
51 |
52 | private byte[] signEc(byte[] hash, PrivateKey privateKey) {
53 | java.security.interfaces.ECPrivateKey privKey = (java.security.interfaces.ECPrivateKey) privateKey;
54 | ECParameterSpec s = EC5Util.convertSpec(privKey.getParams());
55 | ECPrivateKeyParameters keyparam = new ECPrivateKeyParameters(
56 | privKey.getS(),
57 | new ECDomainParameters(s.getCurve(), s.getG(), s.getN(), s.getH(), s.getSeed()));
58 | ECDSASigner ecdsaSigner = new ECDSASigner();
59 | ecdsaSigner.init(true, keyparam);
60 | BigInteger[] result3BI = ecdsaSigner.generateSignature(hash);
61 | byte[] rvarArr = result3BI[0].toByteArray();
62 | byte[] svarArr = result3BI[1].toByteArray();
63 | // we need to convert it to 2*32 bytes array. This can 33 with leading 0 or shorter so padding is needed
64 | byte[] sig = new byte[64];
65 | System.arraycopy(rvarArr, rvarArr.length == 33 ? 1 : 0, sig,
66 | Math.max(0, 32 - rvarArr.length), Math.min(32, rvarArr.length));
67 | System.arraycopy(svarArr, svarArr.length == 33 ? 1 : 0, sig,
68 | 32 + Math.max(0, 32 - svarArr.length), Math.min(32, svarArr.length));
69 |
70 | return sig;
71 | }
72 | }
73 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/CborDumpService.java:
--------------------------------------------------------------------------------
1 | /*-
2 | * ---license-start
3 | * EU Digital Green Certificate Issuance Service / dgca-issuance-service
4 | * ---
5 | * Copyright (C) 2021 T-Systems International GmbH and all other contributors
6 | * ---
7 | * Licensed under the Apache License, Version 2.0 (the "License");
8 | * you may not use this file except in compliance with the License.
9 | * You may obtain a copy of the License at
10 | *
11 | * http://www.apache.org/licenses/LICENSE-2.0
12 | *
13 | * Unless required by applicable law or agreed to in writing, software
14 | * distributed under the License is distributed on an "AS IS" BASIS,
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 | * See the License for the specific language governing permissions and
17 | * limitations under the License.
18 | * ---license-end
19 | */
20 |
21 | package eu.europa.ec.dgc.issuance.utils;
22 |
23 | import com.upokecenter.cbor.CBORObject;
24 | import java.io.IOException;
25 | import java.io.Writer;
26 | import org.springframework.stereotype.Service;
27 |
28 | @Service
29 | public class CborDumpService {
30 |
31 | /**
32 | * Method to write a CBOR Array into a {@link Writer} (e.g. {@link java.io.StringWriter}).
33 | *
34 | * @param cb cbor Byte Array to write
35 | * @param writer destination
36 | */
37 | public void dumpCbor(byte[] cb, Writer writer) throws IOException {
38 | CBORObject cborObject = CBORObject.DecodeFromBytes(cb);
39 | writer
40 | .append("")
41 | .append(String.valueOf(cborObject));
42 | }
43 | }
44 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/DgciUtil.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.utils;
2 |
3 | import java.math.BigInteger;
4 | import java.nio.ByteBuffer;
5 | import java.util.UUID;
6 |
7 | public class DgciUtil {
8 |
9 | /**
10 | * Encode UUID to charset of A-Z and 0-9.
11 | *
12 | * @param uuid the UUID to hash
13 | * @return the hashed UUID
14 | */
15 | public static String encodeDgci(UUID uuid) {
16 | ByteBuffer bb = ByteBuffer.wrap(new byte[16]);
17 | bb.putLong(uuid.getMostSignificantBits());
18 | bb.putLong(uuid.getLeastSignificantBits());
19 | BigInteger bint = new BigInteger(1, bb.array());
20 | int radix = 10 + ('Z' - 'A');
21 | return bint.toString(radix).toUpperCase();
22 | }
23 |
24 | }
25 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/HashUtil.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.utils;
2 |
3 | import java.nio.charset.StandardCharsets;
4 | import java.security.MessageDigest;
5 | import java.security.NoSuchAlgorithmException;
6 | import java.util.Base64;
7 |
8 | public class HashUtil {
9 |
10 | /**
11 | * Generates a SHA-256 hash and returns it as Base64 encoded string.
12 | *
13 | * @param raw the raw input
14 | * @return the Base64 encode hash
15 | */
16 | public static String sha256Base64(String raw) {
17 | try {
18 | final MessageDigest digest = MessageDigest.getInstance("SHA-256");
19 | final byte[] hashBytes = digest.digest(raw.getBytes(StandardCharsets.UTF_8));
20 | return Base64.getEncoder().encodeToString(hashBytes);
21 | } catch (NoSuchAlgorithmException e) {
22 | throw new IllegalArgumentException(e);
23 | }
24 | }
25 |
26 | }
27 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/btp/CredentialStore.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.utils.btp;
2 |
3 | import java.net.URLEncoder;
4 | import java.nio.charset.StandardCharsets;
5 | import org.slf4j.Logger;
6 | import org.slf4j.LoggerFactory;
7 | import org.springframework.beans.factory.annotation.Autowired;
8 | import org.springframework.beans.factory.annotation.Value;
9 | import org.springframework.context.annotation.Profile;
10 | import org.springframework.stereotype.Component;
11 | import org.springframework.web.client.RestTemplate;
12 |
13 | @Component
14 | @Profile("btp")
15 | public class CredentialStore {
16 |
17 | private static final Logger log = LoggerFactory.getLogger(CredentialStore.class);
18 |
19 | @Value("${sap.btp.credstore.url}")
20 | private String url;
21 |
22 | private final CredentialStoreCryptoUtil cryptoUtil;
23 |
24 | private final RestTemplate restTemplate;
25 |
26 | @Autowired
27 | public CredentialStore(CredentialStoreCryptoUtil cryptoUtil, RestTemplate restTemplate) {
28 | this.cryptoUtil = cryptoUtil;
29 | this.restTemplate = restTemplate;
30 | }
31 |
32 | /**
33 | * Return the key located under the given name in the credential store.
