/*
 *   
 *
 * Copyright  1990-2006 Sun Microsystems, Inc. All Rights Reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License version
 * 2 only, as published by the Free Software Foundation. 
 * 
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License version 2 for more details (a copy is
 * included at /legal/license.txt). 
 * 
 * You should have received a copy of the GNU General Public License
 * version 2 along with this work; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA 
 * 
 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
 * Clara, CA 95054 or visit www.sun.com if you need additional
 * information or have any questions. 
 */

package com.sun.midp.jadtool;


/*
 * Web proxy  - The URL retrieval mechanism in AppDescriptor does not
 *              work through a proxy server at this time.
 */

import java.io.*;
import java.util.*;
import java.net.URL;
import java.net.MalformedURLException;

import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.DigestInputStream;
import java.security.NoSuchAlgorithmException;
import java.security.KeyStoreException;
import java.security.Key;
import java.security.PrivateKey;
import java.security.Signature;

import java.security.SignatureException;
import java.security.InvalidKeyException;
import java.security.NoSuchProviderException;
import java.security.UnrecoverableKeyException;

import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.security.cert.CertificateFactory;

import java.security.cert.CertificateException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateNotYetValidException;

import com.sun.midp.jadtool.AppDescriptorException;

import com.sun.midp.installer.*;

/**
 * Java API for signing MIDletSuites.
 * <p>
 * AppDescriptor is an extension of the Properties class which provides
 * additional methods for adding message digest and certificate 
 * properties as well as signing the app descriptor file and verifying
 * a signed app descriptor file.
 */
public class AppDescriptor extends JadProperties {
    
    /** Index of the key in arrays returned by getAllCerts. */
    public static int KEY = 0;

    /** Index of the cert in arrays returned by getAllCerts. */
    public static int CERT = 1;

    /** App Descriptor key for . */
    public static final String JAR_SIGNATURE = "MIDlet-Jar-RSA-SHA1";
    /** App Descriptor key for . */
    public static final String CP_ATTR = "MIDlet-Certificate-";
    /** App Descriptor key for . */
    public static final String JAR_URL = "MIDlet-Jar-URL";
    /** App Descriptor key for . */
    public static final String JAR_SIZE = "MIDlet-Jar-Size";
    /** App Descriptor key for . */
    public static final String SEP_ATTR = ": ";    

    /** SHA1 with RSA constant. */
    public static final String SIGN_ALG = "SHA1withRSA";

    /** KeyStore to get certificates and keys from. */
    private KeyStore keystore = null;

    /**
     * Default constructor
     */
    public AppDescriptor() {
        super();
    }

    /**
     * Used to input a stored app descriptor into an AppDescriptor
     * instance from a stream.  The input stream will be converted 
     * to Unicode using <code>encoding</code> if it is specified.
     * If <code>encoding</code> is not specified, a default 
     * encoding of type "UTF8" escapes will be used.
     *
     * Overrides <code>Properties.load</code>
     *
     * @param inputJad App descriptor input stream.
     * @param encoding Encoding of the inputJad stream.
     *
     * @exception IOException If an error occurs while loading the 
     *            inputJad stream.
     * @exception UnsupportedEncodingException If the given encoding
     *            type is not supported.
     * @exception InvalidJadException If the JAD has a format error
     */
    public synchronized void load(InputStream inputJad, String encoding)
        throws UnsupportedEncodingException, IOException, InvalidJadException {
            super.load(inputJad, encoding);
    }

    /**
     * Used to store an app descriptor instance into a jad file 
     * through an output stream.  The internal Unicode stream 
     * will be converted to an output format using
     * <code>encoding</code> if it is specified.
     * If <code>encoding</code> is not specified, a default 
     * encoding of type Ascii with Unicode escapes will be used.
     *
     * Overrides <code>Properties.store</code>
     *
     * @param outputJad App descriptor output stream.
     * @param encoding Encoding of the outputJad stream.
     *
     * @exception IOException If an error occurs while writing the 
     *            inputJad stream.
     * @exception UnsupportedEncodingException If the given encoding
     *            type is not supported.
     */
    public synchronized void store(OutputStream outputJad, String encoding)
            throws UnsupportedEncodingException, IOException {
   
        if (encoding != null) {
            JadWriter.write(this, outputJad, encoding);
        } else {
            JadWriter.write(this, outputJad);
        }
    }

