ojluni/src/main/java/sun/security/ssl/SunX509KeyManagerImpl.java - platform/libcore.git - Git at Google

 /*
  * Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this
  * particular file as subject to the "Classpath" exception as provided
  * by Oracle in the LICENSE file that accompanied this code.
  *
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  *
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit www.oracle.com if you need additional information or have any
  * questions.
  */

 package sun.security.ssl;

 import javax.net.ssl.*;
 import java.security.*;
 import java.security.cert.*;
 import java.security.cert.Certificate;
 import java.util.*;
 import java.net.Socket;

 import javax.security.auth.x500.X500Principal;


 /**
  * An implemention of X509KeyManager backed by a KeyStore.
  *
  * The backing KeyStore is inspected when this object is constructed.
  * All key entries containing a PrivateKey and a non-empty chain of
  * X509Certificate are then copied into an internal store. This means
  * that subsequent modifications of the KeyStore have no effect on the
  * X509KeyManagerImpl object.
  *
  * Note that this class assumes that all keys are protected by the same
  * password.
  *
  * The JSSE handshake code currently calls into this class via
  * chooseClientAlias() and chooseServerAlias() to find the certificates to
  * use. As implemented here, both always return the first alias returned by
  * getClientAliases() and getServerAliases(). In turn, these methods are
  * implemented by calling getAliases(), which performs the actual lookup.
  *
  * Note that this class currently implements no checking of the local
  * certificates. In particular, it is *not* guaranteed that:
  *  . the certificates are within their validity period and not revoked
  *  . the signatures verify
  *  . they form a PKIX compliant chain.
  *  . the certificate extensions allow the certificate to be used for
  *    the desired purpose.
  *
  * Chains that fail any of these criteria will probably be rejected by
  * the remote peer.
  *
  */
 final class SunX509KeyManagerImpl extends X509ExtendedKeyManager {

     private static final Debug debug = Debug.getInstance("ssl");

     private static final String[] STRING0 = new String[0];

     /*
      * The credentials from the KeyStore as
      * Map: String(alias) -> X509Credentials(credentials)
      */
     private Map<String,X509Credentials> credentialsMap;

     /*
      * Cached server aliases for the case issuers == null.
      * (in the current JSSE implementation, issuers are always null for
      * server certs). See chooseServerAlias() for details.
      *
      * Map: String(keyType) -> String[](alias)
      */
     private Map<String,String[]> serverAliasCache;

     /*
      * Basic container for credentials implemented as an inner class.
      */
     private static class X509Credentials {
         PrivateKey privateKey;
         X509Certificate[] certificates;
         private Set<X500Principal> issuerX500Principals;

         X509Credentials(PrivateKey privateKey, X509Certificate[] certificates) {
             // assert privateKey and certificates != null
             this.privateKey = privateKey;
             this.certificates = certificates;
         }

         synchronized Set<X500Principal> getIssuerX500Principals() {
             // lazy initialization
             if (issuerX500Principals == null) {
                 issuerX500Principals = new HashSet<X500Principal>();
                 for (int i = 0; i < certificates.length; i++) {
                     issuerX500Principals.add(
                                 certificates[i].getIssuerX500Principal());
                 }
             }
             return issuerX500Principals;
         }
     }

     SunX509KeyManagerImpl(KeyStore ks, char[] password) throws KeyStoreException,
             NoSuchAlgorithmException, UnrecoverableKeyException {

         credentialsMap = new HashMap<String,X509Credentials>();
         serverAliasCache = new HashMap<String,String[]>();
         if (ks == null) {
             return;
         }

         for (Enumeration<String> aliases = ks.aliases();
                                         aliases.hasMoreElements(); ) {
             String alias = aliases.nextElement();
             if (!ks.isKeyEntry(alias)) {
                 continue;
             }
             Key key = ks.getKey(alias, password);
             if (key instanceof PrivateKey == false) {
                 continue;
             }
             Certificate[] certs = ks.getCertificateChain(alias);
             if ((certs == null) || (certs.length == 0) ||
                     !(certs[0] instanceof X509Certificate)) {
                 continue;
             }
             if (!(certs instanceof X509Certificate[])) {
                 Certificate[] tmp = new X509Certificate[certs.length];
                 System.arraycopy(certs, 0, tmp, 0, certs.length);
                 certs = tmp;
             }