34 | *
35 | * @param name the name of the key
36 | * @return the key from the credential store
37 | */
38 | public SapCredential getKeyByName(String name) {
39 | log.debug("Querying key with name '{}'.", name);
40 | String response = restTemplate.getForEntity(url + "/key?name=" + URLEncoder.encode(name,
41 | StandardCharsets.UTF_8), String.class).getBody();
42 | return SapCredential.fromJson(cryptoUtil.decrypt(response));
43 | }
44 |
45 | }
46 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/btp/CredentialStoreConfig.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.utils.btp;
2 |
3 | import java.nio.charset.StandardCharsets;
4 | import java.util.Base64;
5 | import org.springframework.beans.factory.annotation.Value;
6 | import org.springframework.boot.web.client.RestTemplateBuilder;
7 | import org.springframework.context.annotation.Bean;
8 | import org.springframework.context.annotation.Configuration;
9 | import org.springframework.context.annotation.Profile;
10 | import org.springframework.web.client.RestTemplate;
11 |
12 | @Configuration
13 | @Profile("btp")
14 | public class CredentialStoreConfig {
15 |
16 | @Value("${sap.btp.credstore.username}")
17 | private String username;
18 |
19 | @Value("${sap.btp.credstore.password}")
20 | private String password;
21 |
22 | @Value("${sap.btp.credstore.namespace}")
23 | private String namespace;
24 |
25 | @Bean
26 | RestTemplate restTemplate(RestTemplateBuilder builder) {
27 | RestTemplate restTemplate = builder.build();
28 | restTemplate.getInterceptors().add((request, body, execution) -> {
29 | request.getHeaders().set("Authorization", "Basic " + getAuthToken());
30 | request.getHeaders().set("sapcp-credstore-namespace", namespace);
31 | return execution.execute(request, body);
32 | });
33 |
34 | return restTemplate;
35 | }
36 |
37 | private String getAuthToken() {
38 | String authHeader = username + ":" + password;
39 | return Base64.getEncoder().encodeToString(authHeader.getBytes(StandardCharsets.UTF_8));
40 | }
41 |
42 | }
43 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/btp/CredentialStoreCryptoUtil.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.utils.btp;
2 |
3 | import com.nimbusds.jose.JOSEException;
4 | import com.nimbusds.jose.JWEObject;
5 | import com.nimbusds.jose.Payload;
6 | import com.nimbusds.jose.crypto.RSADecrypter;
7 | import java.security.KeyFactory;
8 | import java.security.NoSuchAlgorithmException;
9 | import java.security.PrivateKey;
10 | import java.security.PublicKey;
11 | import java.security.spec.InvalidKeySpecException;
12 | import java.security.spec.PKCS8EncodedKeySpec;
13 | import java.security.spec.X509EncodedKeySpec;
14 | import java.text.ParseException;
15 | import java.util.Base64;
16 | import javax.annotation.PostConstruct;
17 | import lombok.extern.slf4j.Slf4j;
18 | import org.apache.commons.lang3.NotImplementedException;
19 | import org.springframework.beans.factory.annotation.Value;
20 | import org.springframework.context.annotation.Profile;
21 | import org.springframework.stereotype.Component;
22 |
23 | @Slf4j
24 | @Component
25 | @Profile("btp")
26 | public class CredentialStoreCryptoUtil {
27 |
28 | @Value("${sap.btp.credstore.clientPrivateKey}")
29 | private String clientPrivateKeyBase64;
30 |
31 | @Value("${sap.btp.credstore.serverPublicKey}")
32 | private String serverPublicKeyBase64;
33 |
34 | @Value("${sap.btp.credstore.encrypted}")
35 | private boolean encryptionEnabled;
36 |
37 | private PrivateKey ownPrivateKey;
38 |
39 | private PublicKey serverPublicKey;
40 |
41 | @PostConstruct
42 | private void prepare() throws NoSuchAlgorithmException, InvalidKeySpecException {
43 | if (!encryptionEnabled) {
44 | return;
45 | }
46 |
47 | KeyFactory rsaKeyFactory = KeyFactory.getInstance("RSA");
48 | PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(Base64.getDecoder()
49 | .decode(clientPrivateKeyBase64));
50 | this.ownPrivateKey = rsaKeyFactory.generatePrivate(pkcs8EncodedKeySpec);
51 |
52 | X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(Base64.getDecoder()
53 | .decode(serverPublicKeyBase64));
54 | this.serverPublicKey = rsaKeyFactory.generatePublic(x509EncodedKeySpec);
55 | }
56 |
57 | protected void encrypt() {
58 | throw new NotImplementedException("Encryption is still to be implemented yet.");
59 | }
60 |
61 | protected String decrypt(String jweResponse) {
62 | if (!encryptionEnabled) {
63 | return jweResponse;
64 | }
65 |
66 | JWEObject jweObject;
67 |
68 | try {
69 | RSADecrypter rsaDecrypter = new RSADecrypter(ownPrivateKey);
70 | jweObject = JWEObject.parse(jweResponse);
71 | jweObject.decrypt(rsaDecrypter);
72 |
73 | Payload payload = jweObject.getPayload();
74 | return payload.toString();
75 | } catch (ParseException | JOSEException e) {
76 | log.error("Failed to parse JWE response: {}.", e.getMessage());
77 | throw new RuntimeException(e);
78 | }
79 | }
80 | }
81 |
--------------------------------------------------------------------------------
/src/main/java/eu/europa/ec/dgc/issuance/utils/btp/SapCredential.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.utils.btp;
2 |
3 | import com.google.gson.Gson;
4 | import com.google.gson.GsonBuilder;
5 | import java.util.Date;
6 | import lombok.Data;
7 |
8 | @Data
9 | public class SapCredential {
10 |
11 | private String id;
12 | private String name;
13 | private Date modifiedAt;
14 | private String value;
15 | private String status;
16 | private String username;
17 | private String format;
18 | private String category;
19 | private String type;
20 |
21 | public static SapCredential fromJson(String rawJson) {
22 | return gson().fromJson(rawJson, SapCredential.class);
23 | }
24 |
25 | private static Gson gson() {
26 | return new GsonBuilder()
27 | .enableComplexMapKeySerialization()
28 | .create();
29 | }
30 |
31 | }
32 |
--------------------------------------------------------------------------------
/src/main/resources/META-INF/spring.factories:
--------------------------------------------------------------------------------
1 | io.pivotal.cfenv.spring.boot.CfEnvProcessor=eu.europa.ec.dgc.issuance.config.btp.SapCredentialStoreCfEnvProcessor
2 |
--------------------------------------------------------------------------------
/src/main/resources/application-btp.yml:
--------------------------------------------------------------------------------
1 | sap:
2 | btp:
3 | credstore:
4 | namespace: DgcaIssuerServiceCredentialStore
5 | encrypted: false
6 | username:
7 | password:
8 | url:
9 | clientPrivateKey:
10 | serverPublicKey:
11 |
--------------------------------------------------------------------------------
/src/main/resources/application-cloud.yml:
--------------------------------------------------------------------------------
1 | spring:
2 | h2:
3 | console:
4 | enabled: false
5 | datasource:
6 | driver-class-name: org.postgresql.Driver
7 | url: jdbc:postgresql://localhost:5432/postgres
8 | username: postgres
9 | password: postgres
10 | jpa:
11 | database-platform: org.hibernate.dialect.PostgreSQLDialect
12 |
--------------------------------------------------------------------------------
/src/main/resources/application.yml:
--------------------------------------------------------------------------------
1 | server:
2 | port: 8080
3 | spring:
4 | mvc:
5 | pathmatch:
6 | matching-strategy: ant_path_matcher
7 | application:
8 | name: dgca-issuance-service
9 | datasource:
