-
Notifications
You must be signed in to change notification settings - Fork 224
Expand file tree
/
Copy pathPki.java
More file actions
591 lines (562 loc) · 30.3 KB
/
Pki.java
File metadata and controls
591 lines (562 loc) · 30.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
package com.bettercloud.vault.api.pki;
import com.bettercloud.vault.VaultConfig;
import com.bettercloud.vault.VaultException;
import com.bettercloud.vault.json.Json;
import com.bettercloud.vault.json.JsonObject;
import com.bettercloud.vault.response.PkiResponse;
import com.bettercloud.vault.rest.Rest;
import com.bettercloud.vault.rest.RestResponse;
import java.nio.charset.StandardCharsets;
import java.util.List;
/**
* <p>The implementing class for operations on Vault's PKI backend.</p>
*
* <p>This class is not intended to be constructed directly. Rather, it is meant to used by way of <code>Vault</code>
* in a DSL-style builder pattern. See the Javadoc comments of each <code>public</code> method for usage examples.</p>
*/
public class Pki {
private final VaultConfig config;
private final String mountPath;
private String nameSpace;
public Pki withNameSpace(final String nameSpace) {
this.nameSpace = nameSpace;
return this;
}
/**
* Constructor for use when the PKI backend is mounted on the default path (i.e. <code>/v1/pki</code>).
*
* @param config A container for the configuration settings needed to initialize a <code>Vault</code> driver instance
*/
public Pki(final VaultConfig config) {
this.config = config;
this.mountPath = "pki";
if (this.config.getNameSpace() != null && !this.config.getNameSpace().isEmpty()) {
this.nameSpace = this.config.getNameSpace();
}
}
/**
* Constructor for use when the PKI backend is mounted on some non-default custom path (e.g. <code>/v1/root-ca</code>).
*
* @param config A container for the configuration settings needed to initialize a <code>Vault</code> driver instance
* @param mountPath The path on which your Vault PKI backend is mounted, without the <code>/v1/</code> prefix (e.g. <code>"root-ca"</code>)
*/
public Pki(final VaultConfig config, final String mountPath) {
this.config = config;
this.mountPath = mountPath;
if (this.config.getNameSpace() != null && !this.config.getNameSpace().isEmpty()) {
this.nameSpace = this.config.getNameSpace();
}
}
/**
* <p>Operation to create an role using the PKI backend. Relies on an authentication token being present in
* the <code>VaultConfig</code> instance.</p>
*
* <p>This version of the method uses default values for all optional settings. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
* final PkiResponse response = vault.pki().createOrUpdateRole("testRole");
*
* assertEquals(204, response.getRestResponse().getStatus());
* }</pre>
* </blockquote>
*
* @param roleName A name for the role to be created or updated
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse createOrUpdateRole(final String roleName) throws VaultException {
return createOrUpdateRole(roleName, null);
}
/**
* <p>Operation to create an role using the PKI backend. Relies on an authentication token being present in
* the <code>VaultConfig</code> instance.</p>
*
* <p>This version of the method accepts a <code>RoleOptions</code> parameter, containing optional settings
* for the role creation operation. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
*
* final RoleOptions options = new RoleOptions()
* .allowedDomains(new ArrayList<String>(){{ add("myvault.com"); }})
* .allowSubdomains(true)
* .maxTtl("9h");
* final PkiResponse response = vault.pki().createOrUpdateRole("testRole", options);
*
* assertEquals(204, response.getRestResponse().getStatus());
* }</pre>
* </blockquote>
*
* @param roleName A name for the role to be created or updated
* @param options Optional settings for the role to be created or updated (e.g. allowed domains, ttl, etc)
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse createOrUpdateRole(final String roleName, final RoleOptions options) throws VaultException {
int retryCount = 0;
while (true) {
try {
final String requestJson = roleOptionsToJson(options);
final RestResponse restResponse = new Rest()//NOPMD
.url(String.format("%s/v1/%s/roles/%s", config.getAddress(), this.mountPath, roleName))
.header("X-Vault-Token", config.getToken())
.header("X-Vault-Namespace", this.nameSpace)
.body(requestJson.getBytes(StandardCharsets.UTF_8))
.connectTimeoutSeconds(config.getOpenTimeout())
.readTimeoutSeconds(config.getReadTimeout())
.sslVerification(config.getSslConfig().isVerify())
.sslContext(config.getSslConfig().getSslContext())
.post();
// Validate restResponse
if (restResponse.getStatus() != 204) {
throw new VaultException("Vault responded with HTTP status code: " + restResponse.getStatus(), restResponse.getStatus());
}
return new PkiResponse(restResponse, retryCount);
} catch (Exception e) {
// If there are retries to perform, then pause for the configured interval and then execute the loop again...