    /**
     * Provides a KeyStore instance for use by this AppDescriptor
     * object.  (The default KeyStore type from the Java security
     * properties file is used.  This should be type "JKS", and is
     * the only supported keystore format.)
     * <p>
     * This KeyStore is required by the <code>addcert</code>,
     * <code>sign</code>, <code>signcert</code>, and <code>verify</code> 
     * methods.  If any of these methods is called before 
     * <code>loadKeyStore</code> an exception will be thrown. 
     *
     * @param ksfile The input stream stream to load a KeyStore from.
     * @param storepass The password to unlock the KeyStore, can be null.
     * @exception KeyStoreException The default keystore provider type
     *            is not available in any of the provider packages 
     *            searched.  
     * @exception IOException Thrown if there is a problem parsing 
     *            the input stream or loading its data.
     * @exception CertificateException Thrown if there is trouble loading
     *            certificates into the KeyStore
     * @exception NoSuchAlgorithmException Thrown if the algorithm
     *            needed to verify the KeyStore cannot be found.
     */
    public synchronized void loadKeyStore(InputStream ksfile,
                                          char[] storepass)
        throws KeyStoreException, IOException, 
               NoSuchAlgorithmException, CertificateException, Exception {
        try {
            keystore = KeyStore.getInstance(KeyStore.getDefaultType());
            keystore.load(ksfile, storepass);
        } catch (Exception e) {
            throw new Exception("loadKeyStore failed");
        }
    }

    /**
     * Store a the keystore in the descriptor in a file.
     *
     * @param ksfname file to use
     * @param storepass password of keystore
     */
    public synchronized void storeKeyStore(String ksfname,
                                           char[] storepass)
        throws IOException, KeyStoreException, 
        NoSuchAlgorithmException, CertificateException {

        FileOutputStream fout = new FileOutputStream(ksfname);
        keystore.store(fout, storepass);
        fout.close();
    }

    /**
     * Adds a Base64 encoded signature of the jar file at the URL 
     * specified by the MIDlet-Jar-URL key in the app descriptor.
     * <code>load</code> and <code>loadKeyStore</code> must be
     * call before this method.
     * <p>
     * The line in the app descriptor corresponding to this
     * insertion will look like this:
     * <p>
     *   MIDlet-Jar-RSA-SHA1:j3zKCv6eud2Ubkw80XjpNb7tk5s...
     *
     * If a MIDlet-Jar-RSA-SHA1 property already exists it will
     * be replaced.
     *
     * @param alias  Alias of the signing key in the keystore.
     * @param keypass Password to access the signing (private) key.
     *
     * @exception AppDescriptorException JAR URL or content provider
     *            certificate was
     *            not found in the app descriptor.
     * @exception MalformedURLException The URL corresponding to 
     *            the MIDlet-Jar-URL key could not be parsed.
     * @exception IOException error reading the JAR
     * @exception NoSuchAlgorithmException If SHA1 or RSA need by
     *            getEncodedSig could not be found in an
     *            installed JCA provider.    
     * @exception KeyStoreException
     * @exception InvalidKeyException
     * @exception SignatureException
     * @exception UnrecoverableKeyException
     */
    public void addJarSignature(String alias, char[] keypass)
        throws AppDescriptorException, MalformedURLException, IOException, 
               KeyStoreException, InvalidKeyException, 
               SignatureException, NoSuchAlgorithmException, 
               UnrecoverableKeyException {

        String urlStr = getProperty(JAR_URL);

        if (urlStr == null) {
            throw new AppDescriptorException(JAR_URL + " not in descriptor");
        }

        URL url = new URL(urlStr);
        InputStream jarStream = url.openStream();
        addJarSignature(alias, keypass, jarStream);
    }
    