10 | driver-class-name: org.h2.Driver
11 | url: jdbc:h2:mem:dgc;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=-1;
12 | username: sa
13 | password: ''
14 | jpa:
15 | database-platform: org.hibernate.dialect.H2Dialect
16 | hibernate:
17 | ddl-auto: validate
18 | liquibase:
19 | change-log: classpath:db/changelog.xml
20 | h2:
21 | console:
22 | enabled: true
23 | path: /h2-console
24 | management:
25 | endpoint:
26 | info:
27 | enabled: true
28 | health:
29 | enabled: true
30 | endpoints:
31 | enabled-by-default: false
32 | web:
33 | base-path: /management
34 | exposure:
35 | include: info,health
36 | info:
37 | name: ${spring.application.name}
38 | profiles: ${spring.profiles.active}
39 | springdoc:
40 | api-docs:
41 | path: /api/docs
42 | enabled: true
43 | swagger-ui:
44 | path: /swagger
45 | issuance:
46 | dgciPrefix: URN:UVCI:V1:DE
47 | keyStoreFile: certs/test.jks
48 | keyStorePassword: dgca
49 | certAlias: dev_ec
50 | privateKeyPassword: dgca
51 | countryCode: DE
52 | tanExpirationHours: 2
53 | contextFile: context/context.json
54 | expiration:
55 | vaccination: 365
56 | recovery: 365
57 | test: 3
58 | endpoints:
59 | frontendIssuing: true
60 | backendIssuing: false
61 | testTools: false
62 | wallet: true
63 | publishCert: true
64 | did: true
65 | dgc:
66 | gateway:
67 | connector:
68 | enabled: false
69 | # endpoint: https://dgc-gateway.example.com
70 | # proxy:
71 | # enabled: false
72 | # max-cache-age: 300
73 | # tls-trust-store:
74 | # password: dgcg-p4ssw0rd
75 | # path: classpath:tls_trust_store.p12
76 | # tls-key-store:
77 | # alias: 1
78 | # password: dgcg-p4ssw0rd
79 | # path: classpath:tls_key_store.p12
80 | # trust-anchor:
81 | # alias: ta
82 | # password: dgcg-p4ssw0rd
83 | # path: classpath:trust_anchor.jks
84 |
--------------------------------------------------------------------------------
/src/main/resources/db/changelog.xml:
--------------------------------------------------------------------------------
1 |
2 |
7 |
8 |
9 |
10 |
11 |
--------------------------------------------------------------------------------
/src/main/resources/db/changelog/init-tables.xml:
--------------------------------------------------------------------------------
1 |
2 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
--------------------------------------------------------------------------------
/src/main/resources/logback-spring.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
--------------------------------------------------------------------------------
/src/test/java/OpenApiTest.java:
--------------------------------------------------------------------------------
1 | import eu.europa.ec.dgc.issuance.DgcIssuanceApplication;
2 | import java.io.BufferedInputStream;
3 | import java.io.FileOutputStream;
4 | import java.net.URL;
5 | import lombok.extern.slf4j.Slf4j;
6 | import org.junit.jupiter.api.Assertions;
7 | import org.junit.jupiter.api.Test;
8 | import org.springframework.boot.test.context.SpringBootTest;
9 |
10 | @Slf4j
11 | @SpringBootTest(
12 | classes = DgcIssuanceApplication.class,
13 | properties = {
14 | "server.port=8080",
15 | "springdoc.api-docs.enabled=true",
16 | "springdoc.api-docs.path=/openapi"
17 | },
18 | webEnvironment = SpringBootTest.WebEnvironment.DEFINED_PORT
19 | )
20 | public class OpenApiTest {
21 |
22 | @Test
23 | public void apiDocs() {
24 | try (BufferedInputStream in = new BufferedInputStream(new URL("http://localhost:8080/openapi").openStream());
25 | FileOutputStream out = new FileOutputStream("target/openapi.json")) {
26 | byte[] buffer = new byte[1024];
27 | int read;
28 | while ((read = in.read(buffer, 0, buffer.length)) != -1) {
29 | out.write(buffer, 0, read);
30 | }
31 | } catch (Exception e) {
32 | log.error("Failed to download openapi specification.", e);
33 | Assertions.fail();
34 | }
35 | }
36 | }
37 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/EncodingTest.java:
--------------------------------------------------------------------------------
1 | /*-
2 | * ---license-start
3 | * EU Digital Green Certificate Issuance Service / dgca-issuance-service
4 | * ---
5 | * Copyright (C) 2021 T-Systems International GmbH and all other contributors
6 | * ---
7 | * Licensed under the Apache License, Version 2.0 (the "License");
8 | * you may not use this file except in compliance with the License.
9 | * You may obtain a copy of the License at
10 | *
11 | * http://www.apache.org/licenses/LICENSE-2.0
12 | *
13 | * Unless required by applicable law or agreed to in writing, software
14 | * distributed under the License is distributed on an "AS IS" BASIS,
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 | * See the License for the specific language governing permissions and
17 | * limitations under the License.
18 | * ---license-end
19 | */
20 |
21 | package eu.europa.ec.dgc.issuance;
22 |
23 | import com.nimbusds.jose.util.Base64URL;
24 | import eu.europa.ec.dgc.issuance.utils.DgciUtil;
25 | import eu.europa.ec.dgc.issuance.utils.HashUtil;
26 | import java.nio.charset.StandardCharsets;
27 | import java.security.MessageDigest;
28 | import java.util.UUID;
29 | import org.junit.jupiter.api.Test;
30 |
31 | import static org.junit.jupiter.api.Assertions.assertArrayEquals;
32 | import static org.junit.jupiter.api.Assertions.assertEquals;
33 |
34 | class EncodingTest {
35 |
36 | public static final String TEST_TAN = "U7ULCYZY";
37 | public static final String TEST_TAN_HASHED = "avmGz38ugM7uBePwKKlvh3IB8+7O+WFhQEbjIxhTxgY=";
38 |
39 | public static final String TEST_UUID = "cd7737d4-51ca-45f8-9f74-3a173b9a1f47";
40 | public static final String TEST_DGCI_REP = "NW393C1D87A44870V7TTFQMYC";
41 |
42 | @Test
43 | void testCreateSHA256Hash() {
44 | String output = HashUtil.sha256Base64(TEST_TAN);
45 | assertEquals(TEST_TAN_HASHED, output);
46 | }
47 |
48 | @Test
49 | void dgciEncoding() {
50 | UUID uuid = UUID.fromString(TEST_UUID);
51 | String dgciRep = DgciUtil.encodeDgci(uuid);
52 | assertEquals(25, dgciRep.length());
53 | assertEquals(TEST_DGCI_REP, dgciRep);
54 | }
55 |
56 | @Test
57 | void testBase64URL() throws Exception {
58 | String dgci= "URN:UVCI:V1:DE:NW513NLDH01JY3JCMU4M67WOHA";
59 | MessageDigest digest = MessageDigest.getInstance("SHA-256");
60 | byte[] hash = digest.digest(dgci.getBytes(StandardCharsets.UTF_8));
61 | String hashBase64URL = Base64URL.encode(hash).toString();
62 | System.out.println(hashBase64URL);
63 | assertArrayEquals(hash,Base64URL.from(hashBase64URL).decode());
64 | }
65 | }
66 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/GenerateWalletRequestTest.java:
--------------------------------------------------------------------------------
1 | /*-
2 | * ---license-start
3 | * EU Digital Green Certificate Issuance Service / dgca-issuance-service
4 | * ---
5 | * Copyright (C) 2021 T-Systems International GmbH and all other contributors
6 | * ---
7 | * Licensed under the Apache License, Version 2.0 (the "License");
8 | * you may not use this file except in compliance with the License.
9 | * You may obtain a copy of the License at
10 | *
11 | * http://www.apache.org/licenses/LICENSE-2.0
12 | *
13 | * Unless required by applicable law or agreed to in writing, software
14 | * distributed under the License is distributed on an "AS IS" BASIS,
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 | * See the License for the specific language governing permissions and
17 | * limitations under the License.
