diff -urN ../../31/ejbca/Changelog.txt ./Changelog.txt
--- ../../31/ejbca/Changelog.txt	Mon Jun 20 14:10:19 2005
+++ ./Changelog.txt	Thu Aug 18 16:36:46 2005
@@ -1,3 +1,31 @@
+3.1.2
+---
+New Feature
+    * [ECA-46] - multiple instances of altNames in certificates
+    * [ECA-130] - Implement new Scep mode using POST
+Bug
+    * [ECA-118] - Imported OpenSSL CA not working
+    * [ECA-121] - Can not publish certificate with comma in DN to LDAP
+    * [ECA-123] - Dash not allowed in username
+    * [ECA-124] - User passwords leak into debug log
+    * [ECA-125] - Admiweb too restrictive for estonian chars.
+    * [ECA-126] - Some imported CA certificate contains the field "friendlyName" in PKCS#12 twice
+    * [ECA-131] - Problem with certificate import CLI command
+    * [ECA-133] - Single quote in DN does not work
+    * [ECA-136] - senderNonce in returned SCEP messages longer than 16 bytes
+Improvement
+    * [ECA-108] - Add changelog to ejbca web site
+
+3.1.1
+---
+** Bug
+    * [ECA-113] - key Ids looks critical when editing certificate profiles
+** Task
+    * [ECA-111] - Remove obsolete cli commands
+** Improvement
+    * [ECA-114] - add CA id to 'ca info' cli command
+    * [ECA-116] - Added caid to create certificate method
+
 3.1
 ---
 General (not from Jira):
diff -urN ../../31/ejbca/build.xml ./build.xml
--- ../../31/ejbca/build.xml	Mon Jun 20 09:30:46 2005
+++ ./build.xml	Thu Aug 18 16:32:07 2005
@@ -3,7 +3,7 @@
 
 	<property name="app.name" value="ejbca" />
     <property name="app.name.cap" value="EJBCA" />
-	<property name="app.version" value="${app.name.cap} 3.1" />
+	<property name="app.version" value="${app.name.cap} 3.1.2" />
 	
     <property name="ejbca.home" location="." />
     <property environment="env" />
@@ -134,7 +134,7 @@
     <!-- =================================================================== -->
     <target name="init" depends="j2ee:check">
         <echo>
----------- CONFIGURATION PROPERTIES ----------
+---------- ${app.version} CONFIGURATION PROPERTIES ----------
 jboss.home             = ${jboss.home}
 ca.keystorepass        = ${ca.keystorepass}
 ca.ocspkeystorepass    = ${ca.ocspkeystorepass}
@@ -692,8 +692,7 @@
             <batchtest fork="yes" todir="${test.dir}/reports">
                 <fileset dir="${test.dir}">
                     <include name="**/util/Test*" />
-                    <!-- The Messagesteste demands some CAs that we can't create automagically
-                    <include name="**/protocol/Test*" /> -->
+                    <include name="**/protocol/Test*" />
                     <include name="**/ra/Test*" />
                     <!-- LotsosUsers creates LOOOOTS of users, only run once in a while -->
                     <exclude name="**/ra/TestAddLotsofUsers*" />
@@ -735,9 +734,11 @@
                 <path location="${test.dir}" />
             </classpath>
             <formatter type="xml" />
-            <batchtest fork="no" todir="${test.dir}/web/reports">
+        	<!-- we must use fork=yes or the BC JCE won't be authenticated due to some problem with ant classloading -->
+            <batchtest fork="yes" todir="${test.dir}/web/reports">
                 <fileset dir="${test.dir}">
-                    <include name="**/protocol/ProtocolHttpTest*" />
+                    <include name="**/protocol/ProtocolScepHttpTest*" />
+                    <include name="**/protocol/ProtocolOcspHttpTest*" />
                     <include name="**/webdist/WebdistHttpTest*" />
                 </fileset>
             </batchtest>
diff -urN ../../31/ejbca/doc/RELEASE_NOTES ./doc/RELEASE_NOTES
--- ../../31/ejbca/doc/RELEASE_NOTES	Fri Jun 17 10:07:05 2005
+++ ./doc/RELEASE_NOTES	Thu Aug 18 16:36:46 2005
@@ -1,3 +1,18 @@
+EJBCA V3.1.2
+------------
+This is a minor release with a few minor new features and some bugfixes.
+Read the changelog for details.
+
+This is a plugin-upgrade from 3.1/3.1.1.
+Simply keep ejbca.properties from the earlier release, and 'ant deploy' this new one.
+
+EJBCA V3.1.1
+------------
+This is a minor release with a few small bugfixes found in the 3.1 release.
+Read the changelog for details.
+
+This is a plugin-upgrade from 3.1.
+
 EJBCA V3.1
 ----------
 This is a major release including many new features, improvements, and bug fixes. 
Binary files ../../31/ejbca/lib/bcmail-jdk14.jar and ./lib/bcmail-jdk14.jar differ
Binary files ../../31/ejbca/lib/bcprov-jdk14.jar and ./lib/bcprov-jdk14.jar differ
diff -urN ../../31/ejbca/src/adminweb/ca/editcertificateprofiles/certificateprofilepage.jspf ./src/adminweb/ca/editcertificateprofiles/certificateprofilepage.jspf
--- ../../31/ejbca/src/adminweb/ca/editcertificateprofiles/certificateprofilepage.jspf	Thu May 12 20:27:55 2005
+++ ./src/adminweb/ca/editcertificateprofiles/certificateprofilepage.jspf	Tue Jun 28 15:01:32 2005
@@ -212,7 +212,7 @@
       </td>
     <tr  id="Row<%=row++%2%>"> 
       <td width="50%"  align="right"> 
-        <%= ejbcawebbean.getText("SUBJECTKEYID") %> <br>  <%= ejbcawebbean.getText("SUBJECTKEYIDCRITICAL") %>
+        <%= ejbcawebbean.getText("SUBJECTKEYID") %> <br> <!-- <%= ejbcawebbean.getText("SUBJECTKEYIDCRITICAL") %> -->
 
       </td>
       <td width="50%">
@@ -237,7 +237,7 @@
     </tr>
     <tr  id="Row<%=row++%2%>"> 
       <td width="50%"  align="right"> 
-         <%= ejbcawebbean.getText("AUTHORITYKEYID") %> <br> <%= ejbcawebbean.getText("AUTHORITYKEYIDCRITICAL") %> 
+         <%= ejbcawebbean.getText("AUTHORITYKEYID") %> <br> <!--<%= ejbcawebbean.getText("AUTHORITYKEYIDCRITICAL") %> -->
       </td>
       <td width="50%">
            <!-- Disable the use of critical flag, since it's easy to make misstakes
diff -urN ../../31/ejbca/src/adminweb/ejbcajslib.js ./src/adminweb/ejbcajslib.js
--- ../../31/ejbca/src/adminweb/ejbcajslib.js	Tue May 25 12:25:51 2004
+++ ./src/adminweb/ejbcajslib.js	Wed Aug 17 08:59:39 2005
@@ -51,7 +51,7 @@
 function checkfieldforlegalchars(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_ 0-9.]/g;
+  re = /[^a-öA-ÖüÜ_ 0-9\-.]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -64,7 +64,7 @@
 function checkfieldforlegalcharswithchangeable(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_ 0-9;]/g;
+  re = /[^a-öA-ÖüÜ_ 0-9\-;]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -77,7 +77,7 @@
 function checkfieldforlegaldnchars(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_ 0-9@\.\,\-:\/\?\=\(\)]/g;
+  re = /[^a-öA-ÖüÜ_ 0-9@\.\,\-:\/\?\'\=\(\)]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -90,7 +90,7 @@
 function checkfieldforcompletednchars(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_ 0-9@\,\=\.\-:\/\?\(\)]/g;
+  re = /[^a-öA-ÖüÜ_ 0-9@\,\=\.\-:\/\?\'\(\)]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -103,7 +103,7 @@
 function checkfieldforlegaldncharswithchangeable(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_ 0-9@.,\-:\/;\'\?\+\=\(\)\"]/g;
+  re = /[^a-öA-ÖüÜ_ 0-9@.,\-:\/;\'\?\+\=\(\)\"]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -129,7 +129,7 @@
 function checkfieldforlegalemailchars(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_0-9@\.\-]/g;
+  re = /[^a-öA-ÖüÜ_0-9@\.\-]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -142,7 +142,7 @@
 function checkfieldforlegalemailcharswithchangeable(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_0-9@\.\-;]/g;
+  re = /[^a-öA-ÖüÜ_0-9@\.\-;]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -155,7 +155,7 @@
 function checkfieldforlegalemailcharswithoutat(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_0-9\.\-]/g;
+  re = /[^a-öA-ÖüÜ_0-9\.\-]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -168,7 +168,7 @@
 function checkfieldforlegalemailcharswithoutatwithchangeable(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_0-9\.\-;]/g;
+  re = /[^a-öA-ÖüÜ_0-9\.\-;]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
@@ -209,7 +209,7 @@
 function checkfieldforlegalresourcechars(thetextfield , alerttext){
   field = eval(thetextfield);
   var text = new String(field.value);
-  re = /[^a-öA-Ö_ 0-9\/]/g;
+  re = /[^a-öA-ÖüÜ_ 0-9\/]/g;
   if(re.exec(text)){
     alert(alerttext);
     return false;
diff -urN ../../31/ejbca/src/adminweb/languages/languagefile.en.properties ./src/adminweb/languages/languagefile.en.properties
--- ../../31/ejbca/src/adminweb/languages/languagefile.en.properties	Tue Jun 14 14:20:30 2005
+++ ./src/adminweb/languages/languagefile.en.properties	Wed Aug 17 08:45:19 2005
@@ -93,13 +93,13 @@
 
 OF                        = of
 
-ONLYCHARACTERS            = Only characters, numbers, underscores and whitespace are allowed in field
+ONLYCHARACTERS            = Only characters, numbers, underscores, minus and whitespace are allowed in field
 
-ONLYCHARACTERS2           = Only characters, numbers, underscores and whitespace are allowed in fields.
+ONLYCHARACTERS2           = Only characters, numbers, underscores, minus and whitespace are allowed in fields.
 
 ONLYDECNUMBERS            = Only decimal numbers are allowed in field.
 
-ONLYDNCHARACTERS          = Only characters, numbers, underscores, '.' ',' '=' '(' ')' '/' and '@' are allowed in DN fields.
+ONLYDNCHARACTERS          = Only characters, numbers, underscores, '.' '-' ',' '=' '(' ')' '/' and '@' are allowed in DN fields.
 
 ONLYEMAILCHARS            = Only characters, numbers, underscores,'.' and '@'  are allowed in email field.
 
diff -urN ../../31/ejbca/src/adminweb/languages/languagefile.es.properties ./src/adminweb/languages/languagefile.es.properties
--- ../../31/ejbca/src/adminweb/languages/languagefile.es.properties	Tue Jun 14 14:20:30 2005
+++ ./src/adminweb/languages/languagefile.es.properties	Wed Aug 17 08:45:19 2005
@@ -97,7 +97,7 @@
 
 ONLYDECNUMBERS            = Solamente números decimales son permitidos en el campo.
 
-ONLYDNCHARACTERS          = Solamente caracteres, números, guión bajo, '.' ',' '=' '(' ')' '/' y '@' son permitidos en campos DN.
+ONLYDNCHARACTERS          = Solamente caracteres, números, guión bajo, '.' '-' ',' '=' '(' ')' '/' y '@' son permitidos en campos DN.
 
 ONLYEMAILCHARS            = Solamente caracteres, números, guión bajo,'.' y '@'  son permitidos en campos de email.
 
diff -urN ../../31/ejbca/src/adminweb/languages/languagefile.fr.properties ./src/adminweb/languages/languagefile.fr.properties
--- ../../31/ejbca/src/adminweb/languages/languagefile.fr.properties	Tue Jun 14 14:20:30 2005
+++ ./src/adminweb/languages/languagefile.fr.properties	Wed Aug 17 08:45:19 2005
@@ -1,4 +1,4 @@
-# French language file for the Enterprise Java Bean Certificate Authority
+# French language file for the Enterprise Java Bean Certificate Authority - report change to yquenechdu@linagora.com
  
  # General
  ADD                       = Ajouter
@@ -23,6 +23,8 @@
  
  CANCEL                    = Annuler
  
+ CHARS                     = caractères
+ 
  CLOSE                     = Fermer
  
  CREATE                    = Créer
@@ -41,6 +43,8 @@
  
  EDIT                      = Editer
  
+ ERROR                     = Erreur
+ 
  ERRORRECIEVINGFILE        = Erreur générée à la réception du fichier, Etes vous sûr qu'il est valide est qu'il au format PEM.
  
  HARDTOKEN                 = Token matériel
@@ -53,7 +57,7 @@
  
  INVERTSELECTION           = Inverser Sélection
  
- MADEBYPRIMEKEY            = Développé par PrimeKey Solutions AB, 2002-2005.
+ MADEBYPRIMEKEY            = Développé par PrimeKey 2004 
  
  MONTHJAN                  = Jan
  
@@ -95,7 +99,7 @@
  
  ONLYDECNUMBERS            = Seuls les nombres décimaux sont autorisés dans ce champ.
  
- ONLYDNCHARACTERS          = Seuls les caractères, nombres, underscores, '.' ',' '=' '(' ')' '/' et '@' sont autorisés dans les champs DN.
+ ONLYDNCHARACTERS          = Seuls les caractères, nombres, underscores, '.' '-' ',' '=' '(' ')' '/' et '@' sont autorisés dans les champs DN.
  
  ONLYEMAILCHARS            = Seuls les caractères, nombres, underscores,'.' et '@'  sont autorisés dans le champ email.
  
@@ -119,6 +123,8 @@
  
  RESET                     = Réinitialiser
  
+ RESTORE                   = Restaurer
+ 
  ROW                       = Colonnes:
  
  RULE                      = Règles
@@ -167,11 +173,11 @@
  
  EDITHARDTOKENISSUERS      = Editer l'émetteur de Token matériel
  
- EJBCAISAFULLY             = @EJBCA@ est une Autorité de certification pleinement opérationnelle . Basée sur une technologie J2EE qui fournit robustesse et performance. 
-
- EJBCAISAFULLY2            = @EJBCA@ peut être utilisé dans un mode autonome ou dans une application J2EE.
+ EJBCAISAFULLY             = EJBCA est une Autorité de certification pleinement opérationnelle . Basée sur une technologie J2EE qui fournit robustesse et performance. 
+ 
+ EJBCAISAFULLY2            = EJBCA peut être utilisé dans un mode autonome ou dans une application J2EE..
  
