summaryrefslogtreecommitdiff
path: root/bkucommon
diff options
context:
space:
mode:
Diffstat (limited to 'bkucommon')
-rw-r--r--bkucommon/pom.xml159
-rw-r--r--bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidator.java13
-rw-r--r--bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidatorImpl.java83
-rw-r--r--bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java140
-rw-r--r--bkucommon/src/test/java/at/gv/egiz/bku/conf/CertValidatorTest.java32
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-01a.cerbin0 -> 1111 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-02a.cerbin0 -> 975 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-03a.cerbin0 -> 975 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-01a.cerbin0 -> 865 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-03.cerbin0 -> 979 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-01a.cerbin0 -> 1111 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-02a.cerbin0 -> 975 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-03a.cerbin0 -> 975 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-01a.cerbin0 -> 865 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-03.cerbin0 -> 979 bytes
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-SSL-03.cer26
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-03.cer27
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-01a.cer21
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-02a.cer27
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-03.cer27
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-01a.cer21
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-02a.cer27
-rw-r--r--bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/testCerts/www.a-trust.at.derbin0 -> 1230 bytes
23 files changed, 463 insertions, 140 deletions
diff --git a/bkucommon/pom.xml b/bkucommon/pom.xml
index 40b73e48..a90aebf5 100644
--- a/bkucommon/pom.xml
+++ b/bkucommon/pom.xml
@@ -1,78 +1,85 @@
<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
- <parent>
- <artifactId>bku</artifactId>
- <groupId>at.gv.egiz</groupId>
- <version>1.0-SNAPSHOT</version>
- </parent>
- <modelVersion>4.0.0</modelVersion>
- <groupId>at.gv.egiz</groupId>
- <artifactId>bkucommon</artifactId>
- <name>BKU Common</name>
- <version>1.0-SNAPSHOT</version>
- <url>http://maven.apache.org</url>
- <dependencies>
- <dependency>
- <groupId>at.gv.egiz</groupId>
- <artifactId>utils</artifactId>
- <version>1.0-SNAPSHOT</version>
- </dependency>
- <dependency>
- <groupId>at.gv.egiz</groupId>
- <artifactId>STAL</artifactId>
- <version>1.0-SNAPSHOT</version>
- </dependency>
- <dependency>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </dependency>
- <dependency>
- <groupId>iaik</groupId>
- <artifactId>iaik_jce_full_signed</artifactId>
- </dependency>
- <dependency>
- <groupId>commons-fileupload</groupId>
- <artifactId>commons-fileupload</artifactId>
- <scope>compile</scope>
- </dependency>
- <dependency>
- <groupId>commons-httpclient</groupId>
- <artifactId>commons-httpclient</artifactId>
- <scope>compile</scope>
- </dependency>
- <dependency>
- <groupId>xerces</groupId>
- <artifactId>xercesImpl</artifactId>
- </dependency>
- <dependency>
- <groupId>xalan</groupId>
- <artifactId>xalan</artifactId>
- </dependency>
- <dependency>
- <groupId>iaik</groupId>
- <artifactId>iaik_xsect</artifactId>
- </dependency>
- </dependencies>
- <build>
- <plugins>
- <!--
- plugin> <groupId>org.codehaus.mojo</groupId>
- <artifactId>jaxws-maven-plugin</artifactId> <executions>
- <execution> <id>MOA-SPSS</id> <goals> <goal>wsimport</goal>
- </goals> </execution> </executions> <configuration>
- <extension>true</extension> <verbose>true</verbose>
- <packageName>moaspss.generated</packageName>
- <wsdlDirectory>${basedir}/src/test/wsdl</wsdlDirectory>
- <wsdlFiles> <wsdlFile>MOA-SPSS-1.3.wsdl</wsdlFile> </wsdlFiles>
- <sourceDestDir>${project.build.directory}/generated-sources/moaspss</sourceDestDir>
- <staleFile>${project.build.directory}/generated-sources/moaspss/.staleFlag</staleFile>
- <xnocompile>true</xnocompile> </configuration> </plugin
- -->
- <!--
- skip tests temporarily <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-surefire-plugin</artifactId> <configuration>
- <skip>true</skip> </configuration> </plugin-->
- </plugins>
- </build>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+ <parent>
+ <artifactId>bku</artifactId>