18 | * ---license-end
19 | */
20 |
21 | package eu.europa.ec.dgc.issuance;
22 |
23 | import com.fasterxml.jackson.databind.ObjectMapper;
24 | import com.fasterxml.jackson.databind.SerializationFeature;
25 | import eu.europa.ec.dgc.issuance.restapi.dto.ClaimRequest;
26 | import eu.europa.ec.dgc.issuance.restapi.dto.PublicKey;
27 | import java.nio.charset.StandardCharsets;
28 | import java.security.InvalidKeyException;
29 | import java.security.KeyPair;
30 | import java.security.KeyPairGenerator;
31 | import java.security.MessageDigest;
32 | import java.security.NoSuchAlgorithmException;
33 | import java.security.PrivateKey;
34 | import java.security.Signature;
35 | import java.security.SignatureException;
36 | import java.util.Base64;
37 | import org.junit.jupiter.api.Test;
38 |
39 | class GenerateWalletRequestTest {
40 | // This can be used to generate valid json structure for claim
41 | @Test
42 | void testGenerateWalletRequest() throws Exception {
43 | // Please adapt this to your certificate (the values can be get from browser network log
44 | // see POST /dgci
45 | // and PUT /dgci/{id}
46 | String dgci = "dgci:V1:DE:2e974b3b-d932-4bc9-bbae-d387f93f8bf3:edbcb873196f24be";
47 | String certHash = "mfg0MI7wPFexNkOa4n9OKojrzhe9a9lcim4JzJO3WtY=";
48 | String tan = "U7ULCYZY";
49 | String tanHash = "avmGz38ugM7uBePwKKlvh3IB8+7O+WFhQEbjIxhTxgY=";
50 |
51 | KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
52 | keyPairGen.initialize(2048);
53 | KeyPair keyPair = keyPairGen.generateKeyPair();
54 | byte[] publicKeyBytes = keyPair.getPublic().getEncoded();
55 | String sigAlg = "SHA256WithRSA";
56 |
57 | ClaimRequest claimRequest = new ClaimRequest();
58 | claimRequest.setDgci(dgci);
59 | claimRequest.setTanHash(tanHash);
60 | PublicKey publicKeyDTO = new PublicKey();
61 | publicKeyDTO.setType(keyPair.getPublic().getAlgorithm());
62 | publicKeyDTO.setValue(Base64.getEncoder().encodeToString(publicKeyBytes));
63 | claimRequest.setPublicKey(publicKeyDTO);
64 |
65 | claimRequest.setSigAlg(sigAlg);
66 | claimRequest.setCertHash(certHash);
67 | createClaimSignature(claimRequest, keyPair.getPrivate(), sigAlg);
68 |
69 | ObjectMapper objectMapper = new ObjectMapper().enable(SerializationFeature.INDENT_OUTPUT);
70 | System.out.println(objectMapper.writeValueAsString(claimRequest));
71 | }
72 |
73 | public static void main(String[] args) {
74 | try {
75 | final MessageDigest digest = MessageDigest.getInstance("SHA-256");
76 | final byte[] hashBytes = digest.digest("U7ULCYZY".getBytes(StandardCharsets.UTF_8));
77 | System.out.println(Base64.getEncoder().encodeToString(hashBytes));
78 | } catch (NoSuchAlgorithmException e) {
79 | throw new IllegalArgumentException(e);
80 | }
81 | }
82 |
83 | private void createClaimSignature(ClaimRequest claimRequest, PrivateKey privateKey, String sigAlg) throws InvalidKeyException, NoSuchAlgorithmException, SignatureException {
84 | StringBuilder sigValue = new StringBuilder();
85 | sigValue.append(claimRequest.getTanHash())
86 | .append(claimRequest.getCertHash())
87 | .append(claimRequest.getPublicKey().getValue());
88 | Signature signature = Signature.getInstance(sigAlg);
89 | signature.initSign(privateKey);
90 | signature.update(sigValue.toString().getBytes(StandardCharsets.UTF_8));
91 | byte[] sigData = signature.sign();
92 | claimRequest.setSignature(Base64.getEncoder().encodeToString(sigData));
93 | }
94 |
95 | @Test
96 | void testGenerateWalletRequestEC() throws Exception {
97 | // Please adapt this to your certificate (the values can be get from browser network log
98 | // see POST /dgci
99 | // and PUT /dgci/{id}
100 | String dgci = "dgci:V1:DE:2e974b3b-d932-4bc9-bbae-d387f93f8bf3:edbcb873196f24be";
101 | String certHash = "mfg0MI7wPFexNkOa4n9OKojrzhe9a9lcim4JzJO3WtY=";
102 | String tan = "U7ULCYZY";
103 | String tanHash = "avmGz38ugM7uBePwKKlvh3IB8+7O+WFhQEbjIxhTxgY=";
104 |
105 | KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("EC");
106 | keyPairGen.initialize(256);
107 | KeyPair keyPair = keyPairGen.generateKeyPair();
108 | byte[] publicKeyBytes = keyPair.getPublic().getEncoded();
109 | String sigAlg = "SHA256withECDSA";
110 |
111 | ClaimRequest claimRequest = new ClaimRequest();
112 | claimRequest.setDgci(dgci);
113 | claimRequest.setTanHash(tanHash);
114 | PublicKey publicKeyDTO = new PublicKey();
115 | publicKeyDTO.setType(keyPair.getPublic().getAlgorithm());
116 | publicKeyDTO.setValue(Base64.getEncoder().encodeToString(publicKeyBytes));
117 | claimRequest.setPublicKey(publicKeyDTO);
118 |
119 | claimRequest.setSigAlg(sigAlg);
120 | claimRequest.setCertHash(certHash);
121 | createClaimSignature(claimRequest,keyPair.getPrivate(),sigAlg);
122 |
123 | ObjectMapper objectMapper = new ObjectMapper().enable(SerializationFeature.INDENT_OUTPUT);
124 | System.out.println(objectMapper.writeValueAsString(claimRequest));
125 | }
126 |
127 | }
128 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/JwkCoreTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance;
2 |
3 | import com.fasterxml.jackson.databind.JsonNode;
4 | import com.fasterxml.jackson.databind.ObjectMapper;
5 | import com.fasterxml.jackson.databind.SerializationFeature;
6 | import com.nimbusds.jose.jwk.Curve;
7 | import com.nimbusds.jose.jwk.ECKey;
8 | import com.nimbusds.jose.jwk.RSAKey;
9 | import java.security.KeyPair;
10 | import java.security.KeyPairGenerator;
11 | import java.security.interfaces.ECPublicKey;
12 | import java.security.interfaces.RSAPublicKey;
13 | import org.junit.jupiter.api.Test;
14 |
15 | class JwkCoreTest {
16 | @Test
17 | void testRSAgeneration() throws Exception {
18 | KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
19 | keyPairGen.initialize(2048);
20 | KeyPair keyPair = keyPairGen.generateKeyPair();
21 |
22 | RSAKey jwkKey = new RSAKey.Builder((RSAPublicKey) keyPair.getPublic()).build();
23 | ObjectMapper objectMapper = new ObjectMapper().enable(SerializationFeature.INDENT_OUTPUT);
24 | String jwkString = jwkKey.toJSONString();
25 | JsonNode jwkElem = objectMapper.readTree(jwkString);
26 | System.out.println(jwkString);
27 | System.out.println(objectMapper.writeValueAsString(jwkElem));