- ERRORNOBROWSER            = Erreur, Votre navigateur doit supporter les frames et le javascript 1.3 pour administrer @EJBCA@. 
+ ERRORNOBROWSER            = Erreur, Votre navigateur doit supporter les frames et le javascript 1.3 pour administrer EJBCA. 
  
  EXCEPTIONOCCURED          = Une erreur s'est produite
  
@@ -189,11 +195,11 @@
  
  SYSTEMFUNCTIONS           = Fonction Système
  
- TOEJBCA                   = dans l'Administration @EJBCA@.
+ TOEJBCA                   = dans l'Administration EJBCA.
  
  WELCOME                   = Bienvenue
  
- WRITTENEXCLUSIVELY        = Ecrit exclusivement en Java, @EJBCA@ peut fonctionner sur n'importe quelle plateforme J2EE qui fonctionne sur les environnements Linux et Windows.
+ WRITTENEXCLUSIVELY        = Ecrit exclusivement en Java, EJBCA peut fonctionner sur n'importe quelle plateforme J2EE qui fonctionne sur les environnements Linux et Windows.
  
  
  # Mostly Authorization Module
@@ -340,9 +346,11 @@
  
  # Mostly Ca Module
  
+ ACTIVATE                  = Activer
+ 
  ACTIVE                    = Actif 
  
- ACTIVEDIRECTORYPUBLISHER  = Annuaire de Publication actif 
+ ACTIVEDIRECTORYPUBLISHER  = Active Directory Microsoft
  
  ACCOUNTDISABLED           = désactiver compte
  
@@ -358,18 +366,28 @@
  
  ANYEXTENDEDKEYUSAGE       = Toutes les Extended Key Usage
  
+ AREYOUSUREACTIVATECA      = Etes vous sur de vouloir activer cette AC ?
+ 
  AREYOUSURETODELETECA      = Etes vous sur de vouloir détruire cette AC. Vous devez révoquer l'AC si vous l'avez utilisé pour émettre des certificats.
  
+ AREYOUSUREMAKECAOFFLINE   = Etes vous sur de vouloir mettre cette AC hors-ligne ?
+ 
  AREYOUSURERENEWCA         = Etes vous sur de vouloir renouveler cette AC
  
+ AREYOUSUREREPUBLISH       = Etes vous sur de vouloir republier ce certificat.
+ 
  AREYOUSUREREVOKECA        = Etes vous sur de vouloir révoquer cette AC.
  
- ARLATTRIBUTE              = LAR (Liste de révocation de l'AC racine)
+ ARLATTRIBUTE              = Attribut de la LAR (Liste de révocation de l'AC racine)
  
  AVAILABLEBITLENGTHS       = Taille de clef disponible
  
  AVAILABLECAS              = ACs disponible
  
+ AUTHENTICATIONCODE        = Code d'authentification
+
+ AUTHENTICATIONERROR       = Erreur d'authentification
+ 
  AUTHORITYKEYID            = Utiliser Identifiant de la clef publique de l'émetteur (Authority Key ID)
  
  AUTHORITYKEYIDCRITICAL    = définir Identifiant de la clef publique de l'émetteur (Authority Key ID) à critique
@@ -392,6 +410,8 @@
  
  CAACTIVATED               = La réponse de certificat reçu avec succès, AC activée
  
+ CAACTIVATIONSUCCESSFUL    = AC activer avec succès
+ 
  CAALREADY                 = l'AC existe déjà
  
  CACERTIFICATEATTR         = Attribut du certificat d'AC 
@@ -416,6 +436,10 @@
  
  CATOKENTYPE               = Support du certificat de l'AC
  
+ CATOKENAUTHFAILED         = Erreur: Autorisation incorrecte pour le Token de l'AC
+
+ CATOKENISOFFLINE          = Erreur: le Token de l'AC est hors ligne, Activer le Token avant de continuer.
+ 
  CATYPE                    = Type d'AC
  
  CERTIFICATE               = Certificat 
@@ -430,51 +454,59 @@
  
  CERTIFICATEPROFILE        = Profil de certificat
  
- CERTIFICATEPROFILEALREADY = Le profil de certificat existe déjà.
+CERTIFICATEPROFILEALREADY = Le profil de certificat existe déjà.
+ 
+CERTIFICATERESPONSE       = Réponse de certificat
  
- CERTIFICATERESPONSE       = Réponse de certificat
+CERTPROFILENOTFOUND       = Error, certificate profile not found.
+
+CERTREPUBLISHFAILED       = Erreur de publication du certification, voir les journaux pour plus d'informations.
+
+CERTREPUBLISHEDSUCCESS    = Certificats publié avec succès.
  
- CERTREQGEN                = Requête de certificat générée
+CERTREQGEN                = Requête de certificat générée
  
- CLASSPATH                 = Chemin de classe 
+CLASSPATH                 = Chemin de classe 
  
- CLIENTAUTH                = Authentification client
+CLIENTAUTH                = Authentification client
  
- CODESIGNING               = Signature de code
+CNPOSTFIX                 = CN de Postfix
+
+CODESIGNING               = Signature de code
  
- CONTESTEDSUCESSFULLY      = connexion testé avec succès
+CONTESTEDSUCESSFULLY      = connexion testé avec succès
  
- COULDNTDELETECA           = Impossible de détruire l'AC, elle est encore employée par quelques utilisateurs ou dans des profils ou des groupes d'admin.
+COULDNTDELETECA           = Impossible de détruire l'AC, elle est encore employée par quelques utilisateurs ou dans des profils ou des groupes d'admin.
  
- COULDNTDELETECERTPROF     = Ne peux pas détruire le profil du certificat, il est encore employé par quelques utilisateurs ou dans les profils .
+COULDNTDELETECERTPROF     = Ne peux pas détruire le profil du certificat, il est encore employé par quelques utilisateurs ou dans les profils .
  
- COULDNTDELETEPUBLISHER    = Impossible de détruire le service de publication, il est encore employé dans les profils de certificats.
+COULDNTDELETEPUBLISHER    = Impossible de détruire le service de publication, il est encore employé dans les profils de certificats.
  
- CREATECA                  = Créer AC
+CREATECA                  = Créer AC
  
- CREATECRL                 = Créer LCR/CRL
+CREATECRL                 = Créer LCR/CRL
  
- CREATENEWCRL              = Créer une nouvelle mise à jour de CRL
+CREATENEWCRL              = Créer une nouvelle mise à jour de LCR
  
- CREATENONEXISTINGUSERS    = Créer un utilisateur inexistant
+CREATENONEXISTINGUSERS    = Créer un utilisateur inexistant
  
- CRLATTRIBUTE              = CRL
+CRLATTRIBUTE              = Attribut de la LCR
  
- CRLDISTPOINT              = Utiliser le Point de distribution des CRL
+CRLDISTPOINT              = Utiliser le Point de distribution des LCR
  
- CRLDISTPOINTCRITICAL      = Point de distribution des CRL à critique
+CRLDISTPOINTCRITICAL      = Point de distribution des LCR à critique
  
- CRLDISTPOINTURI           = URI du Point de distribution des CRL
+CRLDISTPOINTURI           = URI du Point de distribution des LCR
  
- CRLNUMBER                 = Utiliser le numéro de CRL
+ CRLNUMBER                 = Utiliser le numéro de LCR
  
- CRLNUMBERCRITICAL         = Définir numéro de CRL comme critique
+ CRLNUMBERCRITICAL         = Définir numéro de LCR comme critique
  
- CRLPERIOD                 = Période de validité de la CRL
+ CRLPERIOD                 = Période de validité de la LCR
  
- CRLPUBLISHERS             = Publication de CRL
+ CRLPUBLISHERS             = Publication de LCR
  
- CRLSPECIFICDATA           = Données spécifique de CRL
+ CRLSPECIFICDATA           = Données spécifique de LCR
  
  CURRENTCAS                = Autorité de certification actuelle
  
@@ -504,17 +536,17 @@
  
  EDITCA                    = Editer AC
  
- EDITCAS                   = Editer/créer Autorité de certification
+ EDITCAS                   = Editer/créer AC
  
  EDITCERTIFICATEPROFILE    = Editer un profil de certificat
  
- EDITCERTIFICATEPROFILES   = Editer des profils de certificat
+ EDITCERTIFICATEPROFILES   = Profil de certificat
  
  EDITCERTPROF              = Editer un profil de certificat
  
  EDITPUBLISHER             = Editer un service de publication
  
- EDITPUBLISHERS            = Editer les services de publication 
+ EDITPUBLISHERS            = Services de publication 
  
  EMAILPROTECTION           = Protection de courrier électronique
  
@@ -534,7 +566,9 @@
  
  FINISHUSER                = Utilisateur Final
  
- GETCRL                    = récupérer CRL
+ GETCRL                    = récupérer LCR
+ 
+ HARDCATOKENPROPERTIES     = Propriétés du Token matériel de l'AC
  
  HOSTNAME                  = Nom d'hôte
  
@@ -542,67 +576,83 @@
  
  INVALIDPORTNUMBER         = Numéro de port invalide
  
- IPSECENDSYSTEM            = Système IPsec
+INSERTEDAFTERCN           = Texte apposé après le premier champ du CN
+ 
+IPSECENDSYSTEM            = Système IPsec
   
- IPSECTUNNEL               = Tunnel IPSec
+IPSECTUNNEL               = Tunnel IPSec
+ 
+IPSECUSER                 = Utilisateur IPSec
+ 
+INVALIDSUBJECTDN          = La création de l'AC a échouée, DN du sujet du invalide ou le nom alternatif du sujet
+ 
+KEYSIZE                   = Taille de clef
  
- IPSECUSER                 = Utilisateur IPSec
+KEYUSAGECRITICAL          = Key Usage à critique
  
- INVALIDSUBJECTDN          = La création de l'AC a échouée, DN du sujet du invalide ou le nom alternatif du sujet
+LATESTCRL                 = Dernière LCR
  
- KEYSIZE                   = Taille de clef
+LDAPPUBLISHER             = LDAP V3 
  
- KEYUSAGECRITICAL          = Key Usage à critique
+LDAPSETTINGS              = Paramètres LDAP
  
- LATESTCRL                 = Dernière CRL
+LEAVEBLANKTOUSEDEFAULT    = Laisser identifiant de politique vide pour utiliser la valeur par défaut du profil de certificat.
  
- LDAPPUBLISHER             = LDAP V3 
+LOGINDN                   = Identifiant (sous forme de DN)
  
- LDAPSETTINGS              = Paramètres LDAP
+LOGINPWD                  = Mot de passe
  
- LEAVEBLANKTOUSEDEFAULT    = Laisser identifiant de politique vide pour utiliser la valeur par défaut du profil de certificat.
+MAKEOFFLINE               = Mettre hors ligne
+
+MAKEOFFLINESUCCESSFUL     = AC mis hors ligne avec succès 
+ 
+MAKEREQUEST               = Faire une requête de certificat
  
- LOGINDN                   = Identifiant (sous forme de DN)
+MAKEREQUESTHELP           = Chemin de certification de l'AC (format PEM)
  
- LOGINPWD                  = Mot de passe
+MSTEMPLATE                = Valeur de la template Microsoft
+
+MUSTENTERAUTHCODE         = Vous devez saisir un code d'authentification
  
- MAKEREQUEST               = Faire une requête de certificat
+MODIFYEXISTINGUSERS       = Modifier un utilisateur existant
  
- MAKEREQUESTHELP           = Chemin de certification de l'AC (format PEM)
+MUSTSELECTATLEASTONEFIELD = Vous devez sélectionner au moins un champ du DN égal au DN du LDAP
  
- MODIFYEXISTINGUSERS       = Modifier un utilisateur existant
+NAME                      = Nom
  
- MUSTSELECTATLEASTONEFIELD = Vous devez sélectionner au moins un champ du DN égal au DN du LDAP
+NOCRLHAVEBEENGENERATED    = La CRL/LCR n'a pas été générée
+
+NOPUBLISHERSDEFINED       = Aucun service de publication n'est défini pour ce certificat.
  