if (retryCount < config.getMaxRetries()) {
retryCount++;
try {
final int retryIntervalMilliseconds = config.getRetryIntervalMilliseconds();
Thread.sleep(retryIntervalMilliseconds);
} catch (InterruptedException e1) {
e1.printStackTrace();
}
} else if (e instanceof VaultException) {
// ... otherwise, give up.
throw (VaultException) e;
} else {
throw new VaultException(e);
}
}
}
}
/**
* <p>Operation to retrieve an role using the PKI backend. Relies on an authentication token being present in
* the <code>VaultConfig</code> instance.</p>
*
* <p>The role information will be populated in the <code>roleOptions</code> field of the <code>PkiResponse</code>
* return value. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
* final PkiResponse response = vault.pki().getRole("testRole");
*
* final RoleOptions details = response.getRoleOptions();
* }</pre>
* </blockquote>
*
* @param roleName The name of the role to retrieve
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse getRole(final String roleName) throws VaultException {
int retryCount = 0;
while (true) {
// Make an HTTP request to Vault
try {
final RestResponse restResponse = new Rest()//NOPMD
.url(String.format("%s/v1/%s/roles/%s", config.getAddress(), this.mountPath, roleName))
.header("X-Vault-Token", config.getToken())
.header("X-Vault-Namespace", this.nameSpace)
.connectTimeoutSeconds(config.getOpenTimeout())
.readTimeoutSeconds(config.getReadTimeout())
.sslVerification(config.getSslConfig().isVerify())
.sslContext(config.getSslConfig().getSslContext())
.get();
// Validate response
if (restResponse.getStatus() != 200 && restResponse.getStatus() != 404) {
throw new VaultException("Vault responded with HTTP status code: " + restResponse.getStatus(), restResponse.getStatus());
}
return new PkiResponse(restResponse, retryCount);
} catch (Exception e) {
// If there are retries to perform, then pause for the configured interval and then execute the loop again...
if (retryCount < config.getMaxRetries()) {
retryCount++;
try {
final int retryIntervalMilliseconds = config.getRetryIntervalMilliseconds();
Thread.sleep(retryIntervalMilliseconds);
} catch (InterruptedException e1) {
e1.printStackTrace();
}
} else if (e instanceof VaultException) {
// ... otherwise, give up.
throw (VaultException) e;
} else {
throw new VaultException(e);
}
}
}
}
/**
* <p>Operation to revike a certificate in the vault using the PKI backend.
* Relies on an authentication token being present in
* the <code>VaultConfig</code> instance.</p>
*
* <p>A successful operation will return a 204 HTTP status. A <code>VaultException</code> will be thrown if
* the role does not exist, or if any other problem occurs. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
*
* final PkiResponse response = vault.pki().revoke("serialnumber");
* assertEquals(204, response.getRestResponse().getStatus();
* }</pre>
* </blockquote>
*
* @param serialNumber The name of the role to delete
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse revoke(final String serialNumber) throws VaultException {
int retryCount = 0;
while (true) {
// Make an HTTP request to Vault
JsonObject jsonObject = new JsonObject();
if (serialNumber != null) {
jsonObject.add("serial_number", serialNumber);
}
final String requestJson = jsonObject.toString();
try {
final RestResponse restResponse = new Rest()//NOPMD
.url(String.format("%s/v1/%s/revoke", config.getAddress(), this.mountPath))
.header("X-Vault-Token", config.getToken())
.header("X-Vault-Namespace", this.nameSpace)
.connectTimeoutSeconds(config.getOpenTimeout())
.readTimeoutSeconds(config.getReadTimeout())
.body(requestJson.getBytes(StandardCharsets.UTF_8))
.sslVerification(config.getSslConfig().isVerify())
.sslContext(config.getSslConfig().getSslContext())
.post();
// Validate response
if (restResponse.getStatus() != 200) {
throw new VaultException("Vault responded with HTTP status code: " + restResponse.getStatus(), restResponse.getStatus());
}
return new PkiResponse(restResponse, retryCount);
} catch (Exception e) {
// If there are retries to perform, then pause for the configured interval and then execute the loop again...
if (retryCount < config.getMaxRetries()) {
retryCount++;
try {
final int retryIntervalMilliseconds = config.getRetryIntervalMilliseconds();
Thread.sleep(retryIntervalMilliseconds);
} catch (InterruptedException e1) {
e1.printStackTrace();
}
} else if (e instanceof VaultException) {
// ... otherwise, give up.