28 | }
29 |
30 | @Test
31 | void testECgeneration() throws Exception {
32 | KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("EC");
33 | keyPairGen.initialize(256);
34 | KeyPair keyPair = keyPairGen.generateKeyPair();
35 | ECPublicKey ecPublicKey = (ECPublicKey) keyPair.getPublic();
36 | Curve curve = Curve.forECParameterSpec(ecPublicKey.getParams());
37 |
38 | ECKey jwkKey = new ECKey.Builder(curve,(ECPublicKey) keyPair.getPublic()).build();
39 | ObjectMapper objectMapper = new ObjectMapper().enable(SerializationFeature.INDENT_OUTPUT);
40 | String jwkString = jwkKey.toJSONString();
41 | JsonNode jwkElem = objectMapper.readTree(jwkString);
42 | System.out.println(objectMapper.writeValueAsString(jwkElem));
43 | }
44 | }
45 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/restapi/controller/CertControllerTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.restapi.controller;
2 |
3 | import eu.europa.ec.dgc.issuance.restapi.dto.PublicKeyInfo;
4 | import java.security.KeyFactory;
5 | import java.security.PublicKey;
6 | import java.security.spec.X509EncodedKeySpec;
7 | import java.util.Base64;
8 | import org.junit.jupiter.api.Test;
9 | import org.springframework.beans.factory.annotation.Autowired;
10 | import org.springframework.boot.test.context.SpringBootTest;
11 | import org.springframework.http.HttpStatus;
12 | import org.springframework.http.ResponseEntity;
13 |
14 | import static org.junit.jupiter.api.Assertions.assertEquals;
15 | import static org.junit.jupiter.api.Assertions.assertNotNull;
16 |
17 | @SpringBootTest
18 | class CertControllerTest {
19 | @Autowired
20 | CertController certController;
21 |
22 | @Test
23 | public void testPublicKey() throws Exception {
24 | ResponseEntity publicKeyResponse = certController.getPublic();
25 | assertEquals(HttpStatus.OK,publicKeyResponse.getStatusCode());
26 | publicKeyResponse.getBody();
27 | PublicKeyInfo publicKey = publicKeyResponse.getBody();
28 |
29 | byte[] keyBytes = Base64.getDecoder().decode(publicKey.getPublicKeyEncoded());
30 | X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
31 | KeyFactory kf = KeyFactory.getInstance(publicKey.getKeyType());
32 | PublicKey publicKeySec = kf.generatePublic(spec);
33 | assertNotNull(publicKeySec);
34 | }
35 | }
36 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/restapi/controller/ContextControllerTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.restapi.controller;
2 |
3 | import org.junit.jupiter.api.Test;
4 | import org.springframework.beans.factory.annotation.Autowired;
5 | import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
6 | import org.springframework.boot.test.context.SpringBootTest;
7 | import org.springframework.http.MediaType;
8 | import org.springframework.test.web.servlet.MockMvc;
9 |
10 | import static org.junit.jupiter.api.Assertions.*;
11 | import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
12 | import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
13 | import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
14 |
15 | @SpringBootTest
16 | @AutoConfigureMockMvc
17 | class ContextControllerTest {
18 |
19 | @Autowired
20 | private MockMvc mockMvc;
21 |
22 | @Test
23 | void getContext() throws Exception {
24 | mockMvc.perform(get("/context"))
25 | .andExpect(status().isOk())
26 | .andExpect(content().contentType(MediaType.APPLICATION_JSON))
27 | .andExpect(content().json("{\"Origin\":\"DE\",\"versions\":{}}"));
28 |
29 | }
30 |
31 | }
32 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/restapi/controller/DgciControllerTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.restapi.controller;
2 |
3 | import eu.europa.ec.dgc.issuance.restapi.dto.EgdcCodeData;
4 | import org.junit.jupiter.api.Test;
5 | import org.springframework.beans.factory.annotation.Autowired;
6 | import org.springframework.boot.test.context.SpringBootTest;
7 | import org.springframework.http.ResponseEntity;
8 |
9 | import static org.junit.jupiter.api.Assertions.assertNotNull;
10 |
11 | @SpringBootTest
12 | public class DgciControllerTest {
13 | @Autowired
14 | DgciBackendController dgciController;
15 |
16 | @Test
17 | void checkBackendIssuing() throws Exception {
18 | String edgc = "{\"ver\":\"1.0.0\",\"nam\":{\"fn\":\"Garcia\",\"fnt\":\"GARCIA\"," +
19 | "\"gn\":\"Francisco\",\"gnt\":\"FRANCISCO\"},\"dob\":\"1991-01-01\",\"v\":[{\"tg\":\"840539006\"," +
20 | "\"vp\":\"1119305005\",\"mp\":\"EU/1/20/1507\",\"ma\":\"ORG-100001699\",\"dn\":1,\"sd\":2,\"dt\":" +
21 | "\"2021-05-14\",\"co\":\"CY\",\"is\":\"Neha\",\"ci\":\"dgci:V1:CY:HIP4OKCIS8CXKQMJSSTOJXAMP:03\"}]}";
22 | ResponseEntity responseEntity = dgciController.createEdgc(edgc);
23 | assertNotNull(responseEntity.getBody());
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/service/ContextServiceTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import com.fasterxml.jackson.databind.JsonNode;
4 | import org.junit.jupiter.api.Test;
5 | import org.springframework.beans.factory.annotation.Autowired;
6 | import org.springframework.boot.test.context.SpringBootTest;
7 |
8 | import static org.junit.jupiter.api.Assertions.*;
9 |
10 | @SpringBootTest(
11 | properties = {
12 | "issuance.contextData = {\"test\":\"Data\"}"
13 | }
14 | )
15 | class ContextServiceTest {
16 |
17 | @Autowired
18 | ContextService contextService;
19 |
20 | @Test
21 | void getContextFromEnvironment() {
22 | JsonNode json = contextService.getContextDefinition();
23 | assertEquals("{\"test\":\"Data\"}",json.toString());
24 | }
25 |
26 | }
27 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/service/DGCGenTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import com.upokecenter.cbor.CBORObject;
4 | import com.upokecenter.cbor.CBORType;
5 | import ehn.techiop.hcert.kotlin.chain.Base45Service;
6 | import ehn.techiop.hcert.kotlin.chain.impl.DefaultBase45Service;
7 | import eu.europa.ec.dgc.issuance.entity.GreenCertificateType;
8 | import eu.europa.ec.dgc.issuance.restapi.dto.DgciIdentifier;
9 | import eu.europa.ec.dgc.issuance.restapi.dto.DgciInit;
10 | import eu.europa.ec.dgc.issuance.restapi.dto.EgcDecodeResult;