    /**
     * Adds a Base64 encoded signature of the jar file provided in
     * an input stream to the app descriptor.
     * <p>
     * The line in the app descriptor corresponding to this
     * insertion will look like this:
     *
     *   MIDlet-Jar-RSA-SHA1:j3zKCv6eud2Ubkw80XjpNb7tk5s...
     *
     * If a MIDlet-Jar-RSA-SHA1 property already exists it will
     * be replaced.
     *
     * @param alias  Alias of the signing key in the keystore.
     * @param keypass Password to access the signing (private) key.
     * @param jarStream stream to read the jar file from
     *
     * @exception IOException If there is a problem reading the 
     *            input stream.
     * @exception NoSuchAlgorithmException If SHA1 or RSA need by
     *            getEncodedSig could not be found in an
     *            installed JCA provider.    
     * @exception KeyStoreException
     * @exception InvalidKeyException
     * @exception SignatureException
     * @exception UnrecoverableKeyException
     */
    public void addJarSignature(String alias, char[] keypass,
            InputStream jarStream) throws IOException,
        NoSuchAlgorithmException, 
        KeyStoreException, InvalidKeyException, SignatureException,
        NoSuchAlgorithmException, UnrecoverableKeyException {

        setProperty(JAR_SIGNATURE, getEncodedSig(alias, keypass, jarStream));
    }

    /**
     * Retrieves a certificate out of a KeyStore and adds it 
     * to the app descriptor as:
     * <p>
     *   content_provider.certificate-1-1:<Base64 encoded newcert>
     * <p>
     * Instance variable <code>keystore</code> must not be null, 
     * and should have been set by <code>loadKeyStore</code>
     * before this method is called.
     *
     * @param alias Alias of the chosen certificate in the keystore
     * @param chainNum number of the chain to add certificate to
     * @param certNum number of the certificate in the chain to replace it,
     *        or 0 to add the certificate at the end of the chain
     *
     * @exception KeyStoreException If there is an error with the keystore.
     * @exception CertificateException If there is a problem with the
     *            encoding of the certificate.
     * @exception AppDescriptorException If the KeyStore has not been 
     *            initialized (keystore is null)
     */    
    public void addCert(String alias, int chainNum, int certNum)
    throws CertificateException, KeyStoreException, AppDescriptorException {
	Certificate[] chain = getCertificatesFromKeyStore(alias);
	if (certNum == 0) {
	    // find next number after the highest existing certificate number
	    for (certNum = 1;
		 getProperty(CP_ATTR + chainNum + "-" + certNum) != null;
		 certNum++);

	    for (int i = 0; i < chain.length; i++) {
		addEncodedCertificate(chain[i], chainNum, certNum + i);
	    }
	} else {
	    addEncodedCertificate(chain[certNum-1], chainNum, certNum);
	}
    }

    /**
     * Returns an X509Certificate object from the app descriptor property
     * chosen by <code>certnum</code>, or 
     * null if that certificate does not exist in the descriptor.
     * <p>
     * After finding the chosen property in the app descriptor, 
     * decodes it from Base64 into a byte-encoded certificate and then
     * creates the X509 format certificate from that opaque data.
     *
     * @param chainNum number of the certificate chain
     * @param certNum number of the certificate in the chain
     *
     * @return an X509Certificate object or null if the certificate is
     * not in the JAD
     *
     * @exception CertificateException If there is a format problem with
     *            the certificate
     */
    public X509Certificate getCert(int chainNum, int certNum)
        throws CertificateException {

        X509Certificate c = null;
        
        String base64 = getProperty(CP_ATTR + chainNum + "-" + certNum);
        if (base64 != null) {
            c = base64CertToX509Cert(base64);
        } 

        return c;
    }
  
    /**
     * Returns an X509Certificate object from the app descriptor property
     * chosen by <code>certnum</code>, or 
     * null if that certificate does not exist in the descriptor.
     * <p>
     * After finding the chosen property in the app descriptor, 
     * decodes it from Base64 into a byte-encoded certificate and then
     * creates the X509 format certificate from that opaque data.
     *
     * @param chainNum number of the certificate chain
     * @param certNum number of the certificate in the chain
     *
     * @return an X509Certificate object or null if the certificate is
     * not in the JAD
     *
     * @exception CertificateException If there is a format problem with
     *            the certificate
     */
    public X509Certificate getCertAttribute(int chainNum, int certNum)
        throws CertificateException {

        X509Certificate c = null;
        