+ <groupId>at.gv.egiz</groupId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <modelVersion>4.0.0</modelVersion>
+ <groupId>at.gv.egiz</groupId>
+ <artifactId>bkucommon</artifactId>
+ <name>BKU Common</name>
+ <version>1.0-SNAPSHOT</version>
+ <url>http://maven.apache.org</url>
+ <dependencies>
+ <dependency>
+ <groupId>at.gv.egiz</groupId>
+ <artifactId>utils</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </dependency>
+ <dependency>
+ <groupId>at.gv.egiz</groupId>
+ <artifactId>STAL</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </dependency>
+ <dependency>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>iaik</groupId>
+ <artifactId>iaik_jce_full_signed</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>commons-fileupload</groupId>
+ <artifactId>commons-fileupload</artifactId>
+ <scope>compile</scope>
+ </dependency>
+ <dependency>
+ <groupId>commons-httpclient</groupId>
+ <artifactId>commons-httpclient</artifactId>
+ <scope>compile</scope>
+ </dependency>
+ <dependency>
+ <groupId>xerces</groupId>
+ <artifactId>xercesImpl</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>xalan</groupId>
+ <artifactId>xalan</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>iaik</groupId>
+ <artifactId>iaik_xsect</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>iaik</groupId>
+ <artifactId>iaik_pki</artifactId>
+ <scope>compile</scope>
+ </dependency>
+ </dependencies>
+ <build>
+ <plugins>
+ <!--
+ plugin> <groupId>org.codehaus.mojo</groupId>
+ <artifactId>jaxws-maven-plugin</artifactId> <executions> <execution>
+ <id>MOA-SPSS</id> <goals> <goal>wsimport</goal> </goals>
+ </execution> </executions> <configuration>
+ <extension>true</extension> <verbose>true</verbose>
+ <packageName>moaspss.generated</packageName>
+ <wsdlDirectory>${basedir}/src/test/wsdl</wsdlDirectory> <wsdlFiles>
+ <wsdlFile>MOA-SPSS-1.3.wsdl</wsdlFile> </wsdlFiles>
+ <sourceDestDir>${project.build.directory}/generated-sources/moaspss</sourceDestDir>
+ <staleFile>${project.build.directory}/generated-sources/moaspss/.staleFlag</staleFile>
+ <xnocompile>true</xnocompile> </configuration> </plugin
+ -->
+ <!--
+ skip tests temporarily <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-surefire-plugin</artifactId> <configuration>
+ <skip>true</skip> </configuration> </plugin
+ -->
+ </plugins>
+ </build>
</project> \ No newline at end of file
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidator.java b/bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidator.java
new file mode 100644
index 00000000..6a95b369
--- /dev/null
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidator.java
@@ -0,0 +1,13 @@
+package at.gv.egiz.bku.conf;
+
+import iaik.x509.X509Certificate;
+
+import java.io.File;
+
+public interface CertValidator {
+
+ public abstract void init(File certDir, File caDir);
+
+ public abstract boolean isCertificateValid(String transactionId, X509Certificate[] certs);
+
+} \ No newline at end of file
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidatorImpl.java b/bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidatorImpl.java
new file mode 100644
index 00000000..125233c1
--- /dev/null
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/conf/CertValidatorImpl.java
@@ -0,0 +1,83 @@
+package at.gv.egiz.bku.conf;
+
+import iaik.logging.TransactionId;
+import iaik.logging.impl.TransactionIdImpl;
+import iaik.pki.DefaultPKIConfiguration;
+import iaik.pki.DefaultPKIProfile;
+import iaik.pki.PKIConfiguration;
+import iaik.pki.PKIException;
+import iaik.pki.PKIFactory;
+import iaik.pki.PKIModule;
+import iaik.pki.PKIProfile;
+import iaik.pki.store.certstore.CertStoreParameters;
+import iaik.pki.store.certstore.directory.DefaultDirectoryCertStoreParameters;
+import iaik.pki.store.truststore.DefaultTrustStoreProfile;
+import iaik.pki.store.truststore.TrustStoreProfile;
+import iaik.pki.store.truststore.TrustStoreTypes;
+import iaik.x509.X509Certificate;
+
+import java.io.File;
+import java.util.Date;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+public class CertValidatorImpl implements CertValidator {
+
+ private static Log log = LogFactory.getLog(CertValidatorImpl.class);
+
+ private PKIFactory pkiFactory;
+ private PKIProfile profile;
+
+ public CertValidatorImpl() {
+
+ }
+
+ /* (non-Javadoc)
+ * @see at.gv.egiz.bku.conf.CertValidator#init(java.io.File, java.io.File)
+ */
+ public void init(File certDir, File caDir) {
+ // the parameters specifying the directory certstore