11 | import eu.europa.ec.dgc.issuance.restapi.dto.IssueData;
12 | import eu.europa.ec.dgc.issuance.restapi.dto.SignatureData;
13 | import java.io.ByteArrayInputStream;
14 | import java.io.IOException;
15 | import java.nio.charset.StandardCharsets;
16 | import java.time.Duration;
17 | import java.time.ZonedDateTime;
18 | import java.time.temporal.ChronoUnit;
19 | import java.util.Base64;
20 | import java.util.zip.Deflater;
21 | import java.util.zip.DeflaterInputStream;
22 | import org.junit.jupiter.api.Test;
23 | import org.springframework.beans.factory.annotation.Autowired;
24 | import org.springframework.boot.test.context.SpringBootTest;
25 |
26 | import static org.junit.jupiter.api.Assertions.assertNull;
27 | import static org.junit.jupiter.api.Assertions.assertTrue;
28 |
29 | /**
30 | * The test shows how produce edgc from json the same way the frontend is doing
31 | * using CBOR primitives
32 | */
33 | @SpringBootTest
34 | class DGCGenTest {
35 | @Autowired
36 | DgciService dgciService;
37 |
38 | @Autowired
39 | EdgcValidator edgcValidator;
40 |
41 | @Autowired
42 | CertificateService certificateService;
43 |
44 | @Test
45 | void genEDGC() throws IOException {
46 | String edgcJson = "{\"ver\":\"1.0.0\",\"nam\":{\"fn\":\"Garcia\",\"fnt\":\"GARCIA\"," +
47 | "\"gn\":\"Francisco\",\"gnt\":\"FRANCISCO\"},\"dob\":\"1991-01-01\",\"v\":[{\"tg\":\"840539006\"," +
48 | "\"vp\":\"1119305005\",\"mp\":\"EU/1/20/1507\",\"ma\":\"ORG-100001699\",\"dn\":1,\"sd\":2,\"dt\":" +
49 | "\"2021-05-14\",\"co\":\"CY\",\"is\":\"Neha\",\"ci\":\"dgci:V1:CY:HIP4OKCIS8CXKQMJSSTOJXAMP:03\"}]}";
50 | String countryCode = "DE";
51 | ZonedDateTime now = ZonedDateTime.now();
52 | ZonedDateTime expiration = now.plus(Duration.of(365, ChronoUnit.DAYS));
53 | long issuedAt = now.toInstant().getEpochSecond();
54 | long expirationSec = expiration.toInstant().getEpochSecond();
55 | byte[] keyId = "key".getBytes(StandardCharsets.UTF_8);
56 | int algId = -7;
57 |
58 | DgciInit dgciInit = new DgciInit();
59 | dgciInit.setGreenCertificateType(GreenCertificateType.Test);
60 | DgciIdentifier certData = dgciService.initDgci(dgciInit);
61 |
62 | byte[] dgcCbor = genDGCCbor(edgcJson, countryCode, issuedAt, certData.getExpired());
63 | byte[] coseBytes = genCoseUnsigned(dgcCbor, Base64.getDecoder().decode(certData.getKid())
64 | ,certData.getAlgId());
65 | byte[] hash = dgciService.computeCoseSignHash(coseBytes);
66 | IssueData issueData = new IssueData();
67 | issueData.setHash(Base64.getEncoder().encodeToString(hash));
68 | SignatureData sign = dgciService.finishDgci(certData.getId(), issueData);
69 | byte[] coseSigned = genSetSignature(coseBytes,Base64.getDecoder().decode(sign.getSignature()));
70 | String edgcQR = coseToQRCode(coseSigned);
71 |
72 | EgcDecodeResult validationResult = edgcValidator.decodeEdgc(edgcQR);
73 | assertTrue(validationResult.isValidated());
74 | assertNull(validationResult.getErrorMessage());
75 | }
76 |
77 | private byte[] genDGCCbor(String edgcJson, String countryCode, long issuedAt, long expirationSec) {
78 | CBORObject map = CBORObject.NewMap();
79 | map.set(CBORObject.FromObject(1),CBORObject.FromObject(countryCode));
80 | map.set(CBORObject.FromObject(6),CBORObject.FromObject(issuedAt));
81 | map.set(CBORObject.FromObject(4),CBORObject.FromObject(expirationSec));
82 | CBORObject hcertVersion = CBORObject.NewMap();
83 | CBORObject hcert = CBORObject.FromJSONString(edgcJson);
84 | hcertVersion.set(CBORObject.FromObject(1),hcert);
85 | map.set(CBORObject.FromObject(-260),hcertVersion);
86 | return map.EncodeToBytes();
87 | }
88 |
89 | private byte[] genCoseUnsigned(byte[] payload,byte[] keyId,int algId) {
90 | CBORObject protectedHeader = CBORObject.NewMap();
91 | protectedHeader.set(CBORObject.FromObject(1),CBORObject.FromObject(algId));
92 | protectedHeader.set(CBORObject.FromObject(4),CBORObject.FromObject(keyId));
93 | byte[] protectedHeaderBytes = protectedHeader.EncodeToBytes();
94 |
95 | CBORObject coseObject = CBORObject.NewArray();
96 | coseObject.Add(protectedHeaderBytes);
97 | coseObject.Add(CBORObject.NewMap());
98 | coseObject.Add(CBORObject.FromObject(payload));
99 | byte[] sigDummy = new byte[0];
100 | coseObject.Add(CBORObject.FromObject(sigDummy));
101 | return CBORObject.FromObjectAndTag(coseObject,18).EncodeToBytes();
102 | }
103 |
104 | private byte[] genSetSignature(byte[] coseData,byte[] signature) {
105 | CBORObject cborObject = CBORObject.DecodeFromBytes(coseData);
106 | if (cborObject.getType() == CBORType.Array && cborObject.getValues().size()==4) {
107 | cborObject.set(3,CBORObject.FromObject(signature));
108 | } else {
109 | throw new IllegalArgumentException("seems not to be cose");
110 | }
111 | return cborObject.EncodeToBytes();
112 | }
113 |
114 | private String coseToQRCode(byte[] cose) throws IOException {
115 | ByteArrayInputStream bis = new ByteArrayInputStream(cose);
116 | DeflaterInputStream compessedInput = new DeflaterInputStream(bis, new Deflater(9));
117 | byte[] coseCompressed = compessedInput.readAllBytes();
118 | Base45Service base45Service = new DefaultBase45Service();
119 | String coded = base45Service.encode(coseCompressed);
120 | return "HC1:"+coded;
121 | }
122 | }
123 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/service/DgciGeneratorTest.java:
--------------------------------------------------------------------------------
1 | /*-
2 | * ---license-start
3 | * EU Digital Green Certificate Issuance Service / dgca-issuance-service
4 | * ---
5 | * Copyright (C) 2021 T-Systems International GmbH and all other contributors
6 | * ---
7 | * Licensed under the Apache License, Version 2.0 (the "License");
8 | * you may not use this file except in compliance with the License.
9 | * You may obtain a copy of the License at
10 | *
11 | * http://www.apache.org/licenses/LICENSE-2.0
12 | *
13 | * Unless required by applicable law or agreed to in writing, software
14 | * distributed under the License is distributed on an "AS IS" BASIS,
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 | * See the License for the specific language governing permissions and
17 | * limitations under the License.