throw (VaultException) e;
} else {
throw new VaultException(e);
}
}
}
}
/**
* <p>Operation to delete an role using the PKI backend. Relies on an authentication token being present in
* the <code>VaultConfig</code> instance.</p>
*
* <p>A successful operation will return a 204 HTTP status. A <code>VaultException</code> will be thrown if
* the role does not exist, or if any other problem occurs. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
*
* final PkiResponse response = vault.pki().deleteRole("testRole");
* assertEquals(204, response.getRestResponse().getStatus();
* }</pre>
* </blockquote>
*
* @param roleName The name of the role to delete
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse deleteRole(final String roleName) throws VaultException {
int retryCount = 0;
while (true) {
// Make an HTTP request to Vault
try {
final RestResponse restResponse = new Rest()//NOPMD
.url(String.format("%s/v1/%s/roles/%s", config.getAddress(), this.mountPath, roleName))
.header("X-Vault-Token", config.getToken())
.header("X-Vault-Namespace", this.nameSpace)
.connectTimeoutSeconds(config.getOpenTimeout())
.readTimeoutSeconds(config.getReadTimeout())
.sslVerification(config.getSslConfig().isVerify())
.sslContext(config.getSslConfig().getSslContext())
.delete();
// Validate response
if (restResponse.getStatus() != 204) {
throw new VaultException("Vault responded with HTTP status code: " + restResponse.getStatus(), restResponse.getStatus());
}
return new PkiResponse(restResponse, retryCount);
} catch (Exception e) {
// If there are retries to perform, then pause for the configured interval and then execute the loop again...
if (retryCount < config.getMaxRetries()) {
retryCount++;
try {
final int retryIntervalMilliseconds = config.getRetryIntervalMilliseconds();
Thread.sleep(retryIntervalMilliseconds);
} catch (InterruptedException e1) {
e1.printStackTrace();
}
} else if (e instanceof VaultException) {
// ... otherwise, give up.
throw (VaultException) e;
} else {
throw new VaultException(e);
}
}
}
}
/**
* <p>Operation to generate a new set of credentials (private key and certificate) based on a given role using
* the PKI backend. The issuing CA certificate is returned as well, so that only the root CA need be in a
* client's trust store.</p>
*
* <p>A successful operation will return a 204 HTTP status. A <code>VaultException</code> will be thrown if
* the role does not exist, or if any other problem occurs. Credential information will be populated in the
* <code>credential</code> field of the <code>PkiResponse</code> return value. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
*
* final PkiResponse response = vault.pki().deleteRole("testRole");
* assertEquals(204, response.getRestResponse().getStatus();
* }</pre>
* </blockquote>
*
* @param roleName The role on which the credentials will be based.
* @param commonName The requested CN for the certificate. If the CN is allowed by role policy, it will be issued.
* @param altNames (optional) Requested Subject Alternative Names, in a comma-delimited list. These can be host names or email addresses; they will be parsed into their respective fields. If any requested names do not match role policy, the entire request will be denied.
* @param ipSans (optional) Requested IP Subject Alternative Names, in a comma-delimited list. Only valid if the role allows IP SANs (which is the default).
* @param ttl (optional) Requested Time To Live. Cannot be greater than the role's max_ttl value. If not provided, the role's ttl value will be used. Note that the role values default to system values if not explicitly set.
* @param format (optional) Format for returned data. Can be pem, der, or pem_bundle; defaults to pem. If der, the output is base64 encoded. If pem_bundle, the certificate field will contain the private key, certificate, and issuing CA, concatenated.
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse issue(
final String roleName,
final String commonName,
final List<String> altNames,
final List<String> ipSans,
final String ttl,
final CredentialFormat format) throws VaultException {
return issue(roleName, commonName, altNames, ipSans, ttl, format, true, "");
}
/**
* <p>Operation to generate a new set of credentials or sign the embedded CSR, in the PKI backend. If CSR is passed the
* sign function of the vault will be called if not, issue will be used.
* The issuing CA certificate is returned as well, so that only the root CA need be in a
* client's trust store.</p>
*
* <p>A successful operation will return a 204 HTTP status. A <code>VaultException</code> will be thrown if
* the role does not exist, or if any other problem occurs. Credential information will be populated in the
* <code>credential</code> field of the <code>PkiResponse</code> return value. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
*
* final PkiResponse response = vault.pki().deleteRole("testRole");
* assertEquals(204, response.getRestResponse().getStatus();
* }</pre>
* </blockquote>
*
* @param roleName The role on which the credentials will be based.
