Ayuda para validar FIEL del SAT desde Java

//validamos que el certificado sea un CSD
X509Certificate cer = CertUtils.getCertificate(cerFile);

//los certificados CSD solo permiten la firma digital
int pathLen = cer.getBasicConstraints();
if(pathLen != -1){
    throw new RuntimeException("El certificado no es un CSD, posee el atributo de Autoridad Certificadora (CA)");
}

//              boolean[] ku = cer.getKeyUsage();
//              if(!ku[0] || !ku[1] || ku[2] || ku[3] || ku[4] || ku[5] || ku[6] || ku[7] || ku[8]){
//                      throw new RuntimeException("El certificado no es un CSD, no posee los usos correctos");
//              }

if(CertUtils.getSerial(cer.getSerialNumber()).length() != 20){
    throw new RuntimeException("El numero de serie del certificado debe contener 20 caracteres");
}

//encriptamos un texto y lo desencriptamos para validar que las llaves sean correspondientes
String signatureBase64 = CertUtils.signSha1ConRsa(CertUtils.TEST_MSG, pkey);

if(!CertUtils.verifySha1ConRsa(CertUtils.TEST_MSG, signatureBase64, cer)){
    throw new RuntimeException("La llave privada y el certificado no corresponden");
}

X500PrincipalHelper issuer = new X500PrincipalHelper(cer.getIssuerX500Principal());

//este atributo indica que el sello fue emitido por un CA del SAT
String unstructuredName = CertUtils.getAttribute(issuer, CertUtils.UnstructuredName);
if(unstructuredName == null){
    int result = JOptionPane.showConfirmDialog(getMainWindow(),
        "El certificado no posee el atributo '" + CertUtils.UnstructuredName + "' del SAT, ¿Desea continuar agregándolo?",
        "Confirmación", JOptionPane.OK_CANCEL_OPTION, JOptionPane.WARNING_MESSAGE);
   
    if(result != JOptionPane.OK_OPTION){
        return;
    }
}

X500PrincipalHelper subject = new X500PrincipalHelper(cer.getSubjectX500Principal(), X500Principal.RFC1779);
String rfc = StringUtils.trimToNull(CertUtils.getAttribute(subject, "OID.2.5.4.45"));
if(rfc == null){
    int result = JOptionPane.showConfirmDialog(getMainWindow(),
        "El sello no contiene el RFC del contribuyente, ¿Desea continuar?",
        "Confirmación", JOptionPane.OK_CANCEL_OPTION, JOptionPane.WARNING_MESSAGE);
   
    if(result != JOptionPane.OK_OPTION){
        return;
    }
} else{
    String rfcEmp = "ERD800101ERT";//rfc del emisor
    if(StringUtils.contains(rfc, '/')){
        String[] tokens = StringUtils.split(rfc, '/');
        rfc = StringUtils.trimToEmpty(tokens[0]);
    }
   
    if(rfcEmp.equals(rfc) == false){
        throw new RuntimeException("EL RFC indicado en el sello es diferente al RFC de la empresa");
    }
}

public static PrivateKey getPrivateKey(byte[] encryptedKey, String passphrase){
    try {
        PKCS8Key pkcs8 = new PKCS8Key(encryptedKey, passphrase.toCharArray());
        return  pkcs8.getPrivateKey();
    } catch (Exception e) {
        e.printStackTrace();
        throw new RuntimeException("Clave del archivo privado (archivo key) inválida");
    }
}

public static X509Certificate getCertificate(File file){
    InputStream is = null;
    try {
        is = new FileInputStream(file);
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509Certificate cert = (X509Certificate)cf.generateCertificate(is);
        return cert;
    } catch (Exception ex) {
        throw new RuntimeException(ex);
    } finally{
        try {
            is.close();
        } catch (IOException e) { }
    }
}

public static String getSerial(BigInteger big){
    String hex = big.toString(16);
   
    if(hex.length() % 2 != 0){
        return com.aipisoft.common.util.StringUtils.EMPTY;
    }
   
    StringBuilder serial = new StringBuilder();
    int pares = hex.length() / 2;
    for(int i=0; i<pares; i++){
        serial.append((char)Integer.parseInt(hex.substring(2*i, (2*i)+2), 16));
    }
   
    return serial.toString();
}

public static String signSha1ConRsa(String datos, PrivateKey pkey) {
    try{ return CertUtils.signSha1ConRsa(datos.getBytes("UTF8"), pkey); } catch(UnsupportedEncodingException ex){ ex.printStackTrace(); throw new RuntimeException(ex);}
}

public static String signSha1ConRsa(byte[] datos, PrivateKey pkey){
    return CertUtils.sign("SHA1withRSA", datos, pkey);
}

public static String signSha256ConRsa(String datos, PrivateKey pkey) {
    try{ return CertUtils.signSha256ConRsa(datos.getBytes("UTF8"), pkey); } catch(UnsupportedEncodingException ex){ ex.printStackTrace(); throw new RuntimeException(ex);}
}

public static String signSha256ConRsa(byte[] datos, PrivateKey pkey){
    return CertUtils.sign("SHA256withRSA", datos, pkey);
}