18 | * ---license-end
19 | */
20 |
21 | package eu.europa.ec.dgc.issuance.service;
22 |
23 | import eu.europa.ec.dgc.issuance.config.IssuanceConfigProperties;
24 | import org.junit.jupiter.api.Test;
25 |
26 | import static org.junit.jupiter.api.Assertions.assertNotNull;
27 | import static org.junit.jupiter.api.Assertions.assertTrue;
28 |
29 | class DgciGeneratorTest {
30 | @Test
31 | void testGenerateDGCI() {
32 | IssuanceConfigProperties issuanceConfigProperties = new IssuanceConfigProperties();
33 | issuanceConfigProperties.setDgciPrefix("URN:UVCI:V1:DE");
34 | DgciGenerator dgciGenerator = new DgciGenerator(issuanceConfigProperties);
35 | String dgci = dgciGenerator.newDgci();
36 | assertNotNull(dgci);
37 | assertTrue(dgci.startsWith(issuanceConfigProperties.getDgciPrefix()));
38 | assertTrue(dgci.length() <= 50,"dgci too long");
39 | System.out.println(dgci);
40 | }
41 | }
42 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/service/EdgcValidatorTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import eu.europa.ec.dgc.issuance.restapi.dto.EgcDecodeResult;
4 | import org.junit.jupiter.api.Test;
5 | import org.springframework.beans.factory.annotation.Autowired;
6 | import org.springframework.boot.test.context.SpringBootTest;
7 |
8 | import static org.junit.jupiter.api.Assertions.*;
9 |
10 |
11 | @SpringBootTest
12 | class EdgcValidatorTest {
13 | @Autowired
14 | EdgcValidator edgcValidator;
15 |
16 | @Test
17 | void testValidateSamples() throws Exception {
18 | String testData = "HC1:6BFOXN%TSMAHN-H/P8JU6+BS.5E9%UD82.7JJ59W2TT+FM*4/IQ0YVKQCPTHCV4*XUA2PWKP/HLIJL8JF8J" +
19 | "F7LPMIH-O92UQ7QQ%NH0LA5O6/UIGSU7QQ7NGWWBA 7.UIAYU3X3SH90THYZQ H9+W3.G8MSGPRAAUICO1DV59UE6Q1M650 LHZA0" +
20 | "D9E2LBHHGKLO-K%FGLIA5D8MJKQJK JMDJL9GG.IA.C8KRDL4O54O4IGUJKJGI.IAHLCV5GVWN.FKP123NJ%HBX/KR968X2-36/-K" +
21 | "KTCY73$80PU6QW6H+932QDONAC5287T:7N95*K64POPGI*%DC*G2KV SU1Y6B.QEN7+SQ4:4P2C:8UFOFC072.T2PE0*J65UY.2ED" +
22 | "TYJDK8W$WKF.VUV9L+VF3TY71NSFIM2F:47*J0JLV50M1WB*C";
23 |
24 | EgcDecodeResult result = edgcValidator.decodeEdgc(testData);
25 | assertTrue(result.isValidated());
26 | assertNull(result.getErrorMessage());
27 | }
28 |
29 | @Test
30 | void testValidateAUSamples() throws Exception {
31 | String testData = "HC1:NCFOXN%TS3DHZN4HAF*PQFKKGTNA.Q/R8WRU2FCGJ9ZU6+9GNH5%DW+70ZMIN9HNO4*J8OX4W$C2VL*LA 4" +
32 | "3/IE%TE6UG+ZEAT1HQ13W1:O1YUI%F1PN1/T1J$HTR9/O14SI.J9DYHZROVZ05QNZ 20OP748$NI4L6RXKYQ8FRKBYOBM4T$7U-N0" +
33 | "O4RK43%JTXO$WOS%H*-VZIEQKERQ8IY1I$HH%U8 9PS5OH6*ZUFZFEPG:YN/P3JRH8LHGL2-LH/CJTK96L6SR9MU9DV5 R1:PI/E2" +
34 | "$4J6AL.+I9UV6$0+BNPHNBC7CTR3$VDY0DUFRLN/Y0Y/K9/IIF0%:K6*K$X4FUTD14//E3:FL.B$JDBLEH-BL1H6TK-CI:ULOPD6LF" +
35 | "20HFJC3DAYJDPKDUDBQEAJJKHHGEC8ZI9$JAQJKZ%K.CPM+81727KGB9S3EM.KV+LP:14JME*2T/5OFDSM*E.4RYXRN2IMA5GDUGS" +
36 | "0/X6*CW0Z3XZFK+FT6GF-I5U9:0J.LIVB0+2T+1K4OUWGQUKM.P6V20KK1R3";
37 |
38 | EgcDecodeResult result = edgcValidator.decodeEdgc(testData);
39 | // it can be not validated because different key
40 | assertFalse(result.isValidated());
41 | assertNull(result.getErrorMessage());
42 | }
43 |
44 | }
45 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/service/ExpirationServiceTest.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | import com.fasterxml.jackson.databind.ObjectMapper;
4 | import ehn.techiop.hcert.kotlin.data.GreenCertificate;
5 | import java.time.LocalDateTime;
6 | import java.time.ZoneOffset;
7 | import kotlinx.serialization.json.Json;
8 | import org.junit.jupiter.api.Test;
9 | import org.springframework.beans.factory.annotation.Autowired;
10 | import org.springframework.boot.test.context.SpringBootTest;
11 |
12 | import static org.junit.jupiter.api.Assertions.assertNotNull;
13 |
14 | @SpringBootTest
15 | class ExpirationServiceTest {
16 | @Autowired
17 | ExpirationService expirationService;
18 | ObjectMapper objectMapper = new ObjectMapper();
19 |
20 | @Test
21 | void testExpriationCalculation() throws Exception {
22 | String vacDataJson = SampleData.vaccination;
23 | GreenCertificate eudgc = testCalculation("vactination",vacDataJson);
24 | System.out.println(eudgc.getVaccinations()[0].getDate());
25 | String recoveryDataJson = SampleData.recovery;
26 | eudgc = testCalculation("recovery",recoveryDataJson);
27 | System.out.println(eudgc.getRecoveryStatements()[0].getCertificateValidUntil());
28 | String testDataJson = SampleData.testNaa;
29 | eudgc = testCalculation("test",testDataJson);
30 | System.out.println(eudgc.getTests()[0].getDateTimeSample());
31 | assertNotNull(eudgc);
32 |
33 | }
34 |
35 | private GreenCertificate testCalculation(String description, String vacDataJson) throws com.fasterxml.jackson.core.JsonProcessingException {
36 | System.out.println("testing: "+description);
37 | GreenCertificate eudgc = Json.Default.decodeFromString(GreenCertificate.Companion.serializer(), vacDataJson);
38 | ExpirationService.CwtTimeFields expTime = expirationService.calculateCwtExpiration(eudgc);
39 | LocalDateTime issuedAt = LocalDateTime.ofEpochSecond(expTime.getIssuedAt(), 0, ZoneOffset.UTC);
40 | assertNotNull(issuedAt);
41 | System.out.println(issuedAt);
42 | LocalDateTime expired = LocalDateTime.ofEpochSecond(expTime.getExpiration(), 0, ZoneOffset.UTC);
43 | System.out.println(expired);
44 | return eudgc;
45 | }
46 | }
47 |
--------------------------------------------------------------------------------
/src/test/java/eu/europa/ec/dgc/issuance/service/SampleData.java:
--------------------------------------------------------------------------------
1 | package eu.europa.ec.dgc.issuance.service;
2 |
3 | public class SampleData {
4 | public static final String recovery = "{\n" +
5 | " \"ver\": \"1.2.1\",\n" +
6 | " \"nam\": {\n" +
7 | " \"fn\": \"Musterfrau-G\\u00f6\\u00dfinger\",\n" +
8 | " \"gn\": \"Gabriele\",\n" +
9 | " \"fnt\": \"MUSTERFRAU
8 | 
9 | 
10 | 
|
87 |
88 | ## How to contribute
89 |
90 | Contribution and feedback is encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our [Contribution Guidelines](./CONTRIBUTING.md). By participating in this project, you agree to abide by its [Code of Conduct](./CODE_OF_CONDUCT.md) at all times.
91 |
92 | ## Contributors
93 |
94 | Our commitment to open source means that we are enabling -in fact encouraging- all interested parties to contribute and become part of its developer community.
95 |
96 | ## Licensing
97 |
98 | Copyright (C) 2021 T-Systems International GmbH and all other contributors
99 |
100 | Licensed under the **Apache License, Version 2.0** (the "License"); you may not use this file except in compliance with the License.
101 |
102 | You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0.
103 |
104 | Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the [LICENSE](./LICENSE) for the specific language governing permissions and limitations under the License.
