Get REAL X.509 data from RFC1421 formatted certificate.

Question

We have a Java application that stores RSA public keys and allows a user to encrypt a short stream of information with any of the keys. The application also allows the user to import a new key certificate into the keystore. When we load the certificate from a file, we want to use the common name (CN) as the alias. Here is the problem:

CertificateFactory x509CertFact = CertificateFactory.getInstance("X.509");
X509Certificate cert = x509CertFact.generateCertificate(certificateInputStream);
String alias = cert.getSubjectX500Principal().getName();

assert alias.equals("CN=CommonName, OU=TestCo..."); // FAILS
assert alais.equals("cn=commonname, ou=testco..."); // PASSES

We know for a fact that the subject name in the file has mixed casing and we need to preserve that casing. Does anyone know how to get more flexible X.509 support from the JCE in Java6?

We've thought of using the BouncyCastle lightweight API, but documentation is almost non-existent.

EDIT: Using JDK 6u11 Here is the list of security providers from java.security:

security.provider.1=sun.security.provider.Sun
security.provider.2=sun.security.rsa.SunRsaSign
security.provider.3=com.sun.net.ssl.internal.ssl.Provider
security.provider.4=com.sun.crypto.provider.SunJCE
security.provider.5=sun.security.jgss.SunProvider
security.provider.6=com.sun.security.sasl.Provider
security.provider.7=org.jcp.xml.dsig.internal.dom.XMLDSigRI
security.provider.8=sun.security.smartcardio.SunPCSC
security.provider.9=sun.security.mscapi.SunMSCAPI
security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider

The certificate:

-----BEGIN CERTIFICATE-----
MIIDHjCCAtugAwIBAgIESnr4OzALBgcqhkjOOAQDBQAwcjELMAkGA1UEBhMCVVMxFTATBgNVBAoT
DEdlbWFsdG8gSW5jLjEnMCUGA1UECxMeU29sdXRpb25zIGFuZCBTcGVjaWFsIFByb2plY3RzMSMw
IQYDVQQDExpGUkJCTHVuYUNyeXB0b1NlcnZlci0xLjAuMDAeFw0wOTA4MDYxNTM1MjNaFw0wOTEx
MDQxNTM1MjNaMHIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxHZW1hbHRvIEluYy4xJzAlBgNVBAsT
HlNvbHV0aW9ucyBhbmQgU3BlY2lhbCBQcm9qZWN0czEjMCEGA1UEAxMaRlJCQkx1bmFDcnlwdG9T
ZXJ2ZXItMS4wLjAwggG3MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I8
70QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQIsJP
u6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZndFIAccCFQCXYFCP
FSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSvu/o66oL5V0wLPQeCZ1FZV466
1FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoB
JDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhAACgYBHBBVNzuoXgpPFPkSN71rI
MKkSIUAVE7iLagFCklCEvHlh1UxyRhCWNh/UazaJzHRZofWlVPRGmgtl+J6BJRJIDorPqt8FfifY
fpbAbCQctMToFF5QqggumOlJozXyfV9eyYyNn+Y4yZDr8JKq70WX/S2M+Oo1+SBJsXMTeDdfkDAL
BgcqhkjOOAQDBQADMAAwLQIUA+VcqEYMHwXdKY4XC+oO/zF/pRkCFQCDKAS5HpSMazbZgToEEYft
QFJSvw==
-----END CERTIFICATE-----

Answer 1

If you mean that you are literally using the identity operator (==) to test, then the assertion should always fail. Use alias.equals("CN=CommonName, OU=...") instead.

However, assuming that's not the problem, can add:

System.out.println(x509CertFact.getProvider());
System.out.println(alias);

at the appropriate points in the code and post the results? It might turn up more leads. Posting the certificate you are loading (in text-friendly PEM format) would be helpful too, if it isn't disclosing any personally-identifying information.

Answer 2

Can't reproduce the error. What JCE do you use? We use the Sun's JCE from Java 5 and 6 and we always get the DN in original case.

Answer 3

Try using X500Principal#getName(String) to get the DN in the format of your choice. Then you can parse the common name out of that.

Alternatively, if you're mapping an alias to an actual certificate you could store the "alias" in all caps (and query it in all caps) but you would still have the original casing from the mapped certificate