+ CertStoreParameters[] certStoreParameters = { new DefaultDirectoryCertStoreParameters(
+ "CS-001", certDir.getAbsolutePath(), true, false) };
+
+ // create a new PKI configuration using the certstore parameters
+ PKIConfiguration pkiConfig = new DefaultPKIConfiguration(
+ certStoreParameters);
+
+ // Transaction ID for logging
+ TransactionId tid = new TransactionIdImpl("Configure-PKI");
+ // get PKI factory for creating PKI module(s)
+ pkiFactory = PKIFactory.getInstance();
+ // configure the factory
+ try {
+ pkiFactory.configure(pkiConfig, tid);
+ } catch (PKIException e) {
+ log.error("Cannot configure PKI module", e);
+ }
+ // the truststore to be used
+ TrustStoreProfile trustProfile = new DefaultTrustStoreProfile("TS-001",
+ TrustStoreTypes.DIRECTORY, caDir.getAbsolutePath());
+ profile = new DefaultPKIProfile(trustProfile);
+ ((DefaultPKIProfile)profile).setAutoAddCertificates(true);
+ }
+
+ /* (non-Javadoc)
+ * @see at.gv.egiz.bku.conf.CertValidator#isCertificateValid(java.lang.String, iaik.x509.X509Certificate[])
+ */
+ public boolean isCertificateValid(String transactionId,
+ X509Certificate[] certs) {
+ // Transaction ID for logging
+ TransactionId tid = new TransactionIdImpl(transactionId);
+ // get a PKIModule
+ PKIModule pkiModule;
+ try {
+ pkiModule = pkiFactory.getPKIModule(profile);
+ return pkiModule.validateCertificate(new Date(), certs[0], certs, null,
+ tid).isCertificateValid();
+ } catch (PKIException e) {
+ log.error("Cannot validate certificate", e);
+ }
+ return false;
+ }
+}
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java b/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java
index 9a1e7020..9ed99190 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/conf/Configurator.java
@@ -9,6 +9,7 @@ import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
+import java.security.GeneralSecurityException;
import java.security.InvalidAlgorithmParameterException;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
@@ -18,27 +19,18 @@ import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.CollectionCertStoreParameters;
import java.security.cert.LDAPCertStoreParameters;
-import java.security.cert.PKIXBuilderParameters;
-import java.security.cert.TrustAnchor;
-import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Iterator;
import java.util.LinkedList;
import java.util.List;
import java.util.Properties;
-import java.util.Set;
-import javax.net.ssl.CertPathTrustManagerParameters;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.KeyManager;
-import javax.net.ssl.ManagerFactoryParameters;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
-import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import org.apache.commons.logging.Log;
@@ -55,6 +47,8 @@ public abstract class Configurator {
protected Properties properties;
+ protected CertValidator certValidator;
+
protected Configurator() {
}
@@ -64,9 +58,9 @@ public abstract class Configurator {
protected abstract InputStream getManifest();
- private Set<TrustAnchor> getCACerts() throws IOException,
+ private X509Certificate[] getCACerts() throws IOException,
CertificateException {
- Set<TrustAnchor> caCerts = new HashSet<TrustAnchor>();
+ List<X509Certificate> caCerts = new ArrayList<X509Certificate>();
File caDir = getCADir();
if (caDir != null) {
if (!caDir.isDirectory()) {
@@ -81,13 +75,12 @@ public abstract class Configurator {
X509Certificate cert = (X509Certificate) cf.generateCertificate(fis);
fis.close();
log.debug("Adding trusted cert " + cert.getSubjectDN());
- caCerts.add(new TrustAnchor(cert, null));
+ caCerts.add(cert);
} catch (Exception e) {
log.error("Cannot add trusted ca", e);
}
}
- return caCerts;
-
+ return caCerts.toArray(new X509Certificate[caCerts.size()]);
} else {
log.warn("No CA certificates configured");
}
@@ -239,69 +232,33 @@ public abstract class Configurator {
}
public void configureSSL() {
- Set<TrustAnchor> caCerts = null;
+ X509Certificate[] caCerts = null;
try {
caCerts = getCACerts();
} catch (Exception e1) {
log.error("Cannot load CA certificates", e1);
}
- List<CertStore> certStoreList = null;
- try {
- certStoreList = getCertstore();
- } catch (Exception e1) {
- log.error("Cannot load certstore certificates", e1);
- }
- String aia = getProperty("SSL.useAIA");
- if ((aia == null) || (aia.equals(""))) {
- System.setProperty("com.sun.security.enableAIAcaIssuers", "true");
- } else {