/** Firma o sella digitalmente datos usando el algoritmo indicado con la llave privada proporcionada, retorna el resultado en Base64 */
public static String sign(String algorithm, byte[] datos, PrivateKey pkey){
    try {
        Signature signer = Signature.getInstance(algorithm);
        signer.initSign(pkey);
        signer.update(datos);
        return CertUtils.trimBase64(CertUtils.toBase64(signer.sign()));
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

public static boolean verifySha1ConRsa(String plainMsg, String signatureBase64, Certificate certificate){
    try{
        return CertUtils.verifySha1ConRsa(plainMsg.getBytes("UTF8"), signatureBase64, certificate);
    } catch(UnsupportedEncodingException ex){ ex.printStackTrace(); throw new RuntimeException(ex);}
}

public static boolean verifySha1ConRsa(byte[] plainMsg, String signatureBase64, Certificate certificate){
    return CertUtils.verify("SHA1withRSA", plainMsg, signatureBase64, certificate);
}

public static boolean verifySha256ConRsa(String plainMsg, String signatureBase64, Certificate certificate){
    try{
        return CertUtils.verifySha256ConRsa(plainMsg.getBytes("UTF8"), signatureBase64, certificate);
    } catch(UnsupportedEncodingException ex){ ex.printStackTrace(); throw new RuntimeException(ex);}
}

public static boolean verifySha256ConRsa(byte[] plainMsg, String signatureBase64, Certificate certificate){
    return CertUtils.verify("SHA256withRSA", plainMsg, signatureBase64, certificate);
}

public static boolean verify(String algorithm, byte[] plainMsg, String signatureBase64, Certificate certificate){
    return CertUtils.verify(algorithm, plainMsg, CertUtils.fromBase64(signatureBase64), certificate);
}

public static boolean verify(String algorithm, byte[] plainMsg, byte[] signature, Certificate certificate){
    try {
        Signature signer = Signature.getInstance(algorithm);
        signer.initVerify(certificate);
        signer.update(plainMsg);
        return signer.verify(signature);
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

public static String getAttribute(X500PrincipalHelper principal, String attrName){
    List values = principal.getAllValues(attrName);
    return values.size() > 0 ? values.get(0).toString() : null;
}

import java.util.ArrayList;
import java.util.Iterator;

import javax.security.auth.x500.X500Principal;

import org.apache.commons.lang3.StringUtils;

/**
 * X500PrincipalHelper
 * <p>
 * Helper class to extract pieces (attributes) of an X500Principal object for
 * display in the UI.
 * <p>
 * This helper uses the X500Principal.RFC2253 format of X500Principal.getname()
 * to parse an X500Principal name into it's component parts.
 * <p>
 * In principals which contain multiple occurrences of the same attribute,the
 * default for all the methods is to return the most significant (first)
 * attribute found.
 *
 */

public class X500PrincipalHelper {
        public static int LEASTSIGNIFICANT = 0;

        public static int MOSTSIGNIFICANT = 1;

        public final static String attrCN = "CN"; //$NON-NLS-1$

        public final static String attrOU = "OU"; //$NON-NLS-1$

        public final static String attrO = "O"; //$NON-NLS-1$

        public final static String attrC = "C"; //$NON-NLS-1$

        public final static String attrL = "L"; //$NON-NLS-1$

        public final static String attrST = "ST"; //$NON-NLS-1$

        public final static String attrSTREET = "STREET";//$NON-NLS-1$

        public final static String attrEMAIL = "EMAILADDRESS"; //$NON-NLS-1$

        public final static String attrUID = "UID"; //$NON-NLS-1$

        ArrayList rdnNameArray = new ArrayList();

        private final static String attrTerminator = "="; //$NON-NLS-1$

        public X500PrincipalHelper() {
                // Do nothing constructor..
                // Wont be useful unless setPrincipal is called...
        }

        public X500PrincipalHelper(X500Principal principal) {
                this(principal, X500Principal.RFC2253);
        }
       
        public X500PrincipalHelper(X500Principal principal, String format) {
                parseDN(principal.getName(format));
        }

        /**
         * Returns an ArrayList containing all the values for the given attribute
         * identifier.
         * <p>
         *
         * @param attributeID
         *            String containing the X500 name attribute whose values are to
         *            be returned
         * @return ArrayList containing the string values of the requested
         *         attribute. Values are in the order they occur. May be empty.
         *
         */
        public ArrayList getAllValues(String attributeID) {
                ArrayList retList = new ArrayList();
                String searchPart = attributeID + attrTerminator;

                for (Iterator iter = rdnNameArray.iterator(); iter.hasNext();) {
                        ArrayList nameList = (ArrayList) iter.next();
                        String namePart = (String) nameList.get(0);