- NAME                      = Nom
+NOTAUTHORIZEDTOVIEWCA     = Vous n'êtes pas autorisé à voir l'AC spécifiée
  
- NOCRLHAVEBEENGENERATED    = La CRL/LCR n'a pas été générée
+NUMBER                    = Nombre émis 
  
- NOTAUTHORIZEDTOVIEWCA     = Vous n'êtes pas autorisé à voir l'AC spécifiée
+OCSPCERTIFICATERENEWED    = Certificat OCSP renouvelé avec succès
  
- NUMBER                    = Nombre émis 
+OCSPSERVICE               = Service OCSP
  
- OCSPCERTIFICATERENEWED    = Certificat OCSP renouvelé avec succès
+OCSPSIGNER                = répondeur OCSP
  
- OCSPSERVICE               = Service OCSP
+OCSPSERVICELOCATOR        = Utiliser le service OCSP
  
- OCSPSIGNER                = répondeur OCSP
+OCSPSERVICELOCATORURI     = URL du service OCSP
  
- OCSPSERVICELOCATOR        = Utiliser le service OCSP
+OFFLINE                   = Hors ligne
  
- OCSPSERVICELOCATORURI     = URL du service OCSP
+ONEAVAILABLEBITLENGTH     = Au moins un des bits disponible doit être sélectionné
  
- ONEAVAILABLEBITLENGTH     = Au moins un des bits disponible doit être sélectionné
+ONLYCHARACTERSINCRLDIST   = Seuls les caractères, nombres, underscores et espaces sont autorisés dans l'URI du Point de distribution des LCR
  
- ONLYCHARACTERSINCRLDIST   = Seuls les caractères, nombres, underscores et espaces sont autorisés dans l'URI du Point de distribution des CRL
+ONLYDECNUMBERSINCRLPERIOD = Seuls les nombres décimaux sont autorisés dans le champ période de la LCR
  
- ONLYDECNUMBERSINCRLPERIOD = Seuls les nombres décimaux sont autorisés dans le champ période de la CRL
+ONLYDECNUMBERSINVALIDITY  = Seuls les nombres décimaux sont autorisés dans le champ validité
  
- ONLYDECNUMBERSINVALIDITY  = Seuls les nombres décimaux sont autorisés dans le champ validité
+ONLYTHEPUBLICKEY          = Seule la clef publique est utilisée dans la requête de certificat
  
- ONLYTHEPUBLICKEY          = Seule la clef publique est utilisée dans la requête de certificat
+ONLYVALUE                 = (Seulement la valeur pas la template actuelle)
  
- OTHERDATA                 = Autres données
+OTHERDATA                 = Autres données
  
  POLICYID                  = Identifiant (OID) de politique de certification
  
@@ -622,6 +672,8 @@
  
  PUBLISHERTYPE             = Type de service de publication
  
+ REPUBLISH                 = Republier
+ 
  REPUBLISHCA               = Republier le certificat d'AC
  
  REASON                    = Raison
@@ -656,13 +708,13 @@
  
  SOFT                      = Logiciel
  
- SUBCA                     = AC subordonnées
+SUBCA                     = AC subordonnée
  
  SUBALTNAME                = Nom alternatif pour le certificat (Subject Alternative Name)
  
  SUBJECTALTNAME            = Utiliser un nom alternatif pour le certificat (Subject Alternative Name)
  
- SUBJECTALTNAMECRITICAL    = Le nom alternatif à Critique
+SUBJECTALTNAMECRITICAL    = Le nom alternatif à Critique
  
  SUBJECTKEYID              = Utiliser Subject Key ID (Identifiant de la clef publique du sujet) 
  
@@ -678,6 +730,8 @@
  
  USEBASICCONSTRAINTS       = Utiliser Basic Constraints (Contrainte de base)
  
+ USECNPOSTFIX              = Utiliser CN Postfix
+ 
  USEDINCARENEWAL           = Utiliser quand l'AC est renouvelée 
  
  USEEXTENDEDKEYUSAGE       = Utiliser Extended Key Usage (Extension des fonctions de la clef)
@@ -686,9 +740,11 @@
  
  USEKEYUSAGE               = Utiliser Key Usage (fonctions de la clef)
  
- USERACCOUNTCONTROL        = Contrôle du compte utilisateur 
+USERACCOUNTCONTROL        = Contrôle du compte utilisateur 
  
- USERCERTIFICATEATTR       = Certificat d'AC 
+ USERCERTIFICATEATTR       = Attribut du certificat utilisateur
+ 
+ USEMSTEMPLATE             = Utiliser un gabarit MS 
  
  USERDESCRIPTION           = Description utilisateur
  
@@ -726,9 +782,9 @@
  
  DEFAULTLANGUAGETOUSE      = Le langage à utiliser dans l'interface 
  
- EJBCADEFAULTADMINPREF     = Préférence de l'administrateur @EJBCA@ par défaut. 
+ EJBCADEFAULTADMINPREF     = Préférence de l'administrateur EJBCA par défaut. 
  
- EJBCAADMINPREFERENCES     = Préférences de l'administrateur @EJBCA@
+ EJBCAADMINPREFERENCES     = Préférences de l'administrateur EJBCA
  
  FORADMIN                  = Pour l'administrateur:
  
@@ -736,7 +792,7 @@
  
  NUMBEROFRECORDSPERPAGE    = Nombre d'enregistrement par page. 
  
- PREFEREDLANGUAGE          = Langage utilisé pour @EJBCA@
+ PREFEREDLANGUAGE          = Langage utilisé pour EJBCA
  
  SECONDARYLANGUAGE         = Langage secondaire
  
@@ -762,6 +818,8 @@
  
  ALIASFIELDMUSTBEFILLED    = L'émetteur doit avoir une valeur d'Alias. 
  
+ AREYOUSUREKEYRECTOKEN     = Etes vous sur de vouloir recouvrir la clef de chiffrement associée avec ce token ?
+ 
  AVAILABLEHARDTOKENPROFILES= Profil de Token matériel disponible
  
  ATLEASTONETOKENPROFILE    = Au moins un profil de token matériel disponible doit être sélectionné 
@@ -826,6 +884,8 @@
  
  GENERALCARDPRINTER        = Impression de carte
  
+ GENERALRECEIPT            = Reçu Général 
+ 
  GENERALSETTINGS           = Paramètres généraux
  
  INITIALAUTHENCPIN         = PIN initale Auth/Chiffrement
@@ -856,6 +916,8 @@
  
  HARDTOKENTYPE             = Type de Token matériel
  
+ MINIMUMOF                 = Minimum de
+ 
  MINKEYLENGTH              = Longueur de clef minimum
  
  NOCOPIESHAVEBEENMADE      = Aucun copie n'a été fabriqué
@@ -864,8 +926,12 @@
  
  NUMBEROFCOPIES            = Nombre de Tokens avec le même Enc Key
  
+ NUMOFADRESSLABELCOPIES    = Nombre d'étiquettes d'adresse
+ 
  NUMOFPINENVCOPIES         = Nombre de PIN par copie d'enveloppe
  
+ NUMOFRECEIPTCOPIES        = Numbre de reçu
+ 
  ONECURRENTISSUERMUSTBESEL = Un émetteur actif doit être sélectionner pour renommer ou utiliser une template.
  
  ONLYCHARACTERSINALIAS     = Seules les caractères et les nombres sont autorisés dans le champ Alias.
@@ -882,7 +948,13 @@
  
  PINENVELOPESETTINGS       = Caractéristique du PIN
  
- PINTYPE                   = Type de PIN
+ PINENVELOPESETTINGS       = paramètre de l'enveloppe du PIN
+ 
+PINTYPE                   = Type de PIN
+ 
+RECEIPTSETTINGS           = paramètres du reçu
+
+RECEIPTTYPE               = Type de reçu
  
  RSA1024BIT                = RSA 1024 Bit
  
@@ -918,15 +990,23 @@
  
  UNKNOWNHARDTOKENTYPE      = Type de token matériel inconnu
  
- UPLOADENVELOPETEMP        = Télécharger le PIN d'enveloppe de template
+UPLOADADRESSLABELTEMP     = Ajouter gabarit d'étiquette d'adresse
  
- UPLOADTEMPLATE            = Télécharger Template
+UPLOADENVELOPETEMP        = Ajouter le PIN d'enveloppe de template
  
- UPLOADVISUALTEMP          = Télécharger Template d'affichage
+UPLOADTEMPLATE            = Ajouter Gabarit
  
- USEIDENTICALPINS          = Utiliser identification par PINs
+UPLOADRECEIPTTEMP         = Ajouter gabarit de reçu
  
- YOUMUSTSPECIFYPARAMETER   = Vous devez indiquer un paramètre soit un 'nom ' ou 'SN du Token' et un 'nom'
+UPLOADVISUALTEMP          = Ajouter un gabarit d'affichage
+ 
+USEIDENTICALPINS          = Utiliser identification par PINs
+
+USEUSERDEFINED            = Utiliser un utilisateur défini
+
+UTF8                      = UTF8
+ 
+YOUMUSTSPECIFYPARAMETER   = Vous devez indiquer un paramètre soit un 'nom ' ou 'SN du Token' et un 'nom'
  
  
  # Mostly Log Module
@@ -985,7 +1065,7 @@
  
  EVENT_ERROR_CREATECERTIFICATE                 = Erreur durant la création du Certificat
  
- EVENT_ERROR_CREATECRL                         = Erreur durant la création de la CRL
+ EVENT_ERROR_CREATECRL                         = Erreur durant la création de la LCR
  
  EVENT_ERROR_DATABASE                          = Erreur dans la base de données
  
@@ -997,7 +1077,7 @@
  
  EVENT_ERROR_EDITSYSTEMCONFIGURATION           = Erreur durant l'édition de la configuration Système
  
- EVENT_ERROR_GETLASTCRL                        = Erreur durant la récupération de la dernière CRL
+ EVENT_ERROR_GETLASTCRL                        = Erreur durant la récupération de la dernière LCR
  
  EVENT_ERROR_HARDTOKENCERTIFICATEMAP           = Erreur d'édition du certificat du Token matériel
  
@@ -1029,7 +1109,7 @@
  
  EVENT_ERROR_STORECERTIFICATE                  = Erreur de stockage de certificat
  
- EVENT_ERROR_STORECRL                          = Erreur de stockage de la CRL
+ EVENT_ERROR_STORECRL                          = Erreur de stockage de la LCR
  
  EVENT_ERROR_TOKENGENERATED                    = Erreur durant la génération du Token
  
@@ -1059,7 +1139,7 @@
  
  EVENT_INFO_CREATECERTIFICATE                  = Certificat Créé
  
- EVENT_INFO_CREATECRL                          = CRL Créée
+ EVENT_INFO_CREATECRL                          = LCR Créée
  
  EVENT_INFO_DATABASE                           = Information sur la base de données 
  
@@ -1071,7 +1151,7 @@
  
  EVENT_INFO_EDITSYSTEMCONFIGURATION            = Editer configuration système
  
- EVENT_INFO_GETLASTCRL                         = Dernière CRL Récupérée
+ EVENT_INFO_GETLASTCRL                         = Dernière LCR Récupérée
  
  EVENT_INFO_HARDTOKENCERTIFICATEMAP            = Certificat du Token matériel édité
  
@@ -1101,7 +1181,7 @@
  
  EVENT_INFO_STORECERTIFICATE                   = Certificat Stocké
  
- EVENT_INFO_STORECRL                           = CRL Stockée
+ EVENT_INFO_STORECRL                           = LCR Stockée
  
  EVENT_INFO_TOKENGENERATED                     = Token Généré
  
@@ -1187,7 +1267,7 @@
  
  ADDEDSUCCESSFULLY         = Ajout avec succès.
  
- ADDENDENTITY              = Demande de certificat
+ ADDENDENTITY              = Requête de certificat
  
  ADDPROFILE                = Ajouter Profil
  
@@ -1267,13 +1347,13 @@
  
  CREATED                   = Créée
  
- CRLSIGN                   = signature de CRL
+ CRLSIGN                   = signature de LCR (cRLSign)
  
  CURRENTENDENTITYPROFILES  = Profil d'Entité d'enrôlement actuel
     
- DATAENCIPHERMENT          = Chiffrement de données 
+ DATAENCIPHERMENT          = Chiffrement de données (dataEncipherment)
  
- DECIPHERONLY              = déchiffrement de données seulement
+ DECIPHERONLY              = déchiffrement seulement (decipherOnly)
  
  DEFAULTCA                 = AC par défaut 
  
@@ -1287,7 +1367,7 @@
  
  DELETESELECTED            = Effacer sélection
  
- DIGITALSIGNATURE          = Signature numérique
+ DIGITALSIGNATURE          = Signature numérique (digitalsignature)
  
  DIRECTORYNAME             = Nom d'annuaire
  
@@ -1299,9 +1379,9 @@
  
  EDIPARTNAME               = Nom de l'EDI
  
- EDITPROFILE               = Définir le profil d'un certificat
+ EDITPROFILE               = Définir un profil d'entité
  
- EDITPROFILES              = Editer le profil de l'Entité d'enrôlement
+ EDITPROFILES              = Profil de l'Entité
  
  EDITENDENTITY             = Editer_Entité_Enrôlement
  
@@ -1315,7 +1395,7 @@
  
  EMPTY                     = Vide
  
- ENCIPHERONLY              = Chiffrement seulement
+ ENCIPHERONLY              = Chiffrement seulement (encipherOnly)
  
  ENDENTITYPROFILE          = Profil de l'Entité d'enrôlement
  
@@ -1329,6 +1409,8 @@
  
  GIVENNAME2                = Nom, Nom
  
+ GUID                      = Identifiant unique global
+ 
  FIND                      = Recherche
  
  FINDENDENTITYWITHUSERNAME = Recherche une Entité d'enrôlement par son nom
@@ -1347,13 +1429,13 @@
  
  ISSUERDN                  = DN de l'émetteur
  
- KEYAGREEMENT              = validation de clef (Key agreement)
+ KEYAGREEMENT              = clef d'échange (Key agreement)
  
  KEYCERTSIGN               = Signature de certificat (Key certificate sign)
  
  KEYCOMPROMISE             = clef compromise (Key compromise)
  
- KEYENCIPHERMENT           = clef de chiffrement
+ KEYENCIPHERMENT           = clef de chiffrement (keyEncipherment)
  
  KEYRECOVERABLE            = clef de recouvrement
  
@@ -1421,7 +1503,7 @@
  
  NOKEYUSAGESPECIFIED       = Pas de "key usage" spécifié 
  
- NONREPUDIATION            = Non répudiation
+ NONREPUDIATION            = Non repudiation (nonRepudiation)
  
  NOCERTIFICATEPROFILEDEFINED    = Pas de profil de certificat défini pour cette Entité d'enrôlement.
  