- System.setProperty("com.sun.security.enableAIAcaIssuers", aia);
- }
- String lifetime = getProperty("SSL.cache.lifetime");
- if ((lifetime == null) || (lifetime.equals(""))) {
- System.setProperty("sun.security.certpath.ldap.cache.lifetime", "0");
- } else {
- System.setProperty("sun.security.certpath.ldap.cache.lifetime", lifetime);
- }
- X509CertSelector selector = new X509CertSelector();
- PKIXBuilderParameters pkixParams;
+ String disableAll = getProperty("SSL.disableAllChecks");
try {
- pkixParams = new PKIXBuilderParameters(caCerts, selector);
- if ((getProperty("SSL.doRevocationChecking") != null)
- && (Boolean.valueOf(getProperty("SSL.doRevocationChecking")))) {
- log.info("Enable revocation checking");
- System.setProperty("com.sun.security.enableCRLDP", "true");
- Security.setProperty("ocsp.enable", "true");
- } else {
- log.warn("Revocation checking disabled");
- }
- for (CertStore cs : certStoreList) {
- pkixParams.addCertStore(cs);
- }
- ManagerFactoryParameters trustParams = new CertPathTrustManagerParameters(
- pkixParams);
- TrustManagerFactory trustFab;
- trustFab = TrustManagerFactory.getInstance("PKIX");
- trustFab.init(trustParams);
KeyManager[] km = null;
SSLContext sslCtx = SSLContext
.getInstance(getProperty("SSL.sslProtocol"));
- String disableAll = getProperty("SSL.disableAllChecks");
if ((disableAll != null) && (Boolean.parseBoolean(disableAll))) {
log.warn("--------------------------------------");
log.warn(" Disabling SSL Certificate Validation ");
log.warn("--------------------------------------");
- sslCtx.init(km, new TrustManager[] { new MyTrustManager(caCerts,
- certStoreList) }, null);
+ sslCtx.init(km,
+ new TrustManager[] { new MyAlwaysTrustManager(caCerts) }, null);
} else {
- sslCtx.init(km, trustFab.getTrustManagers(), null);
+ MyPKITrustManager pkixTM = new MyPKITrustManager(certValidator,
+ getCertDir(), getCADir(), caCerts);
+ sslCtx.init(km, new TrustManager[] { pkixTM }, null);
}
HttpsURLConnection.setDefaultSSLSocketFactory(sslCtx.getSocketFactory());
} catch (Exception e) {
log.error("Cannot configure SSL", e);
}
- String disableAll = getProperty("SSL.disableAllChecks");
if ((disableAll != null) && (Boolean.parseBoolean(disableAll))) {
log.warn("---------------------------------");
log.warn(" Disabling Hostname Verification ");
@@ -315,20 +272,75 @@ public abstract class Configurator {
}
}
- private static class MyTrustManager implements X509TrustManager {
- private static Log log = LogFactory.getLog(MyTrustManager.class);
+
+
+ public void setCertValidator(CertValidator certValidator) {
+ this.certValidator = certValidator;
+ }
+
+ private static class MyPKITrustManager implements X509TrustManager {
+ private static Log log = LogFactory.getLog(MyPKITrustManager.class);
+
+ private CertValidator certValidator;
private X509Certificate[] trustedCerts;
- public MyTrustManager(Set<TrustAnchor> caCerts, List<CertStore> cs) {
- trustedCerts = new X509Certificate[caCerts.size()];
+ public MyPKITrustManager(CertValidator cv, File certStore, File trustStore,
+ X509Certificate[] trustedCerts) {
+ certValidator = cv;
+ certValidator.init(certStore, trustStore);
+ this.trustedCerts = trustedCerts;
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String authType)
+ throws CertificateException {
+ log.error("Did not expect this method to get called");
+ throw new CertificateException("Method not implemented");
+ }
+
+ private static iaik.x509.X509Certificate[] convertCerts(
+ X509Certificate[] certs) throws GeneralSecurityException {
+ iaik.x509.X509Certificate[] retVal = new iaik.x509.X509Certificate[certs.length];
int i = 0;
- for (Iterator<TrustAnchor> it = caCerts.iterator(); it.hasNext();) {
- TrustAnchor ta = it.next();
- trustedCerts[i++] = ta.getTrustedCert();
+ for (X509Certificate cert : certs) {
+ if (cert instanceof iaik.x509.X509Certificate) {
+ retVal[i++] = (iaik.x509.X509Certificate) cert;
+ } else {
+ retVal[i++] = new iaik.x509.X509Certificate(cert.getEncoded());
+ }
+ }
+ return retVal;
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String authType)
+ throws CertificateException {
+ try {
+ boolean valid = certValidator.isCertificateValid(Thread.currentThread()
+ .getName(), convertCerts(chain));
+ if (!valid) {
+ throw new CertificateException("Certificate not valid");
+ }
+ } catch (GeneralSecurityException e) {
+ throw new CertificateException(e);
}
}
@Override