             X509Credentials cred = new X509Credentials((PrivateKey)key,
                 (X509Certificate[])certs);
             credentialsMap.put(alias, cred);
             if (debug != null && Debug.isOn("keymanager")) {
                 System.out.println("***");
                 System.out.println("found key for : " + alias);
                 for (int i = 0; i < certs.length; i++) {
                     System.out.println("chain [" + i + "] = "
                     + certs[i]);
                 }
                 System.out.println("***");
             }
         }
     }

     /*
      * Returns the certificate chain associated with the given alias.
      *
      * @return the certificate chain (ordered with the user's certificate first
      * and the root certificate authority last)
      */
     public X509Certificate[] getCertificateChain(String alias) {
         if (alias == null) {
             return null;
         }
         X509Credentials cred = credentialsMap.get(alias);
         if (cred == null) {
             return null;
         } else {
             return cred.certificates.clone();
         }
     }

     /*
      * Returns the key associated with the given alias
      */
     public PrivateKey getPrivateKey(String alias) {
         if (alias == null) {
             return null;
         }
         X509Credentials cred = credentialsMap.get(alias);
         if (cred == null) {
             return null;
         } else {
             return cred.privateKey;
         }
     }

     /*
      * Choose an alias to authenticate the client side of a secure
      * socket given the public key type and the list of
      * certificate issuer authorities recognized by the peer (if any).
      */
     public String chooseClientAlias(String[] keyTypes, Principal[] issuers,
             Socket socket) {
         /*
          * We currently don't do anything with socket, but
          * someday we might.  It might be a useful hint for
          * selecting one of the aliases we get back from
          * getClientAliases().
          */

         if (keyTypes == null) {
             return null;
         }

         for (int i = 0; i < keyTypes.length; i++) {
             String[] aliases = getClientAliases(keyTypes[i], issuers);
             if ((aliases != null) && (aliases.length > 0)) {
                 return aliases[0];
             }
         }
         return null;
     }

     /*
      * Choose an alias to authenticate the client side of an
      * <code>SSLEngine</code> connection given the public key type
      * and the list of certificate issuer authorities recognized by
      * the peer (if any).
      *
      * @since 1.5
      */
     public String chooseEngineClientAlias(String[] keyType,
             Principal[] issuers, SSLEngine engine) {
         /*
          * If we ever start using socket as a selection criteria,
          * we'll need to adjust this.
          */
         return chooseClientAlias(keyType, issuers, null);
     }

     /*
      * Choose an alias to authenticate the server side of a secure
      * socket given the public key type and the list of
      * certificate issuer authorities recognized by the peer (if any).
      */
     public String chooseServerAlias(String keyType,
             Principal[] issuers, Socket socket) {
         /*
          * We currently don't do anything with socket, but
          * someday we might.  It might be a useful hint for
          * selecting one of the aliases we get back from
          * getServerAliases().
          */
         if (keyType == null) {
             return null;
         }

         String[] aliases;

         if (issuers == null || issuers.length == 0) {
             aliases = serverAliasCache.get(keyType);
             if (aliases == null) {
                 aliases = getServerAliases(keyType, issuers);
                 // Cache the result (positive and negative lookups)
                 if (aliases == null) {
                     aliases = STRING0;
                 }
                 serverAliasCache.put(keyType, aliases);
             }
         } else {
             aliases = getServerAliases(keyType, issuers);
         }
         if ((aliases != null) && (aliases.length > 0)) {
             return aliases[0];
         }
         return null;
     }