@@ -1613,6 +1695,8 @@
  
  UPN                       = UPN, Nom Principale
  
+ UPNDOMAIN                 = UPN (partie du domaine seulement)
+ 
  UNIFORMRESOURCEID         = URI, Uniform Resource ID
  
  UNKNOWNREASON             = raison inconnue
@@ -1624,6 +1708,10 @@
  USEINBATCH                = Batch generation
  
  USEONLYDOMAIN             = (utiliser seulement la partie du domaine de l'adresse, sans '@')  
+ 
+ UNSTRUCTUREDADDRESS       = Adresse non conforme (IP)
+
+ UNSTRUCTUREDNAME          = Nom non conforme (FQDN)
  
  ENDENTITYALREADYEXISTS    = Entité d'enrôlement existe déjà, choisir un autre nom 
  
diff -urN ../../31/ejbca/src/adminweb/ra/addendentity.jsp ./src/adminweb/ra/addendentity.jsp
--- ../../31/ejbca/src/adminweb/ra/addendentity.jsp	Tue May 24 11:32:09 2005
+++ ./src/adminweb/ra/addendentity.jsp	Fri Aug  5 11:08:09 2005
@@ -898,7 +898,7 @@
            <select name="<%= SELECT_USERNAME %>" size="1" tabindex="<%=tabindex++%>">
                <% if( options != null){
                     for(int i=0;i < options.length;i++){ %>
-             <option value='<%=options[i].trim()%>' <% if(lastselectedusername.equals(options[i])) out.write(" selected "); %>> 
+             <option value="<%=options[i].trim()%>" <% if(lastselectedusername.equals(options[i])) out.write(" selected "); %>> 
                <%=options[i].trim()%>
              </option>                
                <%   }
@@ -906,7 +906,7 @@
                 %>
            </select>
            <% }else{ %> 
-             <input type="text" name="<%= TEXTFIELD_USERNAME %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value='<%= profile.getValue(EndEntityProfile.USERNAME,0) %>'>
+             <input type="text" name="<%= TEXTFIELD_USERNAME %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value="<%= profile.getValue(EndEntityProfile.USERNAME,0) %>">
            <% } %>
 
         </td>
@@ -1023,7 +1023,7 @@
            <select name="<%= SELECT_SUBJECTDN + i %>" size="1" tabindex="<%=tabindex++%>">
                <% if( options != null){
                     for(int j=0;j < options.length;j++){ %>
-             <option value='<%=options[j].trim()%>' <% if( lastselectedsubjectdns != null) 
+             <option value="<%=options[j].trim()%>" <% if( lastselectedsubjectdns != null) 
                                                          if(lastselectedsubjectdns[i].equals(options[j])) out.write(" selected "); %>> 
                 <%=options[j].trim()%>
              </option>                
@@ -1032,7 +1032,7 @@
                 %>
            </select>
            <% }else{ %> 
-             <input type="text" name="<%= TEXTFIELD_SUBJECTDN + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value='<%= profile.getValue(fielddata[EndEntityProfile.FIELDTYPE],fielddata[EndEntityProfile.NUMBER]) %>'>
+             <input type="text" name="<%= TEXTFIELD_SUBJECTDN + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value="<%= profile.getValue(fielddata[EndEntityProfile.FIELDTYPE],fielddata[EndEntityProfile.NUMBER]) %>">
            <% }
             }
             else{ %>
@@ -1077,7 +1077,7 @@
            <select name="<%= SELECT_SUBJECTALTNAME + i %>" size="1" tabindex="<%=tabindex++%>">
                <% if( options != null){
                     for(int j=0;j < options.length;j++){ %>
-             <option value='<%=options[j].trim()%>' <% if( lastselectedsubjectaltnames != null) 
+             <option value="<%=options[j].trim()%>" <% if( lastselectedsubjectaltnames != null) 
                                                          if(lastselectedsubjectaltnames[i].equals(options[j])) out.write(" selected "); %>> 
                 <%=options[j].trim()%>
              </option>                
@@ -1089,7 +1089,7 @@
                 if(fielddata[EndEntityProfile.FIELDTYPE] == EndEntityProfile.UPN){ %>
                    <input type="text" name="<%= TEXTFIELD_UPNNAME+i %>" size="20" maxlength="255" tabindex="<%=tabindex++%>" >@
                 <% } %> 
-             <input type="text" name="<%= TEXTFIELD_SUBJECTALTNAME + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value='<%= profile.getValue(fielddata[EndEntityProfile.FIELDTYPE],fielddata[EndEntityProfile.NUMBER]) %>'>
+             <input type="text" name="<%= TEXTFIELD_SUBJECTALTNAME + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value="<%= profile.getValue(fielddata[EndEntityProfile.FIELDTYPE],fielddata[EndEntityProfile.NUMBER]) %>">
            <% }
             }
             else{ %>
diff -urN ../../31/ejbca/src/adminweb/ra/editendentity.jsp ./src/adminweb/ra/editendentity.jsp
--- ../../31/ejbca/src/adminweb/ra/editendentity.jsp	Mon May 16 06:01:46 2005
+++ ./src/adminweb/ra/editendentity.jsp	Fri Aug  5 11:08:09 2005
@@ -897,7 +897,7 @@
            <select name="<%= SELECT_EMAILDOMAIN %>" size="1" tabindex="<%=tabindex++%>">
                <% if( options != null){
                     for(int i=0;i < options.length;i++){ %>
-             <option value='<%=options[i].trim()%>' <% if(emaildomain.equals(options[i])) out.write(" selected "); %>>
+             <option value="<%=options[i].trim()%>" <% if(emaildomain.equals(options[i])) out.write(" selected "); %>>
                 <%=options[i].trim()%>  
              </option>                
                <%   }
@@ -905,7 +905,7 @@
                 %>
            </select>
            <% }else{ %> 
-             <input type="text" name="<%= TEXTFIELD_EMAILDOMAIN %>" size="20" maxlength="255" tabindex="<%=tabindex++%>"  value='<%=emaildomain%>'>
+             <input type="text" name="<%= TEXTFIELD_EMAILDOMAIN %>" size="20" maxlength="255" tabindex="<%=tabindex++%>"  value="<%=emaildomain%>">
            <% } %>
         </td>
 	<td><input type="checkbox" name="<%= CHECKBOX_REQUIRED_EMAIL %>" value="<%= CHECKBOX_VALUE %>"  disabled="true" <% if(profile.isRequired(EndEntityProfile.EMAIL,0)) out.write(" CHECKED "); %>></td>
@@ -930,7 +930,7 @@
            <select name="<%= SELECT_SUBJECTDN + i %>" size="1" tabindex="<%=tabindex++%>">
                <% if( options != null){
                     for(int j=0;j < options.length;j++){ %>
-             <option value='<%=options[j].trim()%>' <% if(userdata.getSubjectDNField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]).equals(options[j].trim())) out.write(" selected "); %>> 
+             <option value="<%=options[j].trim()%>" <% if(userdata.getSubjectDNField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]).equals(options[j].trim())) out.write(" selected "); %>> 
                 <%=options[j].trim()%>
              </option>                
                <%   }
@@ -938,7 +938,7 @@
                 %>
            </select>
            <% }else{ %> 
-             <input type="text" name="<%= TEXTFIELD_SUBJECTDN + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value='<%= userdata.getSubjectDNField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]) %>'>
+             <input type="text" name="<%= TEXTFIELD_SUBJECTDN + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value="<%= userdata.getSubjectDNField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]) %>">
            <% }
             }
             else{ %>
@@ -986,7 +986,7 @@
                 <select name="<%= SELECT_SUBJECTALTNAME + i %>" size="1" tabindex="<%=tabindex++%>">
                   <% if( options != null){
                       for(int j=0;j < options.length;j++){ %>
-                  <option value='<%=options[j].trim()%>' <%  if(upndomain.equals(options[j].trim())) out.write(" selected "); %>> 
+                  <option value="<%=options[j].trim()%>" <%  if(upndomain.equals(options[j].trim())) out.write(" selected "); %>> 
                     <%=options[j].trim()%>
                   </option>                
                <%   }
@@ -994,7 +994,7 @@
                 %>
                 </select>
              <% }else{ %> 
-             <input type="text" name="<%= TEXTFIELD_SUBJECTALTNAME + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value='<%= upndomain %>'>
+             <input type="text" name="<%= TEXTFIELD_SUBJECTALTNAME + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value="<%= upndomain %>">
              <% }
               }else{    
                if(!profile.isModifyable(fielddata[EndEntityProfile.FIELDTYPE],fielddata[EndEntityProfile.NUMBER])){ 
@@ -1002,7 +1002,7 @@
            <select name="<%= SELECT_SUBJECTALTNAME + i %>" size="1" tabindex="<%=tabindex++%>">
                <% if( options != null){
                     for(int j=0;j < options.length;j++){ %>
-             <option value='<%=options[j].trim()%>' <%  if(userdata.getSubjectAltNameField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]).equals(options[j].trim())) out.write(" selected "); %>> 
+             <option value="<%=options[j].trim()%>" <%  if(userdata.getSubjectAltNameField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]).equals(options[j].trim())) out.write(" selected "); %>> 
                 <%=options[j].trim()%>
              </option>                
                <%   }
@@ -1010,7 +1010,7 @@
                 %>
            </select>
            <% }else{ %>
-             <input type="text" name="<%= TEXTFIELD_SUBJECTALTNAME + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value='<%= userdata.getSubjectAltNameField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]) %>'>
+             <input type="text" name="<%= TEXTFIELD_SUBJECTALTNAME + i %>" size="40" maxlength="255" tabindex="<%=tabindex++%>" value="<%= userdata.getSubjectAltNameField(profile.profileFieldIdToUserFieldIdMapper(fielddata[EndEntityProfile.FIELDTYPE]),fielddata[EndEntityProfile.NUMBER]) %>">
            <% }
             }
             }else{ %>
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/SecConst.java ./src/java/se/anatom/ejbca/SecConst.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/SecConst.java	Wed Aug  4 16:06:08 2004
+++ ./src/java/se/anatom/ejbca/SecConst.java	Sat Jul 23 21:53:14 2005
@@ -25,7 +25,7 @@
  * types. Constants for Token Types Token type is constructed of integer constants since only one
  * token type can be generated.
  *
- * @version $Id: SecConst.java,v 1.23 2004/08/04 14:06:08 sbailliez Exp $
+ * @version $Id: SecConst.java,v 1.23.2.2 2005/07/23 19:53:14 anatom Exp $
  */
 public class SecConst extends Object {
     // User types
@@ -46,9 +46,6 @@
     public static final int USER_SENDNOTIFICATION = 0x100;
 
 
-    /** All bits used by Type. */
-    public static final int USER_MASK = 0xff;
-
     // Token types.
 
     /** Indicates that a browser generated token should be used. */
@@ -104,6 +101,11 @@
     public static final int FIXED_CERTIFICATEPROFILE_BOUNDRY = 1000;
     public static final int PROFILE_NO_PROFILE = 0;
 
+    
+    /**
+     * Constants used in the RSASignSessionBean indicating the userdata defined CA should be used.
+     */
+    public static final int CAID_USEUSERDEFINED = 0;
 
     /** Constant used to determine the size of the result from SQL select queries */
     public static final int MAXIMUM_QUERY_ROWCOUNT = 100; 
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaAdminCommandFactory.java ./src/java/se/anatom/ejbca/admin/CaAdminCommandFactory.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaAdminCommandFactory.java	Sat Jun 11 14:49:57 2005
+++ ./src/java/se/anatom/ejbca/admin/CaAdminCommandFactory.java	Tue Jun 28 15:03:26 2005
@@ -16,7 +16,7 @@
 /**
  * Factory for CA Admin Commands.
  *
- * @version $Id: CaAdminCommandFactory.java,v 1.11 2005/06/11 12:49:57 anatom Exp $
+ * @version $Id: CaAdminCommandFactory.java,v 1.11.2.1 2005/06/28 13:03:26 herrvendil Exp $
  */
 public class CaAdminCommandFactory {
     /**
@@ -37,9 +37,7 @@
             return null;
         }
 
-        if (args[0].equals("makeroot")) {
-            return new CaMakeRootCommand(args);
-        } else if (args[0].equals("getrootcert")) {
+        if (args[0].equals("getrootcert")) {
             return new CaGetRootCertCommand(args);
         } else if (args[0].equals("listexpired")) {
             return new CaListExpiredCommand(args);
@@ -49,20 +47,10 @@
             return new CaListCAsCommand(args);
         } else if (args[0].equals("init")) {
             return new CaInitCommand(args);
-        } else if (args[0].equals("makereq")) {
-            return new CaMakeReqCommand(args);
-        } else if (args[0].equals("recrep")) {
-            return new CaRecRepCommand(args);
-        } else if (args[0].equals("processreq")) {
-            return new CaProcessReqCommand(args);
         } else if (args[0].equals("createcrl")) {
             return new CaCreateCrlCommand(args);
         } else if (args[0].equals("getcrl")) {
             return new CaGetCrlCommand(args);
-        } else if (args[0].equals("rolloverroot")) {
-            return new CaRolloverRootCommand(args);
-        } else if (args[0].equals("rolloversub")) {
-            return new CaRolloverSubCommand(args);
         } else if (args[0].equals("exportprofiles")) {
             return new CaExportProfilesCommand(args);
         } else if (args[0].equals("importprofiles")) {
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaInfoCommand.java ./src/java/se/anatom/ejbca/admin/CaInfoCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaInfoCommand.java	Mon May  2 19:05:58 2005
+++ ./src/java/se/anatom/ejbca/admin/CaInfoCommand.java	Tue Jun 28 15:02:38 2005
@@ -17,13 +17,14 @@
 import java.security.interfaces.RSAPublicKey;
 import java.util.ArrayList;
 
+import se.anatom.ejbca.ca.caadmin.CAInfo;
 import se.anatom.ejbca.util.CertTools;
 