+ public X509Certificate[] getAcceptedIssuers() {
+ return trustedCerts;
+ }
+ }
+
+ private static class MyAlwaysTrustManager implements X509TrustManager {
+ private static Log log = LogFactory.getLog(MyAlwaysTrustManager.class);
+ private X509Certificate[] trustedCerts;
+
+ public MyAlwaysTrustManager(X509Certificate[] trustedCerts) {
+ this.trustedCerts = trustedCerts;
+ }
+
+ @Override
public void checkClientTrusted(X509Certificate[] arg0, String arg1)
throws CertificateException {
log.error("Did not expect this method to get called");
diff --git a/bkucommon/src/test/java/at/gv/egiz/bku/conf/CertValidatorTest.java b/bkucommon/src/test/java/at/gv/egiz/bku/conf/CertValidatorTest.java
new file mode 100644
index 00000000..7bc0daa5
--- /dev/null
+++ b/bkucommon/src/test/java/at/gv/egiz/bku/conf/CertValidatorTest.java
@@ -0,0 +1,32 @@
+package at.gv.egiz.bku.conf;
+
+import iaik.x509.X509Certificate;
+
+import java.io.File;
+import java.io.IOException;
+import java.security.cert.CertificateException;
+
+import static org.junit.Assert.*;
+
+import org.junit.Before;
+import org.junit.Test;
+
+public class CertValidatorTest {
+
+ private CertValidator cv;
+
+ @Before
+ public void setUp() {
+ cv = new CertValidatorImpl();
+ String caDir = getClass().getClassLoader().getResource("at/gv/egiz/bku/conf/certs/CACerts").getPath();
+ String certDir = getClass().getClassLoader().getResource("at/gv/egiz/bku/conf/certs/certStore").getPath();
+ cv.init(new File(caDir), new File(certDir));
+ }
+
+ @Test
+ public void testValid() throws CertificateException, IOException {
+ X509Certificate cert = new X509Certificate(getClass().getClassLoader().getResourceAsStream("at/gv/egiz/bku/conf/certs/testCerts/www.a-trust.at.der"));
+ assertTrue(cv.isCertificateValid("TID", new X509Certificate[]{cert}));
+ }
+
+}
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-01a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-01a.cer
new file mode 100644
index 00000000..f9fef65f
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-01a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-02a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-02a.cer
new file mode 100644
index 00000000..36a442b8
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-02a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-03a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-03a.cer
new file mode 100644
index 00000000..ab9e0cd7
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-Qual-03a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-01a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-01a.cer
new file mode 100644
index 00000000..efa28178
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-01a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-03.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-03.cer
new file mode 100644
index 00000000..33e77636
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/CACerts/A-Trust-nQual-03.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-01a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-01a.cer
new file mode 100644
index 00000000..f9fef65f
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-01a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-02a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-02a.cer
new file mode 100644
index 00000000..36a442b8
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-02a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-03a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-03a.cer
new file mode 100644
index 00000000..ab9e0cd7
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-Qual-03a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-01a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-01a.cer
new file mode 100644
index 00000000..efa28178
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-01a.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-03.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-03.cer
new file mode 100644
index 00000000..33e77636
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/A-Trust-nQual-03.cer
Binary files differ
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-SSL-03.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-SSL-03.cer
new file mode 100644
index 00000000..ee859434
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-SSL-03.cer
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEdzCCA1+gAwIBAgIDAmU4MA0GCSqGSIb3DQEBBQUAMIGNMQswCQYDVQQGEwJB
+VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
+bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYDVQQLDBBBLVRydXN0LW5R
+dWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAzMB4XDTA2MDgxNjIyMDAw
+MFoXDTE2MDgxNjIyMDAwMFowgYcxCzAJBgNVBAYTAkFUMUgwRgYDVQQKDD9BLVRy
+dXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0ZW52
+ZXJrZWhyIEdtYkgxFjAUBgNVBAsMDWEtc2lnbi1TU0wtMDMxFjAUBgNVBAMMDWEt
+c2lnbi1TU0wtMDMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMjPM6
+PqgdPBPV4Efudpytt2Y4GZJfjeRdZo5SCuULDvvL+23xxBWnR3scFvfE1ekHN/YK
+k+2/qhU2B2ntoSNJSyDchNM8YPc9Lx67zZyhQTZgbBzh3IZAVb/hwuRRRV68JCBj
+r3r6v7IbwjH5XcVISdB4szx0z93aAQyKW9QkV+tD5a1vWFETvdHsZeVmDzfqcdsG
+AznPJw+9HrImCsswCWYUgPcFRkPNjj2r2NoyckVN781aWmNTAqJPf/Ckj9l9pUIt
+Vjhy8XNJW4iVDBkkykBXcGSkIau0ypJrRjsD1jKqUTIRZ/y2HlyltmwWi8OuyBLd
+LaHDbjc0b6JmqoivAgMBAAGjgeMwgeAwDwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4E
+CgQIQD6h02K0A90wEwYDVR0jBAwwCoAIRGqVZ1V5EU8wDgYDVR0PAQH/BAQDAgEG
+MIGUBgNVHR8EgYwwgYkwgYaggYOggYCGfmxkYXA6Ly9sZGFwLmEtdHJ1c3QuYXQv
+b3U9QS1UcnVzdC1uUXVhbC0wMyxvPUEtVHJ1c3QsYz1BVD9jZXJ0aWZpY2F0ZXJl
+dm9jYXRpb25saXN0P2Jhc2U/b2JqZWN0Y2xhc3M9ZWlkQ2VydGlmaWNhdGlvbkF1
+dGhvcml0eTANBgkqhkiG9w0BAQUFAAOCAQEAHKlnV3R9sbXojtONugyazkZCEzmC
+nZF1Dz4cOL0vPzzvS8MVWtG43zAgVI1NT/0ETSWsXD3YfzRi+f+/CxrGn0gwZX2t
+VGx+Z9w5ufiy1vuhxDUPmpos1TbJ4Wv3Une0E7iuHmNLg5qVlKeHWpcU8t1Y0nCt
+eRz34Qm87AVAykta33XST1fYvGoPKsDtn3qx9ye/pcbDvWjPwmqF2UUoql+d5hmJ
+Umgzwezqk4I+FS98BrnaPgC5UVFHg+yUjiUDLjYy7UvDZ5Led6kkLXuzVhQolLvr
+KTrGp5k42PG2MMkw8f6GMF/6yePXgzFMCRN8ReR7J5Htv33SytLRmFRd8g==
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-03.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-03.cer
new file mode 100644
index 00000000..7e67be95
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-03.cer
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEgzCCA2ugAwIBAgIDAarsMA0GCSqGSIb3DQEBBQUAMIGNMQswCQYDVQQGEwJB
+VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
+bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYDVQQLDBBBLVRydXN0LW5R
+dWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAzMB4XDTA1MTExMzIzMDAw
+MFoXDTE1MTExMzIzMDAwMFowgZMxCzAJBgNVBAYTAkFUMUgwRgYDVQQKDD9BLVRy
+dXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0ZW52
+ZXJrZWhyIEdtYkgxHDAaBgNVBAsME2Etc2lnbi1jb3Jwb3JhdGUtMDMxHDAaBgNV
+BAMME2Etc2lnbi1jb3Jwb3JhdGUtMDMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCp44qY+AiVXlcnHoKvch9s3ujoWFNktvcteIPwK7s0mb/uxTUW9UIF
+Die9n3AbyTsJE6R3nZYSJVHHi+1DKD72/WEo/B5NOOtd6KUMfJgca1tDmcsIwhFn
+82qkZrbNQwdIIdLe6+nDmjd9UBIaKv7yy1kq20jh09HOK3/bWhafVQE7EAgDfNrn
+8f0JfnnF0EA/La5kkg878L22fh9lRzt8H21THqJPtK4/e9SttjrJnPhFk2/MjAGS
+uaDufG6BV5Hnn7klR5qm5q32ypleLA6Zi4m9jRCVtPd4jRPYM40XpRkrJuFw+lxp
+rejfEZt/SRh1eQXiXDUgtgX8OaIylH9pAgMBAAGjgeMwgeAwDwYDVR0TAQH/BAUw
+AwEB/zARBgNVHQ4ECgQIQj75YZ1a5XIwEwYDVR0jBAwwCoAIRGqVZ1V5EU8wDgYD
+VR0PAQH/BAQDAgEGMIGUBgNVHR8EgYwwgYkwgYaggYOggYCGfmxkYXA6Ly9sZGFw
+LmEtdHJ1c3QuYXQvb3U9QS1UcnVzdC1uUXVhbC0wMyxvPUEtVHJ1c3QsYz1BVD9j
+ZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0P2Jhc2U/b2JqZWN0Y2xhc3M9ZWlkQ2Vy
+dGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOCAQEARu7e1SyBRjlA
+g/thtFwtKQRvopTZKWj2LWpEdvPvwThOvf8Depnas+ly5af8r8YzsqJzfX3XWvhN
+qOOI24g5FmXfCUTq/kbtaeTq/AqV94793IJfcilPnpMOEHMqXNDiRUoAgR/9EVj8
+mDVvL2lLlJzeAltqOD5Bi9QwguaD2/3/E5ymFnqkf1dnlXbo8AhcwPEzReNKn1eM
+Ilg4FwP1bP0HUK3Fyz1UQ/Hncg+MS7c+SkjpNEd4sH7/GdxuQs5Sk7IRwot1+sbX
+3CkkPhSqiUzig9raxJYrtbb2kyiUO8+d5HzRyoP4BNzsdZdPc0gDYweXg5qarHOQ
+16IEOtBmKg==
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-01a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-01a.cer
new file mode 100644
index 00000000..0c68e593
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-01a.cer
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIEJjCCAw6gAwIBAgIDAOJEMA0GCSqGSIb3DQEBBQUAMFUxCzAJBgNVBAYTAkFUMRAwDgYDVQQK
+EwdBLVRydXN0MRkwFwYDVQQLExBBLVRydXN0LW5RdWFsLTAxMRkwFwYDVQQDExBBLVRydXN0LW5R
+dWFsLTAxMB4XDTA0MTEzMDIzMDAwMFoXDTA4MTEzMDIzMDAwMFowgZ8xCzAJBgNVBAYTAkFUMUgw
+RgYDVQQKEz9BLVRydXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0
+ZW52ZXJrZWhyIEdtYkgxIjAgBgNVBAsTGWEtc2lnbi1jb3Jwb3JhdGUtbGlnaHQtMDExIjAgBgNV
+BAMTGWEtc2lnbi1jb3Jwb3JhdGUtbGlnaHQtMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDGC65v8rni63DojEBriynPwRqNCp14/SkN5ROkTUGNvLSabfSJV4PKGLTzasPAaChwX0g/
+kebahFM3R7nIyeVx2YB8VRvC4I/spP/mCs5+6pf1N+6Kiq4NcswgNBBfqAteaQIylBMy6HDkjoXY