                        if (namePart.startsWith(searchPart)) {
                                // Return the string starting after the ID string and the = sign
                                // that follows it.
                                retList.add(namePart.toString().substring(searchPart.length()));
                        }
                }

                return retList;

        }

        /**
         * Gets the Country (C) attribute from the given X500Principal object.
         * <p>
         *
         * @return the C attribute.
         *
         */
        public String getC() {
                return findPart(attrC);
        }

        /**
         * Gets the most significant common name (CN) attribute from the given
         * X500Principal object. For names that contains multiple attributes of this
         * type. The first (most significant) one will be returned
         * <p>
         *
         * @return the Most significant common name attribute.
         *
         */
        public String getCN() {
                return findPart(attrCN);
        }

        /**
         * Gets the Email Address (EMAILADDRESS) attribute from the given
         * X500Principal object.
         * <p>
         *
         * @return the EMAILADDRESS attribute.
         *
         */
        public String getEMAILDDRESS() {
                return findPart(attrEMAIL);
        }

        /**
         * Gets the Locale (L) attribute from the given X500Principal object.
         * <p>
         *
         * @return the L attribute.
         *
         */
        public String getL() {
                return findPart(attrL);
        }

        /**
         * Gets the most significant Organization (O) attribute from the given
         * X500Principal object. For names that contains multiple attributes of this
         * type. The first (most significant) one will be returned
         * <p>
         *
         * @return the Most significant O attribute.
         *
         */

        public String getO() {
                return findPart(attrO);

        }

        /**
         * Gets the most significant Organizational Unit (OU) attribute from the
         * given X500Principal object. For names that contains multiple attributes
         * of this type. The first (most significant) one will be returned
         * <p>
         *
         * @return the Most significant OU attribute.
         *
         */

        public String getOU() {
                return findPart(attrOU);

        }

        /**
         * Gets the State (ST) attribute from the given X500Principal object.
         * <p>
         *
         * @return the ST attribute.
         *
         */
        public String getST() {
                return findPart(attrST);
        }

        /**
         * Gets the Street (STREET) attribute from the given X500Principal object.
         * <p>
         *
         * @return the STREET attribute.
         *
         */
        public String getSTREET() {
                return findPart(attrSTREET);
        }

        public String getUID() {
                return findPart(attrUID);
        }

        /**
         * Set the X500Principal name object to be parsed.
         * <p>
         *
         * @param principal
         *            - X500Principal
         */
        public void setPrincipal(X500Principal principal) {
                setPrincipal(principal, X500Principal.RFC2253);
        }
       
        public void setPrincipal(X500Principal principal, String format) {
                parseDN(principal.getName(format));
        }

        private String findPart(String attributeID) {
                return findSignificantPart(attributeID, MOSTSIGNIFICANT);
        }

        private String findSignificantPart(String attributeID, int significance) {
                String retNamePart = null;
                String searchPart = attributeID + attrTerminator;

                for (Iterator iter = rdnNameArray.iterator(); iter.hasNext();) {
                        ArrayList nameList = (ArrayList) iter.next();
                        String namePart = (String) nameList.get(0);

                        if (namePart.startsWith(searchPart)) {
                                // Return the string starting after the ID string and the = sign
                                // that follows it.
                                retNamePart = namePart.toString().substring(searchPart.length());
                                // By definition the first one is most significant
                                if (significance == MOSTSIGNIFICANT)
                                        break;
                        }
                }

                return retNamePart;
        }

        /**
         * Derived From: org.eclipse.osgi.internal.verifier - DNChainMatching.java
         *
         * Takes a distinguished name in canonical form and fills in the rdnArray
         * with the extracted RDNs.
         *
         * @param dn
         *            the distinguished name in canonical form.
         * @throws IllegalArgumentException
         *             if a formatting error is found.
         */
        private void parseDN(String dn) throws IllegalArgumentException {
                int startIndex = 0;
                char c = '\0';
                ArrayList nameValues = new ArrayList();

                // Clear the existing array, in case this instance is being re-used
                rdnNameArray.clear();

                while (startIndex < dn.length()) {
                        int endIndex;
                        for (endIndex = startIndex; endIndex < dn.length(); endIndex++) {
                                c = dn.charAt(endIndex);
                                if (c == ',' || c == '+')
                                        break;
                                if (c == '\\') {
                                        endIndex++; // skip the escaped char
                                }
                        }

                        if (endIndex > dn.length())
                                throw new IllegalArgumentException("unterminated escape " + dn); //$NON-NLS-1$

                        nameValues.add(StringUtils.trimToEmpty(dn.substring(startIndex, endIndex)));

                        if (c != '+') {
                                rdnNameArray.add(nameValues);
                                if (endIndex != dn.length())
                                        nameValues = new ArrayList();
                                else
                                        nameValues = null;
                        }
                        startIndex = endIndex + 1;
                }
                if (nameValues != null) {
                        throw new IllegalArgumentException("improperly terminated DN " + dn); //$NON-NLS-1$
                }
        }
}