 
 /**
  * Gets and prints info about the CA.
  *
- * @version $Id: CaInfoCommand.java,v 1.11 2005/05/02 17:05:58 anatom Exp $
+ * @version $Id: CaInfoCommand.java,v 1.11.2.1 2005/06/28 13:02:38 herrvendil Exp $
  */
 public class CaInfoCommand extends BaseCaAdminCommand {
     /**
@@ -49,8 +50,14 @@
         try {            
             String caname = args[1];
             ArrayList chain = new ArrayList(getCertChain(caname));
-
-            getOutputStream().println("CA name: "+caname);
+            CAInfo cainfo = getCAInfo(caname);
+                                    
+            getOutputStream().println("CA name: " + caname);
+            getOutputStream().println("CA ID: " + cainfo.getCAId());
+            getOutputStream().println("CA CRL Period: " + cainfo.getCRLPeriod());
+            getOutputStream().println("CA Description: " + cainfo.getDescription());
+            getOutputStream().println("\n");
+            
             if (chain.size() < 2)
               getOutputStream().println("This is a Root CA.");
             else
@@ -60,6 +67,7 @@
             if (chain.size() > 0) {
                 X509Certificate rootcert = (X509Certificate)chain.get(chain.size()-1);
                 getOutputStream().println("Root CA DN: "+CertTools.getSubjectDN(rootcert));
+                getOutputStream().println("Root CA id: "+CertTools.getSubjectDN(rootcert));
                 getOutputStream().println("Certificate valid from: "+rootcert.getNotBefore().toString());
                 getOutputStream().println("Certificate valid to: "+rootcert.getNotAfter().toString());
                 getOutputStream().println("Root CA keysize: "+((RSAPublicKey)rootcert.getPublicKey()).getModulus().bitLength());            
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaMakeReqCommand.java ./src/java/se/anatom/ejbca/admin/CaMakeReqCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaMakeReqCommand.java	Wed Oct 13 09:14:46 2004
+++ ./src/java/se/anatom/ejbca/admin/CaMakeReqCommand.java	Thu Jan  1 01:00:00 1970
@@ -1,102 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
- 
-package se.anatom.ejbca.admin;
-
-import java.io.*;
-import java.security.KeyPair;
-import java.security.KeyStore;
-import java.security.cert.X509Certificate;
-import java.util.Collection;
-
-import se.anatom.ejbca.util.CertTools;
-import se.anatom.ejbca.util.KeyTools;
-
-
-/**
- * Generates keys and creates a keystore (PKCS12) to be used by the CA.
- *
- * @version $Id: CaMakeReqCommand.java,v 1.11 2004/10/13 07:14:46 anatom Exp $
- */
-public class CaMakeReqCommand extends BaseCaAdminCommand {
-    /**
-     * Creates a new instance of CaMakeReqCommand
-     *
-     * @param args command line arguments
-     */
-    public CaMakeReqCommand(String[] args) {
-        super(args);
-    }
-
-    /**
-     * Runs the command
-     *
-     * @throws IllegalAdminCommandException Error in command args
-     * @throws ErrorAdminCommandException Error running command
-     */
-    public void execute() throws IllegalAdminCommandException, ErrorAdminCommandException {
-
-        if (args.length < 7) {
-            String msg = "Usage: CA makereq <DN> <keysize> <rootca-certificate> <request-file> <keystore-file> <storepassword>";
-            msg += "\nGenerates a certification request for a subCA for sending to a RootCA.";
-            msg += "\nrootca-certificates is a file with one or more PEM-certificates, ordered so the RootCA is last.";
-            throw new IllegalAdminCommandException(msg);
-        }
-
-        String dn = args[1];
-        int keysize = Integer.parseInt(args[2]);
-        String rootfile = args[3];
-        String reqfile = args[4];
-        String ksfile = args[5];
-        String storepwd = args[6];
-
-
-        
-        getOutputStream().println("Generating cert request (and keystore):");
-        getOutputStream().println("DN: " + dn);
-        getOutputStream().println("Keysize: " + keysize);
-        getOutputStream().println("RootCA cert file: " + rootfile);
-        getOutputStream().println("Storing CertificationRequest in: " + reqfile);
-        getOutputStream().println("Storing KeyStore in: " + ksfile);
-        getOutputStream().println("Protected with storepassword: " + storepwd);
-
-        try {
-            // Read in RootCA certificate
-            Collection rootcerts = CertTools.getCertsFromPEM(new FileInputStream(rootfile));
-
-            // Generate keys
-            getOutputStream().println("Generating keys, please wait...");
-
-            KeyPair rsaKeys = KeyTools.genKeys(keysize);
-
-            // Create selfsigned cert...
-            X509Certificate selfcert = CertTools.genSelfCert(dn, 365, null, rsaKeys.getPrivate(), rsaKeys.getPublic(), true);
-
-            // Create certificate request
-            makeCertRequest(dn, rsaKeys, reqfile);
-
-            // Create keyStore
-            KeyStore ks = KeyTools.createP12(privKeyAlias, rsaKeys.getPrivate(), selfcert, rootcerts);
-
-            FileOutputStream os = new FileOutputStream(ksfile);
-            ks.store(os, storepwd.toCharArray());
-            getOutputStream().println("Keystore '"+ksfile+"' generated successfully.");
-         
-        } catch (Exception e) {
-            throw new ErrorAdminCommandException(e);
-        }
-    } // execute
-
-
-    // execute
-}
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaMakeRootCommand.java ./src/java/se/anatom/ejbca/admin/CaMakeRootCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaMakeRootCommand.java	Wed Oct 13 09:14:45 2004
+++ ./src/java/se/anatom/ejbca/admin/CaMakeRootCommand.java	Thu Jan  1 01:00:00 1970
@@ -1,87 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
- 
-package se.anatom.ejbca.admin;
-
-import java.io.*;
-import java.security.KeyPair;
-import java.security.KeyStore;
-import java.security.cert.X509Certificate;
-
-import se.anatom.ejbca.util.CertTools;
-import se.anatom.ejbca.util.KeyTools;
-
-
-/**
- * makeroot CA admin command, generates keys and creates a keystore (PKCS12) to be used by the CA
- *
- * @version $Id: CaMakeRootCommand.java,v 1.11 2004/10/13 07:14:45 anatom Exp $
- */
-public class CaMakeRootCommand extends BaseCaAdminCommand {
-    /**
-     * Creates a new instance of CaMakeRootCommand
-     *
-     * @param args command line arguments
-     */
-    public CaMakeRootCommand(String[] args) {
-        super(args);
-    }
-
-    /**
-     * Runs the command
-     *
-     * @throws IllegalAdminCommandException Error in command args
-     * @throws ErrorAdminCommandException Error running command
-     */
-    public void execute() throws IllegalAdminCommandException, ErrorAdminCommandException {
-        // Generates keys and creates a keystore (PKCS12) to be used by the CA
-        if (args.length < 7) {
-            String msg = "Usage: CA makeroot <DN> <keysize> <validity-days> <policyID> <filename> <storepassword>";
-            msg += "\npolicyId can be 'null' if no Certificate Policy extension should be present, or\nobjectID as '2.5.29.32.0'.";
-            throw new IllegalAdminCommandException(msg);
-        }
-        String dn = args[1];
-        int keysize = Integer.parseInt(args[2]);
-        int validity = Integer.parseInt(args[3]);
-        String policyId = args[4];
-        String filename = args[5];
-        String storepwd = args[6];
-        if (policyId.equals("null"))
-            policyId = null;
-
-        getOutputStream().println("Generating rootCA keystore:");
-        getOutputStream().println("DN: "+dn);
-        getOutputStream().println("Keysize: "+keysize);
-        getOutputStream().println("Validity (days): "+validity);
-        getOutputStream().println("Policy ID: "+policyId);
-        getOutputStream().println("Storing in: "+filename);
-        getOutputStream().println("Protected with storepassword: "+storepwd);
-
-        try {
-            // Generate keys
-            getOutputStream().println("Generating keys, please wait...");
-            KeyPair rsaKeys = KeyTools.genKeys(keysize);
-            X509Certificate rootcert = CertTools.genSelfCert("CN=dummy", 36500, null, rsaKeys.getPrivate(), rsaKeys.getPublic(), true);
-            //X509Certificate rootcert = CertTools.genSelfCert(dn, validity, policyId, rsaKeys.getPrivate(), rsaKeys.getPublic(), true);
-            KeyStore ks = KeyTools.createP12(privKeyAlias, rsaKeys.getPrivate(), rootcert, (X509Certificate)null);
-
-            FileOutputStream os = new FileOutputStream(filename);
-            getOutputStream().println("Storing keystore '"+filename+"'.");
-            ks.store(os, storepwd.toCharArray());
-        } catch (Exception e) {
-            throw new ErrorAdminCommandException(e);
-        }
-        getOutputStream().println("Keystore "+filename+" generated successfully.");         
-    } // exceute
-
-}//CaMakeRootCommand
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaProcessReqCommand.java ./src/java/se/anatom/ejbca/admin/CaProcessReqCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaProcessReqCommand.java	Wed Oct 13 09:14:45 2004
+++ ./src/java/se/anatom/ejbca/admin/CaProcessReqCommand.java	Thu Jan  1 01:00:00 1970
@@ -1,104 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
- 
-package se.anatom.ejbca.admin;
-
-import java.io.*;
-import java.security.cert.X509Certificate;
-
-import javax.naming.Context;
-
-import se.anatom.ejbca.ca.sign.ISignSessionHome;
-import se.anatom.ejbca.ca.sign.ISignSessionRemote;
-import se.anatom.ejbca.protocol.IResponseMessage;
-import se.anatom.ejbca.protocol.PKCS10RequestMessage;
-import se.anatom.ejbca.util.Base64;
-import se.anatom.ejbca.util.CertTools;
-import se.anatom.ejbca.util.FileTools;
-
-
-/**
- * Receive certification request and create certificate to send back.
- *
- * @version $Id: CaProcessReqCommand.java,v 1.12 2004/10/13 07:14:45 anatom Exp $
- */
-public class CaProcessReqCommand extends BaseCaAdminCommand {
-    /**
-     * Creates a new instance of CaProcessReqCommand
-     *
-     * @param args command line arguments
-     */
-    public CaProcessReqCommand(String[] args) {
-        super(args);
-    }
-
-    /**
-     * Runs the command
-     *
-     * @throws IllegalAdminCommandException Error in command args
-     * @throws ErrorAdminCommandException Error running command
-     */
-    public void execute() throws IllegalAdminCommandException, ErrorAdminCommandException {
-        try {
-            if (args.length < 5) {
-                getOutputStream().println(
-                    "Usage: CA processreq <username> <password> <request-file> <outfile>");
-                getOutputStream().println(
-                    "Used to receive certificate requests from subCAs and generate certificates to be sent back.");
-
-                return;
-            }
-
-            String username = args[1];
-            String password = args[2];
-            String reqfile = args[3];
-            String outfile = args[4];
-
-            getOutputStream().println("Processing cert request:");
-            getOutputStream().println("Username: " + username);
-            getOutputStream().println("Password: " + password);
-            getOutputStream().println("Request file: " + reqfile);
-
-            byte[] b64Encoded = FileTools.readFiletoBuffer(reqfile);
-            byte[] buffer;
-
-            try {
-                String beginKey = "-----BEGIN CERTIFICATE REQUEST-----";
-                String endKey = "-----END CERTIFICATE REQUEST-----";
-                buffer = FileTools.getBytesFromPEM(b64Encoded, beginKey, endKey);
-            } catch (IOException e) {
-                String beginKey = "-----BEGIN NEW CERTIFICATE REQUEST-----";
-                String endKey = "-----END NEW CERTIFICATE REQUEST-----";
-                buffer = FileTools.getBytesFromPEM(b64Encoded, beginKey, endKey);
-            }
-
-            Context ctx = getInitialContext();
-            ISignSessionHome home = (ISignSessionHome) javax.rmi.PortableRemoteObject.narrow(ctx.lookup(
-                        "RSASignSession"), ISignSessionHome.class);
-            ISignSessionRemote ss = home.create();
-            PKCS10RequestMessage p10 = new PKCS10RequestMessage(buffer);
-            p10.setUsername(username);
-            p10.setPassword(password);
-            IResponseMessage resp = ss.createCertificate(administrator, p10, Class.forName("se.anatom.ejbca.protocol.X509ResponseMessage"));
-            X509Certificate cert = CertTools.getCertfromByteArray(resp.getResponseMessage());
-            FileOutputStream fos = new FileOutputStream(outfile);
-            fos.write("-----BEGIN CERTIFICATE-----\n".getBytes());
-            fos.write(Base64.encode(cert.getEncoded()));
-            fos.write("\n-----END CERTIFICATE-----\n".getBytes());
-            fos.close();
-            getOutputStream().println("Wrote certificate (PEM-format) to file " + outfile);
-        } catch (Exception e) {
-            throw new ErrorAdminCommandException(e);
-        }
-    } // execute
-}
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaRecRepCommand.java ./src/java/se/anatom/ejbca/admin/CaRecRepCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaRecRepCommand.java	Fri Feb 11 14:12:18 2005
+++ ./src/java/se/anatom/ejbca/admin/CaRecRepCommand.java	Thu Jan  1 01:00:00 1970
@@ -1,118 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
- 
-package se.anatom.ejbca.admin;
-
-import java.io.*;
-import java.security.KeyStore;
-import java.security.PrivateKey;
-import java.security.Signature;
-import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Enumeration;
-
-import se.anatom.ejbca.util.CertTools;
-import se.anatom.ejbca.util.FileTools;
-import se.anatom.ejbca.util.KeyTools;
-
-
-/**
- * Receive certificate reply as result of certificate request.
- *
- * @version $Id: CaRecRepCommand.java,v 1.12 2005/02/11 13:12:18 anatom Exp $
- */
-public class CaRecRepCommand extends BaseCaAdminCommand {
-    /**
-     * Creates a new instance of CaRecRepCommand
-     *
-     * @param args command line arguments
-     */
-    public CaRecRepCommand(String[] args) {
-        super(args);
-    }
-
-    /**
-     * Runs the command
-     *
-     * @throws IllegalAdminCommandException Error in command args
-     * @throws ErrorAdminCommandException Error running command
-     */
-    public void execute() throws IllegalAdminCommandException, ErrorAdminCommandException {
-        getOutputStream().println("TODO");
-        try {
-            if (args.length < 4) {
-                getOutputStream().println("Usage: CA recrep <certificate-file> <keystore-file> <storepassword>");
-                getOutputStream().println("Used to receive certificates which has been produced as result of sending a certificate request to a CA.");
-                return;
-            }
-
-            String certfile = args[1];
-            String ksfile = args[2];
-            String storepwd = args[3];
-
-            getOutputStream().println("Receiving cert reply:");
-            getOutputStream().println("Cert reply file: " + certfile);
-            getOutputStream().println("Storing KeyStore in: " + ksfile);
-            getOutputStream().println("Protected with storepassword: " + storepwd);
-
-            X509Certificate cert = CertTools.getCertfromByteArray(FileTools.readFiletoBuffer(certfile));
-            KeyStore store = KeyStore.getInstance("PKCS12", "BC");