        String base64 = getProperty(CP_ATTR + chainNum + "-" + certNum);
        if (base64 != null) {
            c = base64CertToX509Cert(base64);
        } 

        return c;
    }
  
    /**
     * Returns all X509Certificate objects from the app descriptor.
     * <p>
     * After finding a certificate property in the app descriptor, 
     * decodes it from Base64 into a byte-encoded certificate and then
     * creates the X509 format certificate from that opaque data.
     *
     * @return Vector of object arrays, each containing key, and a
     * X509Certificate object
     */
    public Vector getAllCerts() throws CertificateException {
        Vector certs = new Vector();

	for (int idx = 0; idx < size(); idx++) {
            String key = getKeyAt(idx);
	    String base64 = getValueAt(idx);

            if (key.startsWith(CP_ATTR)) {
                X509Certificate c = base64CertToX509Cert(base64);
                Object[] temp = new Object[2];

                temp[KEY] = key;
                temp[CERT] = c;
                certs.addElement(temp);
            }
        }

        return certs;
    }
  
    /**
     * Returns a message digest of a certificate in "human readable" 
     * from from the app descriptor property
     * chosen by <code>certnum</code>, or 
     * null if that certificate does not exist in the descriptor.
     * <p>
     * After finding the chosen property in the app descriptor, 
     * decodes it from Base64 into a byte-encoded certificate and then
     * creates a readable digest String based on that data.
     *
     * @param chainNum number of the certificate chain
     * @param certNum number of the certificate in the chain
     * @param alg A Digest algorithm to use, e.g. "SHA1" or "MD5".
     *
     * @return A message digest of a certificate in hex as a String or
     *    null if the certificate is not in the JAD.
     *
     * @exception NoSuchAlgorithmException Thrown if the digest
     *            <code>algorithm</code> could not be found.
     */
    public String getCertDigest(int chainNum, int certNum, String alg)
        throws NoSuchAlgorithmException {

        String digest = null;
        
        String base64 = getProperty(CP_ATTR + chainNum + "-" + certNum);
        if (base64 != null) {
            byte[] certificateData = Base64.decode(base64);
            digest = createFingerprint(certificateData, alg);
        }

        return digest;      
    }

    /* ************ PRIVATE METHODS ************* */

    /**
     * Retrieves a certificate chain out of a KeyStore.
     * Instance variable <code>keystore</code> must not be null,
     * and should have been set by <code>loadKeyStore</code>
     * before this method is called.
     *
     * @param alias Alias of the chosen certificate in the keystore
     * @return all certificates in the chain
     * @exception KeyStoreException If there is an error with the keystore.
     * @exception CertificateException If there is a problem with the
     *            encoding of the certificate.
     * @exception AppDescriptorException If the KeyStore has not been 
     *            initialized (keystore is null);
     */    
    private Certificate[] getCertificatesFromKeyStore(String alias)
    throws AppDescriptorException, CertificateException, KeyStoreException {

	if (keystore == null) {
	    throw new AppDescriptorException(
	    AppDescriptorException.KEYSTORE_NOT_INITIALIZED);
	}

	// Return a certifcate chain if we can get it.
	Certificate[] chain = keystore.getCertificateChain(alias);
	if (chain == null) {
	    // Otherwise try for a certificate.
	    Certificate cert = keystore.getCertificate(alias);
	    if (cert == null) {
		throw new CertificateException("Certificate not found");
	    }
	    chain = new Certificate[] { cert };
	}

	return chain;
    }

    /**
     * Add a certificate to the app descriptor as:
     * <p>
     *   content_provider.certificate-1-1:<Base64 encoded newcert>
     * <p>
     * Instance variable <code>keystore</code> must not be null, 
     * and should have been set by <code>loadKeyStore</code>
     * before this method is called.
     *
     * @param cert the certificate to add
     * @param chainNum number of the chain to add certificate to
     * @param certNum number of the certificate in the chain to replace it,
     *        or 0 to add the certificate at the end of the chain
     *
     * @exception CertificateEncodingException If there is a problem with the
     *            encoding of the certificate.
     */    
    private void addEncodedCertificate(Certificate cert,
				       int chainNum, int certNum)
    throws CertificateEncodingException {