     /*
      * Choose an alias to authenticate the server side of an
      * <code>SSLEngine</code> connection given the public key type
      * and the list of certificate issuer authorities recognized by
      * the peer (if any).
      *
      * @since 1.5
      */
     public String chooseEngineServerAlias(String keyType,
             Principal[] issuers, SSLEngine engine) {
         /*
          * If we ever start using socket as a selection criteria,
          * we'll need to adjust this.
          */
         return chooseServerAlias(keyType, issuers, null);
     }

     /*
      * Get the matching aliases for authenticating the client side of a secure
      * socket given the public key type and the list of
      * certificate issuer authorities recognized by the peer (if any).
      */
     public String[] getClientAliases(String keyType, Principal[] issuers) {
         return getAliases(keyType, issuers);
     }

     /*
      * Get the matching aliases for authenticating the server side of a secure
      * socket given the public key type and the list of
      * certificate issuer authorities recognized by the peer (if any).
      */
     public String[] getServerAliases(String keyType, Principal[] issuers) {
         return getAliases(keyType, issuers);
     }

     /*
      * Get the matching aliases for authenticating the either side of a secure
      * socket given the public key type and the list of
      * certificate issuer authorities recognized by the peer (if any).
      *
      * Issuers comes to us in the form of X500Principal[].
      */
     private String[] getAliases(String keyType, Principal[] issuers) {
         if (keyType == null) {
             return null;
         }
         if (issuers == null) {
             issuers = new X500Principal[0];
         }
         if (issuers instanceof X500Principal[] == false) {
             // normally, this will never happen but try to recover if it does
             issuers = convertPrincipals(issuers);
         }
         String sigType;
         if (keyType.contains("_")) {
             int k = keyType.indexOf("_");
             sigType = keyType.substring(k + 1);
             keyType = keyType.substring(0, k);
         } else {
             sigType = null;
         }

         X500Principal[] x500Issuers = (X500Principal[])issuers;
         // the algorithm below does not produce duplicates, so avoid Set
         List<String> aliases = new ArrayList<>();

         for (Map.Entry<String,X509Credentials> entry :
                                                 credentialsMap.entrySet()) {

             String alias = entry.getKey();
             X509Credentials credentials = entry.getValue();
             X509Certificate[] certs = credentials.certificates;

             if (!keyType.equals(certs[0].getPublicKey().getAlgorithm())) {
                 continue;
             }
             if (sigType != null) {
                 if (certs.length > 1) {
                     // if possible, check the public key in the issuer cert
                     if (!sigType.equals(certs[1].getPublicKey().getAlgorithm())) {
                         continue;
                     }
                 } else {
                     // Check the signature algorithm of the certificate itself.
                     // Look for the "withRSA" in "SHA1withRSA", etc.
                     String sigAlgName =
                             certs[0].getSigAlgName().toUpperCase(Locale.ENGLISH);
                     String pattern = "WITH" + sigType.toUpperCase(Locale.ENGLISH);
                     if (sigAlgName.contains(pattern) == false) {
                         continue;
                     }
                 }
             }

             if (issuers.length == 0) {
                 // no issuer specified, match all
                 aliases.add(alias);
                 if (debug != null && Debug.isOn("keymanager")) {
                     System.out.println("matching alias: " + alias);
                 }
             } else {
                 Set<X500Principal> certIssuers =
                                         credentials.getIssuerX500Principals();
                 for (int i = 0; i < x500Issuers.length; i++) {
                     if (certIssuers.contains(issuers[i])) {
                         aliases.add(alias);
                         if (debug != null && Debug.isOn("keymanager")) {
                             System.out.println("matching alias: " + alias);
                         }
                         break;
                     }
                 }
             }
         }

         String[] aliasStrings = aliases.toArray(STRING0);
         return ((aliasStrings.length == 0) ? null : aliasStrings);
     }

     /*
      * Convert an array of Principals to an array of X500Principals, if
      * possible. Principals that cannot be converted are ignored.
      */
     private static X500Principal[] convertPrincipals(Principal[] principals) {
         List<X500Principal> list = new ArrayList<>(principals.length);
         for (int i = 0; i < principals.length; i++) {
             Principal p = principals[i];
             if (p instanceof X500Principal) {
                 list.add((X500Principal)p);
             } else {
                 try {
                     list.add(new X500Principal(p.getName()));
                 } catch (IllegalArgumentException e) {
                     // ignore
                 }
             }
         }
         return list.toArray(new X500Principal[list.size()]);
     }