+X/c+SxjyrqAkeZCK+SHMOraXCO1PZHWbYwleKXf4R2Z6ayEfJ2XWeVuqqon76WHp/POI0RADBchA
+6Vm1ROzSAHz39bay1TZunQXSs3VQ9cE3uQPjN+80efmf0ZgNF0sXsDTssoZg2feTANSOkTGM1bMC
+5xe1hWFL8MZNe4yZ+NSgFN2fofb8BPvyQAW0no2PNA6PAgMBAAGjgbMwgbAwDwYDVR0TAQH/BAUw
+AwEB/zARBgNVHQ4ECgQITp5/1C/JHx8wEwYDVR0jBAwwCoAITlnOxwIyhzAwDgYDVR0PAQH/BAQD
+AgEGMGUGA1UdHwReMFwwWqBYoFaGVGxkYXA6Ly9sZGFwLmEtdHJ1c3QuYXQvb3U9QS1UcnVzdC1u
+UXVhbC0wMSxvPUEtVHJ1c3QsYz1BVD9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0PzANBgkqhkiG
+9w0BAQUFAAOCAQEAOtuz2GqnTibk/poCLrdYKpZSrLyfWFsJJpfBYA9HMasnfpJBCHgRHJud6DAO
+xD900Vhmwy66D8dqsN3+fR8Bx8ZMKspnFN1B2Wz7LWOxMaKqP3JolJ/oVwzJRm0afcUMAfAumkc5
+Yqu0nC5qCF9zYY9YbJklh84uEzEg9j85kuRBHOCUc+5MVrnv7WPbirx6c95YFqXBQ0arA5QE9zYq
+MDO8aUYPOWEHgtrVI+kMwELYHqLDX7i9VqsXhgFPeVz1wIV7s/i3budGeHMS6hjnyIc30FqM7CTY
+fcvqVNZliErbjD1k1W1gMgvjLJowNvQC0W7K9/yoQhwTqtNMR4WZwA==
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-02a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-02a.cer
new file mode 100644
index 00000000..c300891d
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-02a.cer
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEizCCA3OgAwIBAgIDAOSoMA0GCSqGSIb3DQEBBQUAMIGLMQswCQYDVQQGEwJB
+VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
+bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRgwFgYDVQQLDA9BLVRydXN0LVF1
+YWwtMDIxGDAWBgNVBAMMD0EtVHJ1c3QtUXVhbC0wMjAeFw0wNDEyMTQyMzAwMDBa
+Fw0xNDEyMTMyMzAwMDBaMIGfMQswCQYDVQQGEwJBVDFIMEYGA1UECgw/QS1UcnVz
+dCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBpbSBlbGVrdHIuIERhdGVudmVy
+a2VociBHbWJIMSIwIAYDVQQLDBlhLXNpZ24tY29ycG9yYXRlLWxpZ2h0LTAyMSIw
+IAYDVQQDDBlhLXNpZ24tY29ycG9yYXRlLWxpZ2h0LTAyMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAk6V4oEauvXgEICqgjTbGHaiDhBVo2nosX23osoKM
+LTkkO/nOCgpdCYpLKgURxwrgHgVh9XT99yxhy6lDwt2rASajj0sQ1fY5BmWVyrXS
+dQ78ISMPb73XaG4M8H7PJFcsVEo9n8veVQwnMY5mSWy0r1IO8n93Bjbmmi4Zt8oS
+p9olWo5/8ByYW8S/AKZuQx+q+bFJv7geuApVjK2iVFe8yQqHhAgDsAsDlMvxDAQ/
+vhrGwHRv8N3sLsjirnbf5S2dGLDjASOMUFvwfLQd7gHH7PV37Xa+aQqa97eE6O4O
+sIhcGRYhoLk/tWTBDapcgHJ0yTtrftuwORVteLUAy0gBNwIDAQABo4HhMIHeMA8G
+A1UdEwEB/wQFMAMBAf8wEQYDVR0OBAoECEkcWDpP6A0DMBMGA1UdIwQMMAqACEI9
+KySmwUXOMA4GA1UdDwEB/wQEAwIBBjCBkgYDVR0fBIGKMIGHMIGEoIGBoH+GfWxk
+YXA6Ly9sZGFwLmEtdHJ1c3QuYXQvb3U9QS1UcnVzdC1RdWFsLTAyLG89QS1UcnVz
+dCxjPUFUP2NlcnRpZmljYXRlcmV2b2NhdGlvbmxpc3Q/YmFzZT9vYmplY3RjbGFz
+cz1laWRDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MA0GCSqGSIb3DQEBBQUAA4IBAQBH
+opWG7LKmPBvuGjZnRV4KGKzzUYVuxSRS1E0VIUPbVLf5xW2r5uUpR8ud5EpiPrcw
+k6K0dzu2Vb4ZbMIP+6J16S/0qvTp/3A/3q87+nJ+ot+IT8GZFJfSw18th2WmZdzR
+ShbM6sgViPtGsFROCdWeiHl248w2+zG+09sf8Bu3UyvwLRAiiKaxuwVdQ9kc0TL3
+gvv+K5eisWWthQOX2IF2jGSEqoAVwfHhl7bc9Vt7XnJSpQFebHnsIVuV4Mv6w4ww
+86hQPCLLvvV7wWDiBQ8l2FWneX0pNH3Wg+A1TRUoptc+pPDdpoP272MDm4fXyPKV
+7QgIaIK+gXNUj2GGt1K9
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-03.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-03.cer
new file mode 100644
index 00000000..2251ca22
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-light-03.cer
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEjzCCA3egAwIBAgIDAartMA0GCSqGSIb3DQEBBQUAMIGNMQswCQYDVQQGEwJB
+VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
+bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYDVQQLDBBBLVRydXN0LW5R
+dWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAzMB4XDTA1MTExMzIzMDAw
+MFoXDTE1MTExMzIzMDAwMFowgZ8xCzAJBgNVBAYTAkFUMUgwRgYDVQQKDD9BLVRy
+dXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0ZW52
+ZXJrZWhyIEdtYkgxIjAgBgNVBAsMGWEtc2lnbi1jb3Jwb3JhdGUtbGlnaHQtMDMx
+IjAgBgNVBAMMGWEtc2lnbi1jb3Jwb3JhdGUtbGlnaHQtMDMwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQC359oitbHkkEgdErRPeBdkcYRK2DLdxfcnn+SI
+umSEYzWVscRTchPKSzb7f1a6EHPbB5WZsGJaUDX9KfTqsJNMo+7bASKk3gsLVxNZ
+qY2t2G+y8HvREYYejDOIzjAkcBQrt+nvuBUlGYVJQjEuyAn18f2vG0Y3VNvZFGKn
+PK8AVycUMk0Uw21RbK3vX5tbbPgQ/kcZkN4czi5VHepMvf6hAwwLoJj+KL9zxm8j
+yPK88qCBKAjMNCpZKsEhyanw1CjYbVmHs45Q5W6FBtqDcS6Iq4mC6TtUPGtCTuoH
+7/JLuhEp075ohp87v3fSlzeLJjBpkUDP9U8Tv7l2euD0t1UVAgMBAAGjgeMwgeAw
+DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQIQZFpHL+t2JgwEwYDVR0jBAwwCoAI
+RGqVZ1V5EU8wDgYDVR0PAQH/BAQDAgEGMIGUBgNVHR8EgYwwgYkwgYaggYOggYCG
+fmxkYXA6Ly9sZGFwLmEtdHJ1c3QuYXQvb3U9QS1UcnVzdC1uUXVhbC0wMyxvPUEt
+VHJ1c3QsYz1BVD9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0P2Jhc2U/b2JqZWN0
+Y2xhc3M9ZWlkQ2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOC
+AQEADTRIaQtPwoPS6/TpyBhOw4wAHk/RM4gkLT76URPY2sUHihxqy+8qEElN+f5l