-            FileInputStream fis = new FileInputStream(ksfile);
-            store.load(fis, storepwd.toCharArray());
-            Certificate[] certchain = store.getCertificateChain(privKeyAlias);
-            getOutputStream().println("Loaded certificate chain with length " + certchain.length + " with alias 'privateKey'.");
-            if (certchain.length == 0) {
-                getOutputStream().println("No certificate in chain with alias 'privateKey' in keystore '"+ksfile +"'");
-                getOutputStream().println("Reply NOT received!");
-                return;                
-            }
-            if (!CertTools.isSelfSigned((X509Certificate)certchain[0])) {
-                getOutputStream().println("Certificate in chain with alias 'privateKey' in keystore '"+ksfile +"' is not selfsigned");
-                getOutputStream().println("Reply NOT received!");
-                return;
-            }
-            PrivateKey privKey = (PrivateKey) store.getKey(privKeyAlias, null);
-            // check if the private and public keys match
-            Signature sign = Signature.getInstance("SHA1WithRSA");
-            sign.initSign(privKey);
-            sign.update("foooooooooooooooo".getBytes());
-            byte[] signature = sign.sign();
-            sign.initVerify(cert.getPublicKey());
-            sign.update("foooooooooooooooo".getBytes());
-            if (sign.verify(signature) == false) {
-                getOutputStream().println("Public key in received certificate does not match private key.");
-                getOutputStream().println("Reply NOT received!");
-                return;
-            }
-            // Get the certificate chain
-            Enumeration aliases = store.aliases();
-            ArrayList cacerts = new ArrayList();
-            while (aliases.hasMoreElements()) {
-                String alias = (String)aliases.nextElement();
-                if (!privKeyAlias.equals(alias)) {
-                    Certificate cacert = store.getCertificate(alias);
-                    cacerts.add(cacert);
-                }
-            }
-            // Create new keyStore
-            KeyStore ks = KeyTools.createP12(privKeyAlias, privKey, cert, cacerts);
-            FileOutputStream os = new FileOutputStream(ksfile);
-            ks.store(os, storepwd.toCharArray());
-            getOutputStream().println("Keystore '" + ksfile + "' generated successfully.");
-        } catch (Exception e) {
-            throw new ErrorAdminCommandException(e);
-        }
-    } // execute
-    // execute
-}
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaRolloverRootCommand.java ./src/java/se/anatom/ejbca/admin/CaRolloverRootCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaRolloverRootCommand.java	Wed Oct 13 09:14:45 2004
+++ ./src/java/se/anatom/ejbca/admin/CaRolloverRootCommand.java	Thu Jan  1 01:00:00 1970
@@ -1,128 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
- 
-package se.anatom.ejbca.admin;
-
-import java.io.*;
-import java.security.KeyStore;
-import java.security.PrivateKey;
-import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
-
-import se.anatom.ejbca.util.CertTools;
-import se.anatom.ejbca.util.Hex;
-import se.anatom.ejbca.util.KeyTools;
-
-
-/**
- * Creates a new root certificate with new validity, using the same key.
- *
- * @version $Id: CaRolloverRootCommand.java,v 1.12 2004/10/13 07:14:45 anatom Exp $
- */
-public class CaRolloverRootCommand extends BaseCaAdminCommand {
-    /**
-     * Creates a new instance of CaRolloverRootCommand
-     *
-     * @param args command line arguments
-     */
-    public CaRolloverRootCommand(String[] args) {
-        super(args);
-    }
-
-    /**
-     * Runs the command
-     *
-     * @throws IllegalAdminCommandException Error in command args
-     * @throws ErrorAdminCommandException Error running command
-     */
-    public void execute() throws IllegalAdminCommandException, ErrorAdminCommandException {
-        try {
-            if (args.length < 4) {
-                getOutputStream().println(
-                    "Usage: CA rolloverroot <validity-days> <keystore filename> <storepassword>");
-                getOutputStream().println(
-                    "Rolloverroot is used to generate a new RootCA certificate using an existing keypair. This updates the current RootCA keystore.");
-
-                return;
-            }
-
-            int validity = Integer.parseInt(args[1]);
-            String filename = args[2];
-            String storepwd = args[3];
-
-            // Load keys store
-            KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
-            InputStream is = new FileInputStream(filename);
-            keyStore.load(is, storepwd.toCharArray());
-            // Get old root certificate
-            Certificate[] chain = KeyTools.getCertChain(keyStore,privKeyAlias);
-            if (chain.length > 2) {
-                getOutputStream().println(
-                    "Certificate chain too long, this P12 was not generated with EJBCA?");
-
-                return;
-            }
-            X509Certificate rootcert = (X509Certificate) chain[chain.length - 1];
-            if (!CertTools.isSelfSigned(rootcert)) {
-                getOutputStream().println("Root certificate is not self signed???");
-
-                return;
-            }
-
-            X509Certificate cacert = null;
-            if (chain.length > 1) {
-                cacert = (X509Certificate) chain[chain.length - 2];
-            }
-            // Get private key
-            PrivateKey privateKey = (PrivateKey) keyStore.getKey(privKeyAlias, privateKeyPass);
-
-            if (privateKey == null) {
-                getOutputStream().println("No private key with alias '" + privKeyAlias +
-                    "' in keystore, this keystore was not generated with EJBCA?");
-
-                return;
-            }
-
-            // Generate the new root certificate
-            String policyId = CertTools.getCertificatePolicyId(rootcert, 0);
-            getOutputStream().println("Certificate policy Id is '" + policyId + "'.");
-
-            X509Certificate newrootcert = CertTools.genSelfCert(CertTools.getSubjectDN(rootcert),
-                    validity, policyId, privateKey, rootcert.getPublicKey(), true);
-
-            // verify that the old and new keyidentifieras are the same
-            String oldKeyId = Hex.encode(CertTools.getAuthorityKeyId(rootcert));
-            String newKeyId = Hex.encode(CertTools.getAuthorityKeyId(newrootcert));
-            getOutputStream().println("Old key id: " + oldKeyId);
-            getOutputStream().println("New key id: " + newKeyId);
-
-            if (oldKeyId.compareTo(newKeyId) != 0) {
-                getOutputStream().println(
-                    "Old key identifier and new key identifieras does not match, have the key pair changed?");
-                getOutputStream().println("Unable to rollover Root CA.");
-
-                return;
-            }
-
-            // Create the new PKCS12 file
-            KeyStore ks = KeyTools.createP12(privKeyAlias, privateKey, newrootcert, cacert);
-            FileOutputStream os = new FileOutputStream(filename);
-            ks.store(os, storepwd.toCharArray());
-            getOutputStream().println("Keystore " + filename + " generated successfully.");
-            getOutputStream().println(
-                "Please put keystore in correct location, restart application server and run 'ca init'.");
-        } catch (Exception e) {
-            throw new ErrorAdminCommandException(e);
-        }
-    } // execute
-}
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaRolloverSubCommand.java ./src/java/se/anatom/ejbca/admin/CaRolloverSubCommand.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/CaRolloverSubCommand.java	Wed Oct 13 09:14:46 2004
+++ ./src/java/se/anatom/ejbca/admin/CaRolloverSubCommand.java	Thu Jan  1 01:00:00 1970
@@ -1,152 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
- 
-package se.anatom.ejbca.admin;
-
-import java.io.*;
-import java.security.KeyPair;
-import java.security.KeyStore;
-import java.security.PrivateKey;
-import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
-
-import se.anatom.ejbca.util.CertTools;
-import se.anatom.ejbca.util.Hex;
-import se.anatom.ejbca.util.KeyTools;
-
-
-/**
- * Creates a new root certificate with new validity, using the same key.
- *
- * @version $Id: CaRolloverSubCommand.java,v 1.11 2004/10/13 07:14:46 anatom Exp $
- */
-public class CaRolloverSubCommand extends BaseCaAdminCommand {
-    /**
-     * Creates a new instance of CaRolloverSubCommand
-     *
-     * @param args command line arguments
-     */
-    public CaRolloverSubCommand(String[] args) {
-        super(args);
-    }
-
-    /**
-     * Runs the command
-     *
-     * @throws IllegalAdminCommandException Error in command args
-     * @throws ErrorAdminCommandException Error running command
-     */
-    public void execute() throws IllegalAdminCommandException, ErrorAdminCommandException {
-        try {
-            if (args.length < 5) {
-                getOutputStream().println(
-                    "Usage: CA rolloversub <validity-days> <keystore filename> <storepassword> <certrequest filename>");
-                getOutputStream().println(
-                    "Rolloversub is used to generate a new subCA certificate using an existing keypair. This updates the current subCA keystore.");
-
-                return;
-            }
-
-            int validity = Integer.parseInt(args[1]);
-            String ksfilename = args[2];
-            String storepwd = args[3];
-            String reqfile = args[4];
-
-            // Load keystore
-            KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
-            InputStream is = new FileInputStream(ksfilename);
-            keyStore.load(is, storepwd.toCharArray());
-
-            // Get old certificate chain
-            Certificate[] chain = KeyTools.getCertChain(keyStore, privKeyAlias);
-
-            if (chain.length > 2) {
-                getOutputStream().println(
-                    "Certificate chain too long, this keystore was not generated with EJBCA?");
-
-                return;
-            }
-
-            X509Certificate rootcert = (X509Certificate) chain[chain.length - 1];
-
-            if (!CertTools.isSelfSigned(rootcert)) {
-                getOutputStream().println("Root certificate is not self signed???");
-
-                return;
-            }
-
-            X509Certificate cacert = null;
-
-            if (chain.length > 1) {
-                cacert = (X509Certificate) chain[0];
-            }
-
-            if (cacert == null) {
-                getOutputStream().println(
-                    "No subCA certificate found in keystore, this is not a subCA or keystore was not generated with EJBCA.");
-
-                return;
-            }
-
-            String subjectDN = CertTools.getSubjectDN(cacert);
-            getOutputStream().println("Generating new certificate request for CA with DN '" + subjectDN +
-                "'.");
-
-            // Get private key
-            PrivateKey privateKey = (PrivateKey) keyStore.getKey(privKeyAlias, privateKeyPass);
-
-            if (privateKey == null) {
-                getOutputStream().println("No private key with alias '" + privKeyAlias +
-                    "' in keystore, this keystore was not generated with EJBCA?");
-
-                return;
-            }
-
-            // Make a KeyPair
-            KeyPair keyPair = new KeyPair(cacert.getPublicKey(), privateKey);
-
-            // verify that the old and new keyidentifieras are the same
-            String policyId = CertTools.getCertificatePolicyId(cacert, 0);
-            X509Certificate newselfcert = CertTools.genSelfCert(subjectDN, validity, policyId,
-                    privateKey, cacert.getPublicKey(), true);
-            String oldKeyId = Hex.encode(CertTools.getSubjectKeyId(cacert));
-            String newKeyId = Hex.encode(CertTools.getSubjectKeyId(newselfcert));
-            getOutputStream().println("Old key id: " + oldKeyId);
-
-            if (oldKeyId == null) {
-                getOutputStream().println("Old certificate does not contain SubjectKeyIdentifier.");
-                getOutputStream().println("This is recommended, but decided by your CA.");
-                getOutputStream().println("Continuing...");
-            } else {
-                getOutputStream().println("New key id: " + newKeyId);
-
-                if (oldKeyId.compareTo(newKeyId) != 0) {
-                    getOutputStream().println(
-                        "Old key identifier and new key identifieras does not match, have the key pair changed?");
-                    getOutputStream().println("Unable to rollover subCA.");
-
-                    return;
-                }
-            }
-
-            // Generate the new certificate request
-            makeCertRequest(subjectDN, keyPair, reqfile);
-
-            getOutputStream().println(
-                "Submit certificare request to RootCA and when receiving reply run 'ca recrep'.");
-        } catch (Exception e) {
-            e.printStackTrace();
-            throw new ErrorAdminCommandException(e);
-        }
-    } // execute
-}
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/admin/ca.java ./src/java/se/anatom/ejbca/admin/ca.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/admin/ca.java	Sat Jun 11 14:49:48 2005
+++ ./src/java/se/anatom/ejbca/admin/ca.java	Tue Jun 28 15:03:14 2005
@@ -17,7 +17,7 @@
 /**
  * Implements the CA command line interface
  *
- * @version $Id: ca.java,v 1.40 2005/06/11 12:49:48 anatom Exp $
+ * @version $Id: ca.java,v 1.40.2.1 2005/06/28 13:03:14 herrvendil Exp $
  */
 public class ca extends BaseCommand {
     /**
@@ -33,7 +33,7 @@
                 cmd.execute();
             } else {
                 System.out.println(
-                    "Usage: CA info | init | listcas | makeroot | getrootcert | makereq | recrep | processreq | createcrl | getcrl | rolloverroot | rolloversub | listexpired | exportprofiles | importprofiles | importca | importcert | republish");
+                    "Usage: CA info | init | listcas | getrootcert | createcrl | getcrl |  listexpired | exportprofiles | importprofiles | importca | importcert | republish");
             }
         } catch (Exception e) {
             System.out.println(e.getMessage());            
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/apply/CertReqServlet.java ./src/java/se/anatom/ejbca/apply/CertReqServlet.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/apply/CertReqServlet.java	Fri Apr 29 10:12:49 2005
+++ ./src/java/se/anatom/ejbca/apply/CertReqServlet.java	Sat Jul 23 21:58:14 2005
@@ -77,7 +77,7 @@
  * </p>
  *
  * @author Original code by Lars Silv?n
- * @version $Id: CertReqServlet.java,v 1.51 2005/04/29 08:12:49 anatom Exp $
+ * @version $Id: CertReqServlet.java,v 1.51.2.1 2005/07/23 19:58:14 anatom Exp $
  */
 public class CertReqServlet extends HttpServlet {
     private static Logger log = Logger.getLogger(CertReqServlet.class);
@@ -167,7 +167,7 @@
             ISignSessionRemote signsession = signsessionhome.create();
             RequestHelper helper = new RequestHelper(administrator, debug);
 