 }
	/*
	* Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.ssl;

	import javax.net.ssl.*;
	import java.security.*;
	import java.security.cert.*;
	import java.security.cert.Certificate;
	import java.util.*;
	import java.net.Socket;

	import javax.security.auth.x500.X500Principal;


	/**
	* An implemention of X509KeyManager backed by a KeyStore.
	*
	* The backing KeyStore is inspected when this object is constructed.
	* All key entries containing a PrivateKey and a non-empty chain of
	* X509Certificate are then copied into an internal store. This means
	* that subsequent modifications of the KeyStore have no effect on the
	* X509KeyManagerImpl object.
	*
	* Note that this class assumes that all keys are protected by the same
	* password.
	*
	* The JSSE handshake code currently calls into this class via
	* chooseClientAlias() and chooseServerAlias() to find the certificates to
	* use. As implemented here, both always return the first alias returned by
	* getClientAliases() and getServerAliases(). In turn, these methods are
	* implemented by calling getAliases(), which performs the actual lookup.
	*
	* Note that this class currently implements no checking of the local
	* certificates. In particular, it is not guaranteed that:
	* . the certificates are within their validity period and not revoked
	* . the signatures verify
	* . they form a PKIX compliant chain.
	* . the certificate extensions allow the certificate to be used for
	* the desired purpose.
	*
	* Chains that fail any of these criteria will probably be rejected by
	* the remote peer.
	*
	*/
	final class SunX509KeyManagerImpl extends X509ExtendedKeyManager {

	private static final Debug debug = Debug.getInstance("ssl");

	private static final String[] STRING0 = new String[0];

	/*
	* The credentials from the KeyStore as
	* Map: String(alias) -> X509Credentials(credentials)
	*/
	private Map<String,X509Credentials> credentialsMap;

	/*
	* Cached server aliases for the case issuers == null.
	* (in the current JSSE implementation, issuers are always null for
	* server certs). See chooseServerAlias() for details.
	*
	* Map: String(keyType) -> String[](alias)
	*/
	private Map<String,String[]> serverAliasCache;

	/*
	* Basic container for credentials implemented as an inner class.
	*/
	private static class X509Credentials {
	PrivateKey privateKey;
	X509Certificate[] certificates;
	private Set<X500Principal> issuerX500Principals;

	X509Credentials(PrivateKey privateKey, X509Certificate[] certificates) {
	// assert privateKey and certificates != null
	this.privateKey = privateKey;
	this.certificates = certificates;
	}

	synchronized Set<X500Principal> getIssuerX500Principals() {
	// lazy initialization
	if (issuerX500Principals == null) {
	issuerX500Principals = new HashSet<X500Principal>();
	for (int i = 0; i < certificates.length; i++) {
	issuerX500Principals.add(
	certificates[i].getIssuerX500Principal());
	}
	}
	return issuerX500Principals;
	}
	}

	SunX509KeyManagerImpl(KeyStore ks, char[] password) throws KeyStoreException,
	NoSuchAlgorithmException, UnrecoverableKeyException {

	credentialsMap = new HashMap<String,X509Credentials>();
	serverAliasCache = new HashMap<String,String[]>();
	if (ks == null) {
	return;
	}

	for (Enumeration<String> aliases = ks.aliases();
	aliases.hasMoreElements(); ) {
	String alias = aliases.nextElement();
	if (!ks.isKeyEntry(alias)) {
	continue;
	}
	Key key = ks.getKey(alias, password);
	if (key instanceof PrivateKey == false) {
	continue;
	}
	Certificate[] certs = ks.getCertificateChain(alias);
	if ((certs == null) \|\| (certs.length == 0) \|\|
	!(certs[0] instanceof X509Certificate)) {
	continue;
	}
	if (!(certs instanceof X509Certificate[])) {
	Certificate[] tmp = new X509Certificate[certs.length];
	System.arraycopy(certs, 0, tmp, 0, certs.length);
	certs = tmp;
	}