* @param commonName The requested CN for the certificate. If the CN is allowed by role policy, it will be issued.
* @param altNames (optional) Requested Subject Alternative Names, in a comma-delimited list. These can be host names or email addresses; they will be parsed into their respective fields. If any requested names do not match role policy, the entire request will be denied.
* @param ipSans (optional) Requested IP Subject Alternative Names, in a comma-delimited list. Only valid if the role allows IP SANs (which is the default).
* @param ttl (optional) Requested Time To Live. Cannot be greater than the role's max_ttl value. If not provided, the role's ttl value will be used. Note that the role values default to system values if not explicitly set.
* @param format (optional) Format for returned data. Can be pem, der, or pem_bundle; defaults to pem. If der, the output is base64 encoded. If pem_bundle, the certificate field will contain the private key, certificate, and issuing CA, concatenated.
* @param csr (optional) PEM Encoded CSR
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse issue(
final String roleName,
final String commonName,
final List<String> altNames,
final List<String> ipSans,
final String ttl,
final CredentialFormat format,
final String csr
) throws VaultException {
return issue(roleName, commonName, altNames, ipSans, ttl, format, true, csr);
}
/**
* <p>Operation to generate a new set of credentials or sign the embedded CSR, in the PKI backend. If CSR is passed the
* sign function of the vault will be called if not, issue will be used.
* The issuing CA certificate is returned as well, so that only the root CA need be in a
* client's trust store.</p>
*
* <p>A successful operation will return a 204 HTTP status. A <code>VaultException</code> will be thrown if
* the role does not exist, or if any other problem occurs. Credential information will be populated in the
* <code>credential</code> field of the <code>PkiResponse</code> return value. Example usage:</p>
*
* <blockquote>
* <pre>{@code
* final VaultConfig config = new VaultConfig.address(...).token(...).build();
* final Vault vault = new Vault(config);
*
* final PkiResponse response = vault.pki().deleteRole("testRole");
* assertEquals(204, response.getRestResponse().getStatus();
* }</pre>
* </blockquote>
*
* @param roleName The role on which the credentials will be based.
* @param commonName The requested CN for the certificate. If the CN is allowed by role policy, it will be issued.
* @param altNames (optional) Requested Subject Alternative Names, in a comma-delimited list. These can be host names or email addresses; they will be parsed into their respective fields. If any requested names do not match role policy, the entire request will be denied.
* @param ipSans (optional) Requested IP Subject Alternative Names, in a comma-delimited list. Only valid if the role allows IP SANs (which is the default).
* @param ttl (optional) Requested Time To Live. Cannot be greater than the role's max_ttl value. If not provided, the role's ttl value will be used. Note that the role values default to system values if not explicitly set.
* @param format (optional) Format for returned data. Can be pem, der, or pem_bundle; defaults to pem. If der, the output is base64 encoded. If pem_bundle, the certificate field will contain the private key, certificate, and issuing CA, concatenated.
* @param excludeCNFromSans (optional) Whether to use Verbatim (HashiCorp Vault UI, not sign-verbatim). If false then it will include 'excludeCNFromSans: false' in the request, otherwise it will not be included.
* @param csr (optional) PEM Encoded CSR
* @return A container for the information returned by Vault
* @throws VaultException If any error occurs or unexpected response is received from Vault
*/
public PkiResponse issue(
final String roleName,
final String commonName,
final List<String> altNames,
final List<String> ipSans,
final String ttl,
final CredentialFormat format,
final boolean excludeCNFromSans,
final String csr
) throws VaultException {
int retryCount = 0;
while (true) {
// Construct a JSON body from inputs
final JsonObject jsonObject = Json.object();
if (commonName != null) {
jsonObject.add("common_name", commonName);
}
if (altNames != null && !altNames.isEmpty()) {
final StringBuilder altNamesCsv = new StringBuilder();//NOPMD
for (int index = 0; index < altNames.size(); index++) {
altNamesCsv.append(altNames.get(index));
