Install a trust anchor certificate for smart card authentication.

@param cert SSL certificate in PEM format
@throws HostConfigFault
@throws RuntimeFault
@throws RemoteException
@since 6.0
770752
public void installSmartCardTrustAnchor(String cert) throws HostConfigFault, RuntimeFault, RemoteException {
        getVimService().installSmartCardTrustAnchor(getMOR(), cert);
    }
754344
@Beta
  public static SSLContext trustAllSSLContext() throws GeneralSecurityException {
    TrustManager[] trustAllCerts =
        new TrustManager[] {
          new X509TrustManager() {

            public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {}

            public void checkServerTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {}

            public X509Certificate[] getAcceptedIssuers() {
              return null;
            }
          }
        };
    SSLContext context = getTlsSslContext();
    context.init(null, trustAllCerts, null);
    return context;
  }
1265961
private function _validateIssuerProfile(Certificate $cert)
    {
        $exts = $cert->tbsCertificate()->extensions();
        if ($exts->hasKeyUsage() && !$exts->keyUsage()->isDigitalSignature()) {
            throw new ACValidationException(
                "Issuer PKC's Key Usage extension doesn't permit" .
                     " verification of digital signatures.");
        }
        if ($exts->hasBasicConstraints() && $exts->basicConstraints()->isCA()) {
            throw new ACValidationException("Issuer PKC must not be a CA.");
        }
    }
311532
def connect(self):
    ""
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((self.host, self.port))
    boto.log.debug("wrapping ssl socket; CA certificate file=%s",
                   self.ca_certs)
    self.sock = ssl.wrap_socket(sock, keyfile=self.key_file,
                                certfile=self.cert_file,
                                cert_reqs=ssl.CERT_REQUIRED,
                                ca_certs=self.ca_certs)
    cert = self.sock.getpeercert()
    hostname = self.host.split(':', 0)[0]
    if not ValidateCertificateHostname(cert, hostname):
      raise InvalidCertificateException(hostname,
                                        cert,
                                        'remote hostname "%s" does not match '\
                                        'certificate' % hostname)
94371
public Server openSsl() throws SSLException, CertificateException {
        SelfSignedCertificate cert = new SelfSignedCertificate();
        sslContext = SslContextBuilder.forServer(cert.certificate(), cert.privateKey())
                .sslProvider(SslProvider.OPENSSL)
                .build();
        return this;
    }
442409
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
        PrivateKey privateKey, int lifetime, int delegationMode, X509ExtensionSet extSet) throws IOException,
        GeneralSecurityException {
        return createCertificate(certRequestInputStream, cert, privateKey, lifetime, delegationMode, extSet, null);
    }
368383
@Override
  public void checkClientTrusted(X509Certificate[] x509Certificates, String string)
      throws CertificateException {
    if (trustManager == null) {
      return;
    }
    trustManager.checkClientTrusted(x509Certificates, string);
  }
292248
static KeyStore buildKeyStore(X509Certificate[] certChain, PrivateKey key, char[] keyPasswordChars)
            throws KeyStoreException, NoSuchAlgorithmException,
                   CertificateException, IOException {
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(null, null);
        ks.setKeyEntry(ALIAS, key, keyPasswordChars, certChain);
        return ks;
    }
174417
public void invoke(X509Certificate cert, GSIConstants.CertificateType certType) throws CertPathValidatorException {
        if (!requireSigningPolicyCheck(certType)) {
            return;
        }
        X500Principal caPrincipal = cert.getIssuerX500Principal();
        SigningPolicy policy;
        try {
            policy = this.policyStore.getSigningPolicy(caPrincipal);
        } catch (CertStoreException e) {
            throw new CertPathValidatorException(e);
        }

        if (policy == null) {
            throw new CertPathValidatorException("No signing policy for " + cert.getIssuerDN());
        }

        boolean valid = policy.isValidSubject(cert.getSubjectX500Principal());

        if (!valid) {
            throw new CertPathValidatorException("Certificate " + cert.getSubjectDN()
                    + " violates signing policy for CA " + caPrincipal.getName());
        }
    }
970082
function CA(root) {
  this.name = x509.getCAName(root);
  this.trusted = x509.isTrusted(root);
  this.cert = root;
}
460053
public void addCACertificatesToTrustStore(BufferedInputStream bis) throws CryptoException, InvalidArgumentException {

        if (bis == null) {
            throw new InvalidArgumentException("The certificate stream bis cannot be null");
        }

        try {
            final Collection<? extends Certificate> certificates = cf.generateCertificates(bis);
            for (Certificate certificate : certificates) {
                addCACertificateToTrustStore(certificate);
            }