	X509Credentials cred = new X509Credentials((PrivateKey)key,
	(X509Certificate[])certs);
	credentialsMap.put(alias, cred);
	if (debug != null && Debug.isOn("keymanager")) {
	System.out.println("***");
	System.out.println("found key for : " + alias);
	for (int i = 0; i < certs.length; i++) {
	System.out.println("chain [" + i + "] = "
	+ certs[i]);
	}
	System.out.println("***");
	}
	}
	}

	/*
	* Returns the certificate chain associated with the given alias.
	*
	* @return the certificate chain (ordered with the user's certificate first
	* and the root certificate authority last)
	*/
	public X509Certificate[] getCertificateChain(String alias) {
	if (alias == null) {
	return null;
	}
	X509Credentials cred = credentialsMap.get(alias);
	if (cred == null) {
	return null;
	} else {
	return cred.certificates.clone();
	}
	}

	/*
	* Returns the key associated with the given alias
	*/
	public PrivateKey getPrivateKey(String alias) {
	if (alias == null) {
	return null;
	}
	X509Credentials cred = credentialsMap.get(alias);
	if (cred == null) {
	return null;
	} else {
	return cred.privateKey;
	}
	}

	/*
	* Choose an alias to authenticate the client side of a secure
	* socket given the public key type and the list of
	* certificate issuer authorities recognized by the peer (if any).
	*/
	public String chooseClientAlias(String[] keyTypes, Principal[] issuers,
	Socket socket) {
	/*
	* We currently don't do anything with socket, but
	* someday we might. It might be a useful hint for
	* selecting one of the aliases we get back from
	* getClientAliases().
	*/

	if (keyTypes == null) {
	return null;
	}

	for (int i = 0; i < keyTypes.length; i++) {
	String[] aliases = getClientAliases(keyTypes[i], issuers);
	if ((aliases != null) && (aliases.length > 0)) {
	return aliases[0];
	}
	}
	return null;
	}

	/*
	* Choose an alias to authenticate the client side of an
	* <code>SSLEngine</code> connection given the public key type
	* and the list of certificate issuer authorities recognized by
	* the peer (if any).
	*
	* @since 1.5
	*/
	public String chooseEngineClientAlias(String[] keyType,
	Principal[] issuers, SSLEngine engine) {
	/*
	* If we ever start using socket as a selection criteria,
	* we'll need to adjust this.
	*/
	return chooseClientAlias(keyType, issuers, null);
	}

	/*
	* Choose an alias to authenticate the server side of a secure
	* socket given the public key type and the list of
	* certificate issuer authorities recognized by the peer (if any).
	*/
	public String chooseServerAlias(String keyType,
	Principal[] issuers, Socket socket) {
	/*
	* We currently don't do anything with socket, but
	* someday we might. It might be a useful hint for
	* selecting one of the aliases we get back from
	* getServerAliases().
	*/
	if (keyType == null) {
	return null;
	}

	String[] aliases;

	if (issuers == null \|\| issuers.length == 0) {
	aliases = serverAliasCache.get(keyType);
	if (aliases == null) {
	aliases = getServerAliases(keyType, issuers);
	// Cache the result (positive and negative lookups)
	if (aliases == null) {
	aliases = STRING0;
	}
	serverAliasCache.put(keyType, aliases);
	}
	} else {
	aliases = getServerAliases(keyType, issuers);
	}
	if ((aliases != null) && (aliases.length > 0)) {
	return aliases[0];
	}
	return null;
	}

	/*
	* Choose an alias to authenticate the server side of an
	* <code>SSLEngine</code> connection given the public key type
	* and the list of certificate issuer authorities recognized by
	* the peer (if any).
	*
	* @since 1.5
	*/
	public String chooseEngineServerAlias(String keyType,
	Principal[] issuers, SSLEngine engine) {
	/*
	* If we ever start using socket as a selection criteria,
	* we'll need to adjust this.
	*/
	return chooseServerAlias(keyType, issuers, null);
	}