-            log.debug("Got request for " + username + "/" + password);
+            log.debug("Got request for " + username + "/hiddenpwd");
             debug.print("<h3>username: " + username + "</h3>");
 
             // Check user
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/ca/caadmin/CAAdminSessionBean.java ./src/java/se/anatom/ejbca/ca/caadmin/CAAdminSessionBean.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/ca/caadmin/CAAdminSessionBean.java	Sat Jun 11 14:50:06 2005
+++ ./src/java/se/anatom/ejbca/ca/caadmin/CAAdminSessionBean.java	Fri Jul  1 12:04:19 2005
@@ -82,7 +82,7 @@
 /**
  * Administrates and manages CAs in EJBCA system.
  *
- * @version $Id: CAAdminSessionBean.java,v 1.42 2005/06/11 12:50:06 anatom Exp $
+ * @version $Id: CAAdminSessionBean.java,v 1.42.2.1 2005/07/01 10:04:19 anatom Exp $
  *
  * @ejb.bean description="Session bean handling core CA function,signing certificates"
  *   display-name="CAAdminSB"
@@ -1219,8 +1219,32 @@
             ca.setCAToken(catoken);
             ca.setCertificateChain(certificatechain);
 
+            //  Publish CA certificates.
+            int certtype = CertificateDataBean.CERTTYPE_SUBCA;
+            if(ca.getSignedBy() == CAInfo.SELFSIGNED)
+              certtype = CertificateDataBean.CERTTYPE_ROOTCA;
+            getSignSession().publishCACertificate(admin, ca.getCertificateChain(), ca.getCRLPublishers(), certtype);
+
+            // activate External CA Services
+            Iterator iter = cainfo.getExtendedCAServiceInfos().iterator();
+            while(iter.hasNext()){
+                ExtendedCAServiceInfo info = (ExtendedCAServiceInfo) iter.next();
+                if(info instanceof OCSPCAServiceInfo){
+                    try{
+                        ca.initExternalService(OCSPCAService.TYPE, ca);
+                        ArrayList ocspcertificate = new ArrayList();
+                        ocspcertificate.add(((OCSPCAServiceInfo) ca.getExtendedCAServiceInfo(OCSPCAService.TYPE)).getOCSPSignerCertificatePath().get(0));
+                        getSignSession().publishCACertificate(admin, ocspcertificate, ca.getCRLPublishers(), CertificateDataBean.CERTTYPE_ENDENTITY);
+                    }catch(Exception fe){
+                        getLogSession().log(admin, admin.getCaId(), LogEntry.MODULE_CA,  new java.util.Date(), null, null, LogEntry.EVENT_ERROR_CACREATED,"Couldn't Create ExternalCAService.",fe);
+                        throw new EJBException(fe);
+                    }
+                }
+            }
+            
             // Store CA in database.
             cadatahome.create(cainfo.getSubjectDN(), cainfo.getName(), SecConst.CA_ACTIVE, ca);
+            this.getCRLCreateSession().run(admin,cainfo.getSubjectDN());
             getLogSession().log(admin, admin.getCaId(), LogEntry.MODULE_CA,  new java.util.Date(), null, null, LogEntry.EVENT_INFO_CACREATED,"CA imported successfully from old P12 file, status: " + ca.getStatus());
         }catch(Exception e){
             getLogSession().log(admin, admin.getCaId(), LogEntry.MODULE_CA,  new java.util.Date(), null, null, LogEntry.EVENT_ERROR_CACREATED,"An error occured when trying to import CA from old P12 file", e);
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/ca/caadmin/SoftCAToken.java ./src/java/se/anatom/ejbca/ca/caadmin/SoftCAToken.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/ca/caadmin/SoftCAToken.java	Fri Apr 29 10:16:28 2005
+++ ./src/java/se/anatom/ejbca/ca/caadmin/SoftCAToken.java	Fri Jul  1 12:04:19 2005
@@ -36,7 +36,7 @@
 /** Handles maintenance of the soft devices producing signatures and handling the private key
  *  and stored in database.
  * 
- * @version $Id: SoftCAToken.java,v 1.14 2005/04/29 08:16:28 anatom Exp $
+ * @version $Id: SoftCAToken.java,v 1.14.2.1 2005/07/01 10:04:19 anatom Exp $
  */
 public class SoftCAToken extends CAToken implements java.io.Serializable{
 
@@ -162,14 +162,15 @@
        int keysize = ((RSAPublicKey) p12publickey).getModulus().bitLength();
        log.debug("KeySize="+keysize);
        Certificate[] certchain = new Certificate[1];
-       certchain[0] = CertTools.genSelfCert("CN=dummy1", 1000, null, p12privatekey, p12publickey, true);
+       certchain[0] = CertTools.genSelfCert("CN=dummy", 36500, null, p12privatekey, p12publickey, true);
        keystore.setKeyEntry(PRIVATESIGNKEYALIAS, p12privatekey,null,certchain);       
      
        // generate enc keys.  
        KeyPair enckeys = KeyTools.genKeys(keysize);
-       certchain[0] = CertTools.genSelfCert("CN=dummy2", 1000, null, enckeys.getPrivate(), enckeys.getPublic(), true);
-       this.encCert = certchain[0];
-       keystore.setKeyEntry(PRIVATEDECKEYALIAS,enckeys.getPrivate(),null,certchain);       
+       // generate dummy certificate
+       certchain[0] = CertTools.genSelfCert("CN=dummy2", 36500, null, enckeys.getPrivate(), enckeys.getPublic(), true);
+       this.encCert = certchain[0]; 
+       keystore.setKeyEntry(PRIVATEDECKEYALIAS,enckeys.getPrivate(),null,certchain);              
      
        java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
        keystore.store(baos, keystorepass.toCharArray());
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/ca/caadmin/X509CA.java ./src/java/se/anatom/ejbca/ca/caadmin/X509CA.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/ca/caadmin/X509CA.java	Wed May 18 19:06:27 2005
+++ ./src/java/se/anatom/ejbca/ca/caadmin/X509CA.java	Tue Aug  2 13:38:10 2005
@@ -105,7 +105,7 @@
  * X509CA is a implementation of a CA and holds data specific for Certificate and CRL generation 
  * according to the X509 standard. 
  *
- * @version $Id: X509CA.java,v 1.41 2005/05/18 17:06:27 primelars Exp $
+ * @version $Id: X509CA.java,v 1.41.2.1 2005/08/02 11:38:10 anatom Exp $
  */
 public class X509CA extends CA implements Serializable {
 
@@ -346,7 +346,7 @@
                 X509Extensions.AuthorityKeyIdentifier.getId(),
                 certProfile.getAuthorityKeyIdentifierCritical(), aki);
         }
-        // Subject Alternative name
+         // Subject Alternative name
         if ( (certProfile.getUseSubjectAlternativeName() == true) && (altName != null) && (altName.length() > 0) ) {
             String email = CertTools.getEmailFromDN(altName);
             DEREncodableVector vec = new DEREncodableVector();
@@ -354,46 +354,74 @@
                 GeneralName gn = new GeneralName(1, new DERIA5String(email));
                 vec.add(gn);
             }
-            String dns = CertTools.getPartFromDN(altName, CertTools.DNS);
-            if (dns != null) {
-                GeneralName gn = new GeneralName(2, new DERIA5String(dns));
-                vec.add(gn);
-            }
-            String uri = CertTools.getPartFromDN(altName, CertTools.URI);
-            if (uri == null){            
-                uri  = CertTools.getPartFromDN(altName, CertTools.URI1);
-            }
-            if (uri != null) {
-                GeneralName gn = new GeneralName(6, new DERIA5String(uri));
-                vec.add(gn);
+            
+            ArrayList dns = CertTools.getPartsFromDN(altName, CertTools.DNS);
+            if (!dns.isEmpty()) {            
+				Iterator iter = dns.iterator();
+				while (iter.hasNext()) {
+					GeneralName gn = new GeneralName(2, new DERIA5String((String)iter.next()));
+					vec.add(gn);
+				}
             }
-            String ipstr = CertTools.getPartFromDN(altName, CertTools.IPADDR);
-            if (ipstr != null) {
-                byte[] ipoctets = StringTools.ipStringToOctets(ipstr);
-                GeneralName gn = new GeneralName(7, new DEROctetString(ipoctets));
-                vec.add(gn);
-            }
-            String upn =  CertTools.getPartFromDN(altName, CertTools.UPN);
-            if (upn != null) {
-                ASN1EncodableVector v = new ASN1EncodableVector();
-                v.add(new DERObjectIdentifier(CertTools.UPN_OBJECTID));
-                v.add(new DERTaggedObject(true, 0, new DERUTF8String(upn)));
-                //GeneralName gn = new GeneralName(new DERSequence(v), 0);
-                DERObject gn = new DERTaggedObject(false, 0, new DERSequence(v));
-                vec.add(gn);
-            }            
-            String guid =  CertTools.getPartFromDN(altName, CertTools.GUID);
-            if (guid != null) {
-                ASN1EncodableVector v = new ASN1EncodableVector();
-                byte[] guidbytes = Hex.decode(guid);
-                if (guidbytes != null) {
-                    v.add(new DERObjectIdentifier(CertTools.GUID_OBJECTID));
-                    v.add(new DERTaggedObject(true, 0, new DEROctetString(guidbytes)));
-                    DERObject gn = new DERTaggedObject(false, 0, new DERSequence(v));
-                    vec.add(gn);                    
-                } else {
-                    log.error("Cannot decode hexadecimal guid: "+guid);
-                }
+            			            
+            ArrayList uri = CertTools.getPartsFromDN(altName, CertTools.URI);
+			if (!uri.isEmpty()) {            
+				Iterator iter = uri.iterator();
+				while (iter.hasNext()) {
+					GeneralName gn = new GeneralName(6, new DERIA5String((String)iter.next()));
+					vec.add(gn);
+				}
+			}
+
+			uri = CertTools.getPartsFromDN(altName, CertTools.URI1);
+			if (!uri.isEmpty()) {            
+				Iterator iter = uri.iterator();
+				while (iter.hasNext()) {
+					GeneralName gn = new GeneralName(6, new DERIA5String((String)iter.next()));
+					vec.add(gn);
+				}
+			}
+            
+                    
+            ArrayList ipstr = CertTools.getPartsFromDN(altName, CertTools.IPADDR);
+			if (!ipstr.isEmpty()) {            
+				Iterator iter = ipstr.iterator();
+				while (iter.hasNext()) {
+					byte[] ipoctets = StringTools.ipStringToOctets((String)iter.next());
+					GeneralName gn = new GeneralName(7, new DEROctetString(ipoctets));
+					vec.add(gn);
+				}
+			}
+			            
+            ArrayList upn =  CertTools.getPartsFromDN(altName, CertTools.UPN);
+			if (!upn.isEmpty()) {            
+				Iterator iter = upn.iterator();				
+				while (iter.hasNext()) {
+					ASN1EncodableVector v = new ASN1EncodableVector();
+					v.add(new DERObjectIdentifier(CertTools.UPN_OBJECTID));
+					v.add(new DERTaggedObject(true, 0, new DERUTF8String((String)iter.next())));
+					//GeneralName gn = new GeneralName(new DERSequence(v), 0);
+					DERObject gn = new DERTaggedObject(false, 0, new DERSequence(v));
+					vec.add(gn);
+				}
+			}
+            
+          
+            ArrayList guid =  CertTools.getPartsFromDN(altName, CertTools.GUID);
+			if (!guid.isEmpty()) {            
+				Iterator iter = guid.iterator();				
+				while (iter.hasNext()) {					
+	                ASN1EncodableVector v = new ASN1EncodableVector();
+	                byte[] guidbytes = Hex.decode((String)iter.next());
+	                if (guidbytes != null) {
+	                    v.add(new DERObjectIdentifier(CertTools.GUID_OBJECTID));
+	                    v.add(new DERTaggedObject(true, 0, new DEROctetString(guidbytes)));
+	                    DERObject gn = new DERTaggedObject(false, 0, new DERSequence(v));
+	                    vec.add(gn);                    
+	                } else {
+	                    log.error("Cannot decode hexadecimal guid: "+guid);
+	                }
+				}
             }            
             if (vec.size() > 0) {
                 GeneralNames san = new GeneralNames(new DERSequence(vec));
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/ca/sign/RSASignSessionBean.java ./src/java/se/anatom/ejbca/ca/sign/RSASignSessionBean.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/ca/sign/RSASignSessionBean.java	Mon May  2 18:19:05 2005
+++ ./src/java/se/anatom/ejbca/ca/sign/RSASignSessionBean.java	Wed Aug 10 15:05:05 2005
@@ -72,6 +72,7 @@
 import se.anatom.ejbca.protocol.IRequestMessage;
 import se.anatom.ejbca.protocol.IResponseMessage;
 import se.anatom.ejbca.protocol.ResponseStatus;
+import se.anatom.ejbca.util.Base64;
 import se.anatom.ejbca.util.CertTools;
 import se.anatom.ejbca.util.Hex;
 
@@ -190,6 +191,7 @@
      * Source of good random data
      */
     SecureRandom randomSource = null;
+    
 
 
     /**
@@ -429,7 +431,7 @@
      * @ejb.interface-method view-type="both"
      */
     public Certificate createCertificate(Admin admin, String username, String password, PublicKey pk, int keyusage) throws ObjectNotFoundException, AuthStatusException, AuthLoginException, IllegalKeyException, CADoesntExistsException {
-        return createCertificate(admin, username, password, pk, keyusage, SecConst.PROFILE_NO_PROFILE);
+        return createCertificate(admin, username, password, pk, keyusage, SecConst.PROFILE_NO_PROFILE, SecConst.CAID_USEUSERDEFINED);
     }
 