	// encode the (x.509?) cert in base64
	byte[] certbytes = cert.getEncoded();
	String certtoadd = Base64.encode(certbytes);
	// replace any existing certificate
	setProperty(CP_ATTR + chainNum + "-" + certNum, certtoadd);
    }

    /**
     * <code>getEncodedCertificate</code> - A helper function used
     * by <code>addCert</code>.
     *
     * Retrieves a certificate out of a KeyStore and returns it 
     * as a Base64 encoded String.  Instance variable <code>keystore</code>
     * must not be null, and should have been set by <code>loadKeyStore</code>
     * before this method is called.
     *
     * @param alias Alias of the chosen certificate in the keystore
     * @return Base64 encoded certificate as a String
     * @exception KeyStoreException If there is an error with the keystore.
     * @exception CertificateException If there is a problem with the
     *            encoding of the certificate.
     * @exception AppDescriptorException If the KeyStore has not been 
     *            initialized (keystore is null);
     */    
    private String getEncodedCertificate(String alias) 
        throws KeyStoreException, CertificateException, 
               AppDescriptorException {

        Certificate cert;

        if (keystore == null) {
            throw new AppDescriptorException(
                AppDescriptorException.KEYSTORE_NOT_INITIALIZED);
        }

        // Load a keystore data structure to get keys from      
        cert = keystore.getCertificate(alias);
        if (cert == null) {
            throw new CertificateException("Certificate not found");
        }

        byte[] certbytes = cert.getEncoded();

        // return the (x.509?) encoded cert in base64
        return Base64.encode(certbytes);
    }

    /**
     * <code>getNextCertIndex</code> - A helper function used by
     * <code>addcert</code>.
     *
     * Iterates through the current properties data returns the 
     * index of the first unused key index for either a content-provider
     * (cp) or https certificate. 
     *
     * @param key What cert key should be used...CP_ATTR or HTTPS_ATTR
     * @return The first unused index for a particular certificate type.
     */
    private int getNextCertIndex(String key) {
        int idx = 1;

        while (idx > 0) {
            String value = getProperty(key + idx);
            if (value == null) {
                break;
            }

            idx++;
        }

        return idx;
    }

    /** 
     * <code>createFingerprint</code> - A helper function used by
     * <code>getdigest</code>.
     *
     * <code>createFingerprint</code>, given a certificated encoded 
     * as a byte array will compute a "fingerprint", or Message 
     * Digest of the certificate using the selected <code>algorithm</code>
     * type.
     *
     * A fingerprint is meant to be human readable, and is thus
     * returned as a hex string separated at byte boundaries by
     * a delimiter ":".
     *
     * @param certificateBytes - a certificate encoded as a byte array
     * @param algorithm - The name of a digest algorithm to use, 
     *                    e.g. "SHA1" or "MD5"
     * @return the fingerprint in String form.
     * @exception NoSuchAlgorithmException Thrown if the digest
     *            <code>algorithm</code> could not be found.
     */
    static String createFingerprint(byte[] certificateBytes,
                                     String algorithm) 
            throws NoSuchAlgorithmException {
        MessageDigest md = MessageDigest.getInstance(algorithm);
        md.update(certificateBytes);
        byte[] digest = md.digest();
        StringBuffer sb = new StringBuffer();
        
        for (int i = 0; i < digest.length; i++) {
            int b = digest[i] & 0xff;
            String hex = Integer.toHexString(b);

            if (i != 0) {
                sb.append(":");
            }

            if (hex.length() == 1) {
                sb.append("0");
            }

            sb.append(hex);
        }

        return sb.toString();
    }

    /**
     * A helper function used by <code>sign</code>.
     * Produces a base64 encoded signature for the given buffer.
     *
     * @param alias  Alias of the signing key in the keystore.
     * @param keypass Password to access the signing (private) key.
     * @param stream stream to read the bytes from
     *
     * @return Base64 encoded signature of bits in the buffer
     *
     * @exception IOException If there is a problem reading the 
     *            input stream.
     * @exception KeyStoreException
     * @exception InvalidKeyException
     * @exception SignatureException
     * @exception NoSuchAlgorithmException
     * @exception UnrecoverableKeyException
     */
    private String getEncodedSig(String alias, char[] keypass,
            InputStream stream) throws KeyStoreException, InvalidKeyException, 
            SignatureException, NoSuchAlgorithmException, 
            UnrecoverableKeyException, IOException {
        int bytesRead;
        byte[] buffer = new byte[10240];