	/*
	* Get the matching aliases for authenticating the client side of a secure
	* socket given the public key type and the list of
	* certificate issuer authorities recognized by the peer (if any).
	*/
	public String[] getClientAliases(String keyType, Principal[] issuers) {
	return getAliases(keyType, issuers);
	}

	/*
	* Get the matching aliases for authenticating the server side of a secure
	* socket given the public key type and the list of
	* certificate issuer authorities recognized by the peer (if any).
	*/
	public String[] getServerAliases(String keyType, Principal[] issuers) {
	return getAliases(keyType, issuers);
	}

	/*
	* Get the matching aliases for authenticating the either side of a secure
	* socket given the public key type and the list of
	* certificate issuer authorities recognized by the peer (if any).
	*
	* Issuers comes to us in the form of X500Principal[].
	*/
	private String[] getAliases(String keyType, Principal[] issuers) {
	if (keyType == null) {
	return null;
	}
	if (issuers == null) {
	issuers = new X500Principal[0];
	}
	if (issuers instanceof X500Principal[] == false) {
	// normally, this will never happen but try to recover if it does
	issuers = convertPrincipals(issuers);
	}
	String sigType;
	if (keyType.contains("_")) {
	int k = keyType.indexOf("_");
	sigType = keyType.substring(k + 1);
	keyType = keyType.substring(0, k);
	} else {
	sigType = null;
	}

	X500Principal[] x500Issuers = (X500Principal[])issuers;
	// the algorithm below does not produce duplicates, so avoid Set
	List<String> aliases = new ArrayList<>();

	for (Map.Entry<String,X509Credentials> entry :
	credentialsMap.entrySet()) {

	String alias = entry.getKey();
	X509Credentials credentials = entry.getValue();
	X509Certificate[] certs = credentials.certificates;

	if (!keyType.equals(certs[0].getPublicKey().getAlgorithm())) {
	continue;
	}
	if (sigType != null) {
	if (certs.length > 1) {
	// if possible, check the public key in the issuer cert
	if (!sigType.equals(certs[1].getPublicKey().getAlgorithm())) {
	continue;
	}
	} else {
	// Check the signature algorithm of the certificate itself.
	// Look for the "withRSA" in "SHA1withRSA", etc.
	String sigAlgName =
	certs[0].getSigAlgName().toUpperCase(Locale.ENGLISH);
	String pattern = "WITH" + sigType.toUpperCase(Locale.ENGLISH);
	if (sigAlgName.contains(pattern) == false) {
	continue;
	}
	}
	}

	if (issuers.length == 0) {
	// no issuer specified, match all
	aliases.add(alias);
	if (debug != null && Debug.isOn("keymanager")) {
	System.out.println("matching alias: " + alias);
	}
	} else {
	Set<X500Principal> certIssuers =
	credentials.getIssuerX500Principals();
	for (int i = 0; i < x500Issuers.length; i++) {
	if (certIssuers.contains(issuers[i])) {
	aliases.add(alias);
	if (debug != null && Debug.isOn("keymanager")) {
	System.out.println("matching alias: " + alias);
	}
	break;
	}
	}
	}
	}

	String[] aliasStrings = aliases.toArray(STRING0);
	return ((aliasStrings.length == 0) ? null : aliasStrings);
	}

	/*
	* Convert an array of Principals to an array of X500Principals, if
	* possible. Principals that cannot be converted are ignored.
	*/
	private static X500Principal[] convertPrincipals(Principal[] principals) {
	List<X500Principal> list = new ArrayList<>(principals.length);
	for (int i = 0; i < principals.length; i++) {
	Principal p = principals[i];
	if (p instanceof X500Principal) {
	list.add((X500Principal)p);
	} else {
	try {
	list.add(new X500Principal(p.getName()));
	} catch (IllegalArgumentException e) {
	// ignore
	}
	}
	}
	return list.toArray(new X500Principal[list.size()]);
	}

	}