+I61myCP3IFTClflcHVR1QCoMg0ZI5/EcQTI8Dgd5iQkXuVjh3wCj87Ka2Tu7d1K+
+i9VJ4BR/ph/qmPKR7Lx/PtATw/vWo4k2rbt5o1QwixZ7CPt+BF9xCaAC4uL0bB0M
+9M3i9W2ePmqX6WIB3jMkT9FQC0KihPPfw/17KddNi4rFMMEiTyKvJTtTqDnIAwWW
+TqsL1G7oxMMtnnYaKWMQ6gQiOiRzCY7efcAi/3YwUX6ULW5zxqapNs1vqEbSGsQE
+l1eFl67HBZHYAPdoHGUnZF0KaQ==
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-01a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-01a.cer
new file mode 100644
index 00000000..2d7f1a03
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-01a.cer
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIEKDCCAxCgAwIBAgIDAOKKMA0GCSqGSIb3DQEBBQUAMFUxCzAJBgNVBAYTAkFUMRAwDgYDVQQK
+EwdBLVRydXN0MRkwFwYDVQQLExBBLVRydXN0LW5RdWFsLTAxMRkwFwYDVQQDExBBLVRydXN0LW5R
+dWFsLTAxMB4XDTA0MTIwNTIzMDAwMFoXDTA4MTEzMDIzMDAwMFowgaExCzAJBgNVBAYTAkFUMUgw
+RgYDVQQKEz9BLVRydXN0IEdlcy4gZi4gU2ljaGVyaGVpdHNzeXN0ZW1lIGltIGVsZWt0ci4gRGF0
+ZW52ZXJrZWhyIEdtYkgxIzAhBgNVBAsTGmEtc2lnbi1jb3Jwb3JhdGUtbWVkaXVtLTAxMSMwIQYD
+VQQDExphLXNpZ24tY29ycG9yYXRlLW1lZGl1bS0wMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBANEbZyIMIXZYBjTj/+3TrNGssRKNNdTedQlWB3vJQWLzeG89Kzmhy1WDX8IqDrMtvpXH
+5w6urK3ZT7HGu2Jldrib8rkEOdE9+uNGRtkP8Kuz//CvdXCbIDvBLqgvWn9a3Sl/rUicPqKwcEcN
+bP2Q0iU6NvvALmoqs93PymfTZlkGOwzUe+O88huXkauGWT/DkJd4JYDNJ0wlaGrJa+OorT4Izk1J
+EipqqedUjsAj4Gq3SKrZKG/H/CkoH9uWTzrzFgg8zQhCES4AClo84XVk//EIv3ABDw4hr+lqV1nF
+eXch9o4mLIe5u045471YLJLmyuCPDopb8U2VUoyldpMx+Y8CAwEAAaOBszCBsDAPBgNVHRMBAf8E
+BTADAQH/MBEGA1UdDgQKBAhOuHKxmCmfZDATBgNVHSMEDDAKgAhOWc7HAjKHMDAOBgNVHQ8BAf8E
+BAMCAQYwZQYDVR0fBF4wXDBaoFigVoZUbGRhcDovL2xkYXAuYS10cnVzdC5hdC9vdT1BLVRydXN0
+LW5RdWFsLTAxLG89QS1UcnVzdCxjPUFUP2NlcnRpZmljYXRlcmV2b2NhdGlvbmxpc3Q/MA0GCSqG
+SIb3DQEBBQUAA4IBAQDaukYSeJVxWAh8QShqGqA6Plp9aXCTzwl9hE2gb+/xGPASo+NVQi/sUa0+
+bx29oSJaW6lKzdHQLAx4dwW9XTpJ+0mebB4fQfYHH0lGc1O4au/4O9k+C3SrD6x4WeY9k/SpUFu1
+qjzH+tjta81UWtU7Jve1BhckNwdOFx7cR8fdW+pUQSDV9XnPJfyb+gb9KWhvX+XAbgJoXW1HjJOO
+P5sx6mFhMb3UqAfKQVoAuGbl4+uxIThBTqpICkaaD8WLdukqQjomUMDRbWIf6SblPuOEpPi1G/WM
+qkTkpqX77Wkj08QY/yj5DDrsYJ5NymnWvu7jcoxCFCKvEQ8Q4g7AYKnG
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-02a.cer b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-02a.cer
new file mode 100644
index 00000000..194d4d7c
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/certStore/a-sign-corporate-medium-02a.cer
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEjTCCA3WgAwIBAgIDAOSpMA0GCSqGSIb3DQEBBQUAMIGLMQswCQYDVQQGEwJB
+VDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBp
+bSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRgwFgYDVQQLDA9BLVRydXN0LVF1
+YWwtMDIxGDAWBgNVBAMMD0EtVHJ1c3QtUXVhbC0wMjAeFw0wNDEyMTQyMzAwMDBa
+Fw0xNDEyMTMyMzAwMDBaMIGhMQswCQYDVQQGEwJBVDFIMEYGA1UECgw/QS1UcnVz
+dCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBpbSBlbGVrdHIuIERhdGVudmVy
+a2VociBHbWJIMSMwIQYDVQQLDBphLXNpZ24tY29ycG9yYXRlLW1lZGl1bS0wMjEj
+MCEGA1UEAwwaYS1zaWduLWNvcnBvcmF0ZS1tZWRpdW0tMDIwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCuaTBb6rHd5JZqAdvpmGIl5ne0Hg6GbpJvBeCI
+U6l9Rs8ebMY6aIS++qJOE9rnJHdfZNzLzduuoWEzEuwm9a/azQThM+eT+xlG/Vcf
+NuOQTTjAuXHLvYQ7WxSrBIT/kmAyqJgq/DEPvdX4jmCtVkuZ1gbxYIChLOVBWkVC
+FCK49BuXECtNy5fzK/GyfouZOVoQgiQ1YfecqzibcwO0t+f68Pvp/s6HESAH5tXY
+PdENDw4c/W/qKaeR87jPq98AJ8Lr4bmjWLjK8/ITtGglnJy8osFz22oR7f6fbWl6
+5LdhJ3giM68WEabQcZkw8cx3RDOzbnL2Kn+PVNHHyp3Wh849AgMBAAGjgeEwgd4w
+DwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISoLnpz/+q98wEwYDVR0jBAwwCoAI
+Qj0rJKbBRc4wDgYDVR0PAQH/BAQDAgEGMIGSBgNVHR8EgYowgYcwgYSggYGgf4Z9
+bGRhcDovL2xkYXAuYS10cnVzdC5hdC9vdT1BLVRydXN0LVF1YWwtMDIsbz1BLVRy
+dXN0LGM9QVQ/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdD9iYXNlP29iamVjdGNs
+YXNzPWVpZENlcnRpZmljYXRpb25BdXRob3JpdHkwDQYJKoZIhvcNAQEFBQADggEB
+ABqg1oRs/TZ0hJLJRV/xJglFzgn2fDAXeoVvWnAE09F1d0n+ZorKAKbMfiZ2CuKs
+M0AhU23/5zM90DdrtYWXpa+P8ONALZtHJIqGfVuRKYJq7jY5TpE3yRkTcrp47smp
+WqTwUgG+0aBeU9m+ZtGUFOsBkq+MudD8IZGc7VcLd1n4ltND9ITjX20hu01ju56c
+YC69vFa5hmIccXg/Q3dGEV5Amx8MTQJluG3QvqBOY74yrAFICvK1zsvu+vOGvJQj
+i+PxKlbQdehrV82VDxyfSjpEUADWMGRfE5vg4YBGgfRosh4w7a6ThD2LMLFPmIhy
+P6+VGUBCm2tMDDOo9DVkXFs=
+-----END CERTIFICATE-----
diff --git a/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/testCerts/www.a-trust.at.der b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/testCerts/www.a-trust.at.der
new file mode 100644
index 00000000..61ce8dff
--- /dev/null
+++ b/bkucommon/src/test/resources/at/gv/egiz/bku/conf/certs/testCerts/www.a-trust.at.der
Binary files differ