        // get a signature object
        Signature signature = Signature.getInstance(SIGN_ALG);

        // init the signature with a private key for signing
        Key pk = keystore.getKey(alias, keypass);
        signature.initSign((PrivateKey)pk);

        for (; ; ) {
            bytesRead = stream.read(buffer);
            if (bytesRead == -1) {
                break;
            }

            signature.update(buffer, 0, bytesRead);
        }
        
        // return the signature
        byte[] raw = signature.sign();
        return Base64.encode(raw);
    }

    /**
     * <code>getVerifyCert</code> - A helper function used by
     * <code>verify</code>.
     *
     * Outputs an app descriptor file to the caller provided 
     * ByteArrayOutputStream <code>baos</code> and returns a
     * base64 encoded signature for those bits.  The signature
     * is valid only for exactly the returned bits.  If 
     * <code>encoding</code> is not specified, a default encoding
     * type of Ascii with Unicode escapes is used.
     *
     * @param alias  Alias of the verify key in the keystore. 
     * @return Verified X509Certificate containing the public key
     *         with which this app descriptor file's signature should
     *         be verified.
     * @exception AppDescriptorException
     * @exception NoSuchAlgorithmException
     * @exception KeyStoreException
     * @exception CertificateException
     * @exception UnrecoverableKeyException
     * @exception InvalidKeyException
     * @exception NoSuchProviderException
     * @exception SignatureException
     */

    private X509Certificate getVerifyCert(String alias) 
        throws AppDescriptorException, NoSuchAlgorithmException, 
               KeyStoreException, CertificateException, 
               UnrecoverableKeyException, InvalidKeyException, 
               NoSuchProviderException, SignatureException {
        X509Certificate returncert = null;    
        X509Certificate current = null;
        X509Certificate operatorXcert = null;
        Certificate operatorcert = null;
        byte[] operatordata;
        String operatordn = null;
        String currentdn = null;
        String rv = null;
        
        // get the operator verification cert from the keystore
        operatorcert = keystore.getCertificate(alias);

        // convert opaque operator cert into X509 encoding so we
        // can use it.
        operatordata = operatorcert.getEncoded();
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        ByteArrayInputStream bais = new ByteArrayInputStream(operatordata);
        while (bais.available() > 0) {
            operatorXcert = (X509Certificate)cf.generateCertificate(bais);
        }

        try {
            bais.close();
        } catch (IOException ioe) {
        }

        // Get the operator's distinguished name
        operatordn = (operatorXcert.getSubjectDN()).getName();

        /*
         * Now we search for a CP_ATTR type certificate 
         * who's issuer DN matches "operatordn."
         * It is the certificate that should verify the
         * signature on this app descriptor.
         *
         * Before it can do that, it must be trusted by being
         * verified by the "operator" certificate.
         * The calls to verify() and checkValidity() do this.
         */
        int count = 1;
        while ((current = getCert(1, count)) != null) {
            currentdn = (current.getIssuerDN()).getName();
            if (operatordn.equals(currentdn)) {
                // verify cert sig with operator public key
                current.verify(operatorcert.getPublicKey());
                // check cert validity dates
                current.checkValidity();
                returncert = current;   
                break;
            } 

            count++;
        }

        return returncert;
    }

    /**
     * <code>base64CertToX509Cert</code> - A helper function used by
     * <code>verify</code>
     *
     * @param b64str A certificate encoded as Base64 String
     * @return An X509Certificate object.                              
     * @exception CertificateException Thrown if there is an error
     *            converting the <code>b64str</code> certificate
     *            into X509 format.
     */
    private X509Certificate base64CertToX509Cert(String b64str) 
        throws CertificateException 
    {
        X509Certificate c = null;
        
        byte[] certificateData = Base64.decode(b64str);
        
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        ByteArrayInputStream bais = 
            new ByteArrayInputStream(certificateData);
        
        while (bais.available() > 0) {
            c = (X509Certificate)cf.generateCertificate(bais);
        }

        try {
            bais.close();
        } catch (IOException ioe) {
        }

        return c;           
    }
}