105 |
--------------------------------------------------------------------------------
/certs/test.jks:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/eu-digital-green-certificates/dgca-issuance-service/aed1ff285c0b7033c1ff2dc8c0efc6a532fcf948/certs/test.jks
--------------------------------------------------------------------------------
/context/context.json:
--------------------------------------------------------------------------------
1 | {
2 | "origin": "DE",
3 | "versions": {
4 | "default": {
5 | "privacyUrl": "https://publications.europa.eu/en/web/about-us/legal-notices/eu-mobile-apps",
6 | "context": {
7 | "url": "https://issuance-dgca-test.cfapps.eu10.hana.ondemand.com/dgca-issuance-service/context",
8 | "pubKeys": [
9 | "lKdU1EbQubxyDDm2q3N8KclZ2C94Num3xXjG0pk+3eI=",
10 | "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="
11 | ]
12 | },
13 | "endpoints": {
14 | "claim": {
15 | "url": "https://dgca-issuance-web-eu-test.cfapps.eu10.hana.ondemand.com/dgca-issuance-service/dgci/wallet/claim",
16 | "pubKeys": [
17 | "lKdU1EbQubxyDDm2q3N8KclZ2C94Num3xXjG0pk+3eI=",
18 | "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="
19 | ]
20 | },
21 | "countryList": {
22 | "url": "https://dgca-businessrule-service-eu-test.cfapps.eu10.hana.ondemand.com/countrylist",
23 | "pubKeys": [
24 | "lKdU1EbQubxyDDm2q3N8KclZ2C94Num3xXjG0pk+3eI=",
25 | "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="
26 | ]
27 | },
28 | "rules": {
29 | "url": "https://dgca-businessrule-service-eu-test.cfapps.eu10.hana.ondemand.com/rules",
30 | "pubKeys": [
31 | "lKdU1EbQubxyDDm2q3N8KclZ2C94Num3xXjG0pk+3eI=",
32 | "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="
33 | ]
34 | },
35 | "valuesets": {
36 | "url": "https://dgca-businessrule-service-eu-test.cfapps.eu10.hana.ondemand.com/valuesets",
37 | "pubKeys": [
38 | "lKdU1EbQubxyDDm2q3N8KclZ2C94Num3xXjG0pk+3eI=",
39 | "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="
40 | ]
41 | },
42 | "revocation": {
43 | "url": "https://dgca-revocation-service-eu-test.cfapps.eu10.hana.ondemand.com",
44 | "pubKeys": [
45 | "lKdU1EbQubxyDDm2q3N8KclZ2C94Num3xXjG0pk+3eI=",
46 | "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="
47 | ]
48 | }
49 | }
50 | },
51 | "0.1.0": {
52 | "outdated": true
53 | }
54 | }
55 | }
56 |
--------------------------------------------------------------------------------
/docker-compose.yml:
--------------------------------------------------------------------------------
1 | version: '3'
2 |
3 | services:
4 | postgres:
5 | image: library/postgres:9.6
6 | container_name: dgc-issuance-service-postgres
7 | ports:
8 | - 5432:5432
9 | environment:
10 | POSTGRES_DB: postgres
11 | POSTGRES_USER: postgres
12 | POSTGRES_PASSWORD: postgres
13 | restart: unless-stopped
14 | networks:
15 | persistence:
16 |
17 | backend:
18 | build: .
19 | image: eu-digital-green-certificates/dgc-issuance-service
20 | container_name: dgc-issuance-service
21 | ports:
22 | - 8080:8080
23 | environment:
24 | - SERVER_PORT=8080
25 | - SPRING_PROFILES_ACTIVE=cloud
26 | - SPRING_DATASOURCE_URL=jdbc:postgresql://dgc-issuance-service-postgres:5432/postgres
27 | - SPRING_DATASOURCE_USERNAME=postgres
28 | - SPRING_DATASOURCE_PASSWORD=postgres
29 | depends_on:
30 | - postgres
31 | networks:
32 | backend:
33 | persistence:
34 | restart: unless-stopped
35 |
36 | networks:
37 | backend:
38 | persistence:
39 |
--------------------------------------------------------------------------------
/docs/configuration.md:
--------------------------------------------------------------------------------
1 | # Configuration Manual of Issuance Service
2 |
3 | # Introduction
4 | Issuance Service is developed as self-contained spring boot application.
5 | The issuance application consist of 2 parts
6 | * dgca-issuance-service - this spring boot application. Backend application that serves services as REST Endpoints.
7 | * [dgca-issuance-web](https://github.com/eu-digital-green-certificates/dgca-issuance-web) - Web frontend programmed using React framework
8 | The documentation here concern only dgca-issuance-service
9 | The configuration of issuance service is done using [spring boot configuration capabilities](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config).
10 |
11 | # Default Configuration
12 | The default configuration (default profile) is defined by file src/main/resources/application.yml
13 | It is part of application deployment and is used as default.
14 | This default configuration is set to enable easy start of application out-of-the-box without additional dependencies but
15 | it is not usable for productive environment and miss some functionality.
16 | * usage of in-memory h2 database - all data are lost by restart
17 | * use public test keystore for signing - see certs/test.jks
18 | * no connection to dgc-gateway - the publish key endpoint is not usable
19 |
20 | # Configuring Signing Keys for EDGC (European Green Certificate)
21 | The issuance service needs private-public key to sign the EDGC.
22 | The keys are stored in jks-keystore file and protected by password.
23 | The private key is protected by additional password.
24 | There are cert/test.jks file that are provided for testing purposes only.
25 | You need to create own private key and keep it secret.
26 | The issuance service may use only one private key to sign the message.
27 |
28 | Following properties defines it (compare src/main/resources/application.yml)
29 |
30 | ```
31 | issuance:
32 | keyStoreFile: certs/test.jks
33 | keyStorePassword: dgca
34 | certAlias: edgc_dev_ec
35 | privateKeyPassword: dgca
36 | ```
37 |
38 | You may use the [Keystore Explorer](https://keystore-explorer.org/) to create jks keystore file and certificates.
39 | Following key types are supported
40 | * EC P-256 (for primary edgc algorihm)
41 | * RSA 2048 bit (for secondary egdc algorithm)
42 |
43 | For detailed informations see: https://ec.europa.eu/health/ehealth/covid-19_en
44 |
45 | # Configuring EDGC Parameters
46 | Following parameter configure the creation and handling of EDGC
47 |
48 | ```
49 | issuance:
50 | dgciPrefix: dgci:V1:DE
51 | countryCode: DE
52 | tanExpirationHours: 2
53 | expiration:
54 | vaccination: 365
55 | recovery: 365
56 | test: 60
57 | ```
58 |
59 | The dgciPrefix, countryCode and expiration are used to set up the EDGC fields.
60 | The tanExpirationHours is used to expire first TAN for wallet claim process.
61 |
62 | # Configuring Database
63 | The application needs a database to store dgci data and claim.
64 | The default database is in-memory H2 database and is usable for development only.
65 | In the spring profile "cloud" see src/main/resources/application-cloud.yml there are example postgres database configured.
66 | Consult [spring boot manuals](https://docs.spring.io/spring-boot/docs/current/reference/html/howto.html#howto-data-access)
67 |
68 | # Context File
69 | Context file is used by wallet app for url pinning. It will be server at /context endpoint without any other modification.
70 | If the context file is not configured and empty context json will be returned.
71 |
72 | ```
73 | issuance:
74 | context: context.json
75 | ```
76 |
77 | # Enabling and Disabling Endpoints
78 |
79 | The endpoints are grouped by functions and can be enabled or disabled per configuration.
80 | Default configuration for endpoints.
81 |
82 | ```
83 | issuance:
84 | endpoints:
85 | frontendIssuing: true
86 | backendIssuing: false
87 | testTools: false
88 | wallet: true
89 | publishCert: true
90 | did: true
91 | ```
92 |
93 | | group | endpoints |
94 | | ----------------|-------------------------- |
95 | | frontendIssuing | `POST /dgci`