        } catch (CertificateException e) {
            throw new CryptoException("Unable to add CA certificate to trust store. Error: " + e.getMessage(), e);
        }
    }
502968
public ConnectionOptions withSslProtocol(String sslProtocol, TrustManager trustManager)
      throws NoSuchAlgorithmException, KeyManagementException {
    factory.useSslProtocol(Assert.notNull(sslProtocol, "sslProtocol"),
        Assert.notNull(trustManager, "trustManager"));
    return this;
  }
675596
private static boolean anchorIsTarget(TrustAnchor anchor,
                                          CertSelector sel)
    {
        X509Certificate anchorCert = anchor.getTrustedCert();
        if (anchorCert != null) {
            return sel.match(anchorCert);
        }
        return false;
    }
305350
@Override
	public Result<CertInfo> toCert(AuthzTrans trans, Result<CertResp> in, String[] trustChain) throws IOException {
		if(in.isOK()) {
			CertResp cin = in.value;
			CertInfo cout = newInstance(API.CERT);
			cout.setPrivatekey(cin.privateString());
			String value;
			if((value=cin.challenge())!=null) {
				cout.setChallenge(value);
			}
			cout.getCerts().add(cin.asCertString());
			if(trustChain!=null) {
				for(String c : trustChain) {
					cout.getCerts().add(c);
				}
			}
			if(cin.notes()!=null) {
				boolean first = true;
				StringBuilder sb = new StringBuilder();
				for(String n : cin.notes()) {
					if(first) {
						first = false;
					} else {
						sb.append('\n');
					}
					sb.append(n);
				}
				cout.setNotes(sb.toString());
			}
			return Result.ok(cout);
		} else {
			return Result.err(in);
		}
	}
755158
public static void loadX509Cert( Certificate cert, String certAlias, KeyStore keyStore ) throws KeyStoreException
    {
        keyStore.setCertificateEntry( certAlias, cert );
    }
155987
public void bootstrapTrust() throws MyProxyException {
        try {
            SSLContext sc = SSLContext.getInstance("SSL");
            MyTrustManager myTrustManager = new MyTrustManager();
            TrustManager[] trustAllCerts = new TrustManager[] { myTrustManager };
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            SSLSocketFactory sf = sc.getSocketFactory();
            SSLSocket socket = (SSLSocket)sf.createSocket(this.host, this.port);
            socket.startHandshake();
            socket.close();

            X509Certificate[] acceptedIssuers = myTrustManager.getAcceptedIssuers();
            if (acceptedIssuers == null) {
                throw new MyProxyException("Failed to determine MyProxy server trust roots in bootstrapTrust.");
            }
            for (int idx = 0; idx < acceptedIssuers.length; idx++)
            {
                File x509Dir = new File(org.globus.myproxy.MyProxy.getTrustRootPath());
                if (!x509Dir.exists())
                {
                    StringBuffer newSubject = new StringBuffer();
                    String[] subjArr = acceptedIssuers[idx].getSubjectDN().getName().split(", ");
                    for(int i = (subjArr.length - 1); i > -1; i--)
                    {
                        newSubject.append("/");
                        newSubject.append(subjArr[i]);
                    }
                    String subject = newSubject.toString();

                    File tmpDir = new File(getTrustRootPath() + "-" +
                                           System.currentTimeMillis());
                    if (tmpDir.mkdir() == true)
                    {
                        String hash = opensslHash(acceptedIssuers[idx]);
                        String filename = tmpDir.getPath() + tmpDir.separator + hash + ".0";

                        FileOutputStream os = new FileOutputStream(new File(filename));
                        CertificateIOUtil.writeCertificate(os, acceptedIssuers[idx]);

                        os.close();
                        if (logger.isDebugEnabled()) {
                            logger.debug("wrote trusted certificate to " + filename);
                        }

                        filename = tmpDir.getPath() + tmpDir.separator + hash + ".signing_policy";

                        os = new FileOutputStream(new File(filename));
                        Writer wr = new OutputStreamWriter(os, Charset.forName("UTF-8"));
                        wr.write("access_id_CA X509 '");
                        wr.write(subject);
                        wr.write("'\npos_rights globus CA:sign\ncond_subjects globus \"*\"\n");
                        wr.flush();
                        wr.close();
                        os.close();

                        if (logger.isDebugEnabled()) {
                            logger.debug("wrote trusted certificate policy to " + filename);
                        }

                        // success.  commit the bootstrapped directory.
                        if (tmpDir.renameTo(x509Dir) == true)
                        {
                            if (logger.isDebugEnabled()) {
                                logger.debug("renamed " + tmpDir.getPath() + " to " +
                                             x509Dir.getPath());
                            }
                        }
                        else
                        {
                            throw new MyProxyException("Unable to rename " + tmpDir.getPath() + " to " +
                                                x509Dir.getPath());
                        }
                    }
                    else
                    {
                        throw new MyProxyException("Cannot create temporary directory: " + tmpDir.getName());
                    }
                }
            }
        } catch(Exception e) {
            throw new MyProxyException("MyProxy bootstrapTrust failed.", e);
        }
    }
683373
public void setSignInfo(PrivateKey privKey, Certificate[] certChain, CRL[] crlList) {
        try {
            pkcs = new PdfPKCS7(privKey, certChain, crlList, hashAlgorithm, provider, PdfName.ADBE_PKCS7_SHA1.equals(get(PdfName.SUBFILTER)));
            pkcs.setExternalDigest(externalDigest, externalRSAdata, digestEncryptionAlgorithm);
            if (PdfName.ADBE_X509_RSA_SHA1.equals(get(PdfName.SUBFILTER))) {
                ByteArrayOutputStream bout = new ByteArrayOutputStream();
                for (int k = 0; k < certChain.length; ++k) {
                    bout.write(certChain[k].getEncoded());
                }
                bout.close();
                setCert(bout.toByteArray());
                setContents(pkcs.getEncodedPKCS1());
            }
            else
                setContents(pkcs.getEncodedPKCS7());
            name = PdfPKCS7.getSubjectFields(pkcs.getSigningCertificate()).getField("CN");
            if (name != null)
                put(PdfName.NAME, new PdfString(name, PdfObject.TEXT_UNICODE));
            pkcs = new PdfPKCS7(privKey, certChain, crlList, hashAlgorithm, provider, PdfName.ADBE_PKCS7_SHA1.equals(get(PdfName.SUBFILTER)));
            pkcs.setExternalDigest(externalDigest, externalRSAdata, digestEncryptionAlgorithm);
        }
        catch (Exception e) {
            throw new ExceptionConverter(e);
        }
    }