if (index + 1 < altNames.size()) {
altNamesCsv.append(',');
}
}
jsonObject.add("alt_names", altNamesCsv.toString());
}
if (ipSans != null && !ipSans.isEmpty()) {
final StringBuilder ipSansCsv = new StringBuilder();//NOPMD
for (int index = 0; index < ipSans.size(); index++) {
ipSansCsv.append(ipSans.get(index));
if (index + 1 < ipSans.size()) {
ipSansCsv.append(',');
}
}
jsonObject.add("ip_sans", ipSansCsv.toString());
}
if (ttl != null) {
jsonObject.add("ttl", ttl);
}
if (format != null) {
jsonObject.add("format", format.toString());
}
if (csr != null) {
jsonObject.add("csr", csr);
if (!excludeCNFromSans) {
jsonObject.add("exclude_cn_from_sans", false);
}
}
final String requestJson = jsonObject.toString();
// Make an HTTP request to Vault
try {
String endpoint = (csr == null || csr.isEmpty()) ? "%s/v1/%s/issue/%s" : "%s/v1/%s/sign/%s";
final RestResponse restResponse = new Rest()//NOPMD
.url(String.format(endpoint, config.getAddress(), this.mountPath, roleName))
.header("X-Vault-Token", config.getToken())
.header("X-Vault-Namespace", this.nameSpace)
.body(requestJson.getBytes(StandardCharsets.UTF_8))
.connectTimeoutSeconds(config.getOpenTimeout())
.readTimeoutSeconds(config.getReadTimeout())
.sslVerification(config.getSslConfig().isVerify())
.sslContext(config.getSslConfig().getSslContext())
.post();
// Validate response
if (restResponse.getStatus() != 200 && restResponse.getStatus() != 404) {
String body = restResponse.getBody() != null ? new String(restResponse.getBody()) : "(no body)";
throw new VaultException("Vault responded with HTTP status code: " + restResponse.getStatus() + " " + body, restResponse.getStatus());
}
return new PkiResponse(restResponse, retryCount);
} catch (Exception e) {
// If there are retries to perform, then pause for the configured interval and then execute the loop again...
if (retryCount < config.getMaxRetries()) {
retryCount++;
try {
final int retryIntervalMilliseconds = config.getRetryIntervalMilliseconds();
Thread.sleep(retryIntervalMilliseconds);
} catch (InterruptedException e1) {
e1.printStackTrace();
}
} else if (e instanceof VaultException) {
// ... otherwise, give up.
throw (VaultException) e;
} else {
throw new VaultException(e);
}
}
}
}
private String roleOptionsToJson(final RoleOptions options) {
final JsonObject jsonObject = Json.object();
if (options != null) {
addJsonFieldIfNotNull(jsonObject, "ttl", options.getTtl());
addJsonFieldIfNotNull(jsonObject, "max_ttl", options.getMaxTtl());
addJsonFieldIfNotNull(jsonObject, "allow_localhost", options.getAllowLocalhost());
if (options.getAllowedDomains() != null && options.getAllowedDomains().size() > 0) {
addJsonFieldIfNotNull(jsonObject, "allowed_domains", String.join(",", options.getAllowedDomains()));
}
addJsonFieldIfNotNull(jsonObject, "allow_spiffe_name", options.getAllowSpiffename());
addJsonFieldIfNotNull(jsonObject, "allow_bare_domains", options.getAllowBareDomains());
addJsonFieldIfNotNull(jsonObject, "allow_subdomains", options.getAllowSubdomains());
addJsonFieldIfNotNull(jsonObject, "allow_any_name", options.getAllowAnyName());
addJsonFieldIfNotNull(jsonObject, "enforce_hostnames", options.getEnforceHostnames());
addJsonFieldIfNotNull(jsonObject, "allow_ip_sans", options.getAllowIpSans());
addJsonFieldIfNotNull(jsonObject, "server_flag", options.getServerFlag());
addJsonFieldIfNotNull(jsonObject, "client_flag", options.getClientFlag());
addJsonFieldIfNotNull(jsonObject, "code_signing_flag", options.getCodeSigningFlag());
addJsonFieldIfNotNull(jsonObject, "email_protection_flag", options.getEmailProtectionFlag());
addJsonFieldIfNotNull(jsonObject, "key_type", options.getKeyType());
addJsonFieldIfNotNull(jsonObject, "key_bits", options.getKeyBits());
addJsonFieldIfNotNull(jsonObject, "use_csr_common_name", options.getUseCsrCommonName());
addJsonFieldIfNotNull(jsonObject, "use_csr_sans", options.getUseCsrSans());
if (options.getKeyUsage() != null && options.getKeyUsage().size() > 0) {
addJsonFieldIfNotNull(jsonObject, "key_usage", String.join(",", options.getKeyUsage()));
}
}
return jsonObject.toString();
}
private JsonObject addJsonFieldIfNotNull(final JsonObject jsonObject, final String name, final Object value) {
if (value == null) {
return jsonObject;
}
if (value instanceof String) {
jsonObject.add(name, (String) value);
} else if (value instanceof Boolean) {
jsonObject.add(name, (Boolean) value);
} else if (value instanceof Long) {
jsonObject.add(name, (Long) value);
}
return jsonObject;
}
}