 
@@ -451,7 +453,11 @@
      *                             digitalSignature and nonRepudiation. ex. int keyusage = CertificateData.keyCertSign
      *                             | CertificateData.cRLSign; gives keyCertSign and cRLSign
      * @param certificateprofileid used to override the one set in userdata.
-     *                             Should be set to SecConst.PROFILE_NO_PROFILE if the regular certificateid shpuld be used
+     *                             Should be set to SecConst.PROFILE_NO_PROFILE if the usedata certificateprofileid should be used
+     * @param caid                 used to override the one set in userdata.¨
+     *                             Should be set to SecConst.CAID_USEUSERDEFINED if the regular certificateprofileid should be used
+     * 
+     * 
      * @return The newly created certificate or null.
      * @throws ObjectNotFoundException if the user does not exist.
      * @throws AuthStatusException     If the users status is incorrect.
@@ -460,7 +466,7 @@
      * @ejb.permission unchecked="true"
      * @ejb.interface-method view-type="both"
      */
-    public Certificate createCertificate(Admin admin, String username, String password, PublicKey pk, int keyusage, int certificateprofileid) throws ObjectNotFoundException, AuthStatusException, AuthLoginException, IllegalKeyException, CADoesntExistsException {
+    public Certificate createCertificate(Admin admin, String username, String password, PublicKey pk, int keyusage, int certificateprofileid, int caid) throws ObjectNotFoundException, AuthStatusException, AuthLoginException, IllegalKeyException, CADoesntExistsException {
         debug(">createCertificate(pk, ku)");
         try {
             // Authorize user and get DN
@@ -470,6 +476,11 @@
                 debug("Overriding user certificate profile with :" + certificateprofileid);
                 data.setCertificateProfileId(certificateprofileid);
             }
+            
+            if (caid != SecConst.CAID_USEUSERDEFINED) {
+                debug("Overriding user caid with :" + caid);
+                data.setCAId(caid);
+            }
 
 
             debug("type=" + data.getType());
@@ -934,7 +945,7 @@
     	// Sendernonce is a random number
     	byte[] senderNonce = new byte[16];
     	randomSource.nextBytes(senderNonce);
-    	ret.setSenderNonce(Hex.encode(senderNonce));
+    	ret.setSenderNonce(new String(Base64.encode(senderNonce)));
     	// If we have a specified request key info, use it in the reply
     	if (req.getRequestKeyInfo() != null) {
     		ret.setRecipientKeyInfo(req.getRequestKeyInfo());
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/EIDProfile.java ./src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/EIDProfile.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/EIDProfile.java	Tue May 24 11:33:39 2005
+++ ./src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/EIDProfile.java	Tue Jun 28 15:00:49 2005
@@ -13,14 +13,14 @@
  
 package se.anatom.ejbca.hardtoken.hardtokenprofiles;
 
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Iterator;
 import java.util.List;
 
+import se.anatom.ejbca.SecConst;
 import se.anatom.ejbca.ca.caadmin.CAInfo;
 
-import java.util.ArrayList;
-
 
 
 /**
@@ -28,13 +28,13 @@
  * of eidprofiles in the system.
  *  
  *
- * @version $Id: EIDProfile.java,v 1.6 2005/05/24 09:33:39 herrvendil Exp $
+ * @version $Id: EIDProfile.java,v 1.6.2.1 2005/06/28 13:00:49 herrvendil Exp $
  */
 public abstract class EIDProfile extends HardTokenProfileWithAdressLabel {
 	
 	public static final String KEYTYPE_RSA = "RSA";
 	
-	public static final int CAID_USEUSERDEFINED = 0;
+	public static final int CAID_USEUSERDEFINED = SecConst.CAID_USEUSERDEFINED;
 	
 	// Protected Constants
 	protected static final String CERTIFICATEPROFILEID           = "certificateprofileid";
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/SVGImageManipulator.java ./src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/SVGImageManipulator.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/SVGImageManipulator.java	Sun Jun  5 23:39:21 2005
+++ ./src/java/se/anatom/ejbca/hardtoken/hardtokenprofiles/SVGImageManipulator.java	Tue Jun 28 15:04:02 2005
@@ -59,7 +59,7 @@
  * It replaces all occurrenses of specified variables in the images 
  * with the corresponding userdata.
  *
- * @version $Id: SVGImageManipulator.java,v 1.12 2005/06/05 21:39:21 primelars Exp $
+ * @version $Id: SVGImageManipulator.java,v 1.12.2.1 2005/06/28 13:04:02 herrvendil Exp $
  */
 public class SVGImageManipulator {
 	/**
@@ -114,7 +114,7 @@
 //	private static final Pattern COPYOFSNWITHOUTPREFIX = Pattern.compile("\\$COPYOFSNWITHOUTPREFIX", Pattern.CASE_INSENSITIVE);
 
     static {
-        PINS = new Pattern[30];
+        PINS = new Pattern[0x50];
         PUKS = new Pattern[PINS.length];
         for (int i=0; i<PINS.length; i++) {
             final int pinNr = i+1;
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/protocol/PKCS10RequestMessage.java ./src/java/se/anatom/ejbca/protocol/PKCS10RequestMessage.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/protocol/PKCS10RequestMessage.java	Mon Apr 11 11:03:59 2005
+++ ./src/java/se/anatom/ejbca/protocol/PKCS10RequestMessage.java	Fri Aug 12 12:07:47 2005
@@ -15,6 +15,7 @@
 
 import org.apache.log4j.Logger;
 import org.bouncycastle.asn1.ASN1Set;
+import org.bouncycastle.asn1.DEREncodable;
 import org.bouncycastle.asn1.DERPrintableString;
 import org.bouncycastle.asn1.DERString;
 import org.bouncycastle.asn1.DERUTF8String;
@@ -22,6 +23,8 @@
 import org.bouncycastle.asn1.cms.AttributeTable;
 import org.bouncycastle.asn1.pkcs.CertificationRequestInfo;
 import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.x509.X509Extension;
+import org.bouncycastle.asn1.x509.X509Extensions;
 import org.bouncycastle.asn1.x509.X509Name;
 import org.bouncycastle.jce.PKCS10CertificationRequest;
 import se.anatom.ejbca.util.CertTools;
@@ -40,7 +43,7 @@
 /**
  * Class to handle PKCS10 request messages sent to the CA.
  *
- * @version $Id: PKCS10RequestMessage.java,v 1.28 2005/04/11 09:03:59 anatom Exp $
+ * @version $Id: PKCS10RequestMessage.java,v 1.28.2.3 2005/08/12 10:07:47 anatom Exp $
  */
 public class PKCS10RequestMessage implements IRequestMessage, Serializable {
     static final long serialVersionUID = 3597275157018205136L;
@@ -136,7 +139,7 @@
     /**
      * Returns the challenge password from the certificattion request.
      *
-     * @return challenge password from certification request.
+     * @return challenge password from certification request or null if none exist in the request.
      */
     public String getPassword() {
         if (password != null)
@@ -147,26 +150,55 @@
             }
         } catch (IllegalArgumentException e) {
             log.error("PKCS10 not inited!");
-
             return null;
         }
 
         String ret = null;
 
         // Get attributes
+        // The password attribute can be either a pkcs_9_at_challengePassword directly
+        // or
+        // a pkcs_9_at_extensionRequest containing a pkcs_9_at_challengePassword as a
+        // X509Extension.
         CertificationRequestInfo info = pkcs10.getCertificationRequestInfo();
         AttributeTable attributes = new AttributeTable(info.getAttributes());
+        if (attributes == null) {
+            return null;
+        }
         Attribute attr = attributes.get(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
-        ASN1Set values = attr.getAttrValues();
+        DEREncodable obj = null;
+        if (attr == null) {
+            // See if we have it embedded in an extension request instead
+            attr = attributes.get(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
+            if (attr == null) {
+                return null;                
+            }
+            log.debug("got extension request");
+            ASN1Set values = attr.getAttrValues();
+            if (values.size() == 0) {
+                return null;
+            }
+            X509Extensions exts = X509Extensions.getInstance(values.getObjectAt(0));
+            X509Extension ext = exts.getExtension(PKCSObjectIdentifiers.pkcs_9_at_challengePassword);
+            if (ext == null) {
+                log.debug("no challenge password extension");
+                return null;
+            }
+            obj = ext.getValue();
+        } else {
+            // If it is a challengePassword directly, it's just to grab the value
+            ASN1Set values = attr.getAttrValues();
+            obj = values.getObjectAt(0);
+        }
 
-        if (values.size() > 0) {
+        if (obj != null) {
             DERString str = null;
 
             try {
-                str = DERPrintableString.getInstance((values.getObjectAt(0)));
+                str = DERPrintableString.getInstance((obj));
             } catch (IllegalArgumentException ie) {
                 // This was not printable string, should be utf8string then according to pkcs#9 v2.0
-                str = DERUTF8String.getInstance((values.getObjectAt(0)));
+                str = DERUTF8String.getInstance((obj));
             }
 
             if (str != null) {
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/protocol/ScepRequestMessage.java ./src/java/se/anatom/ejbca/protocol/ScepRequestMessage.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/protocol/ScepRequestMessage.java	Fri May 27 16:52:27 2005
+++ ./src/java/se/anatom/ejbca/protocol/ScepRequestMessage.java	Fri Aug 12 12:07:47 2005
@@ -60,7 +60,7 @@
  * Class to handle SCEP request messages sent to the CA. 
  * TODO: don't forget extensions, e.g. KeyUsage requested by end entity 
  *
- * @version $Id: ScepRequestMessage.java,v 1.40 2005/05/27 14:52:27 anatom Exp $
+ * @version $Id: ScepRequestMessage.java,v 1.40.2.1 2005/08/12 10:07:47 anatom Exp $
  */
 public class ScepRequestMessage extends PKCS10RequestMessage implements IRequestMessage, Serializable {
     static final long serialVersionUID = -235623330828902051L;
@@ -297,11 +297,13 @@
         if (messageType == ScepRequestMessage.SCEP_TYPE_PKCSREQ) {
             ASN1Sequence seq = (ASN1Sequence) derobj;
             pkcs10 = new PKCS10CertificationRequest(seq);
+            log.debug("Successfully extracted PKCS10.");
+            //log.debug("Successfully extracted PKCS10:"+new String(Base64.encode(pkcs10.getEncoded())));
         }
         if (messageType == ScepRequestMessage.SCEP_TYPE_GETCRL) {
             issuerAndSerno = IssuerAndSerialNumber.getInstance(derobj);
+            log.debug("Successfully extracted IssuerAndSerialNumber.");
         }
-        log.debug("Successfully extracted PKCS10.");
         log.debug("<decrypt");
     } // decrypt
 
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/protocol/ScepResponseMessage.java ./src/java/se/anatom/ejbca/protocol/ScepResponseMessage.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/protocol/ScepResponseMessage.java	Sat Nov 20 23:54:28 2004
+++ ./src/java/se/anatom/ejbca/protocol/ScepResponseMessage.java	Thu Aug 11 11:05:14 2005
@@ -52,7 +52,7 @@
 /**
  * A response message for scep (pkcs7).
  *
- * @version $Id: ScepResponseMessage.java,v 1.23 2004/11/20 22:54:28 sbailliez Exp $
+ * @version $Id: ScepResponseMessage.java,v 1.23.2.2 2005/08/11 09:05:14 anatom Exp $
  */
 public class ScepResponseMessage implements IResponseMessage, Serializable {
     static final long serialVersionUID = 2016710353393853878L;
@@ -199,6 +199,7 @@
                 } else if (cert != null) {
                     log.debug("Adding certificates to response message");
                     certList.add(cert);
+                    // Add the CA cert, it's optional but Cisco VPN client complains if it isn't there
                     certList.add(signCert);
                 }
                 CertStore certs = CertStore.getInstance("Collection",
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/protocol/ScepServlet.java ./src/java/se/anatom/ejbca/protocol/ScepServlet.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/protocol/ScepServlet.java	Fri May 27 16:52:27 2005
+++ ./src/java/se/anatom/ejbca/protocol/ScepServlet.java	Thu Aug 11 11:06:05 2005
@@ -13,7 +13,23 @@
 
 package se.anatom.ejbca.protocol;
 
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.security.cert.X509Certificate;
+import java.util.Collection;
+import java.util.Iterator;
+
+import javax.naming.InitialContext;
+import javax.rmi.PortableRemoteObject;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletInputStream;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.apache.log4j.Logger;
+
 import se.anatom.ejbca.apply.RequestHelper;
 import se.anatom.ejbca.authorization.AuthorizationDeniedException;
 import se.anatom.ejbca.ca.caadmin.CAInfo;
@@ -28,18 +44,6 @@
 import se.anatom.ejbca.util.Base64;
 import se.anatom.ejbca.util.CertTools;
 
-import javax.naming.InitialContext;
-import javax.rmi.PortableRemoteObject;
-import javax.servlet.ServletConfig;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.security.cert.X509Certificate;
-import java.util.Collection;
-import java.util.Iterator;
-
 
 /**
  * Servlet implementing server side of the Simple Certificate Enrollment Protocol (SCEP) 
@@ -59,7 +63,7 @@
  * 7. output the result as a der encoded block on stdout 
  * -----
  *
- * @version $Id: ScepServlet.java,v 1.34 2005/05/27 14:52:27 anatom Exp $
+ * @version $Id: ScepServlet.java,v 1.34.2.1 2005/08/11 09:06:05 anatom Exp $
  */
 public class ScepServlet extends HttpServlet {
     private static Logger log = Logger.getLogger(ScepServlet.class);
@@ -103,7 +107,27 @@
     public void doPost(HttpServletRequest request, HttpServletResponse response)
             throws IOException, ServletException {
         log.debug(">doPost()");
-        doGet(request, response);
+        /* 
+         If the remote CA supports it, any of the PKCS#7-encoded SCEP messages
+         may be sent via HTTP POST instead of HTTP GET.   This is allowed for
+         any SCEP message except GetCACert, GetCACertChain, GetNextCACert,
+         or GetCACaps.  In this form of the message, Base 64 encoding is not
+         used.
+         
+         POST /cgi-bin/pkiclient.exe?operation=PKIOperation
+         <binary PKCS7 data>
+         */
+        String operation = "PKIOperation";
+        ServletInputStream sin = request.getInputStream();
+        // This small code snippet is inspired/copied by apache IO utils to Tomas Gustavsson...
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        byte[] buf = new byte[1024];
+        int n = 0;
+        while (-1 != (n = sin.read(buf))) {
+            output.write(buf, 0, n);
+        }
+        String message = new String(Base64.encode(output.toByteArray()));
+        service(operation, message, request.getRemoteAddr(), response);
         log.debug("<doPost()");
     } //doPost
 
@@ -120,33 +144,45 @@
             throws java.io.IOException, ServletException {
         log.debug(">doGet()");
 
-        try {
             log.debug("query string=" + request.getQueryString());
 
+            // These are mandatory in SCEP GET
+            /*
+             GET /cgi-bin/pkiclient.exe?operation=PKIOperation&message=MIAGCSqGSIb3D
+             QEHA6CAMIACAQAxgDCBzAIBADB2MGIxETAPBgNVBAcTCE ......AAAAAA== 
+             */
             String operation = request.getParameter("operation");
             String message = request.getParameter("message");
 
+            service(operation, message, request.getRemoteAddr(), response);
+            
+        log.debug("<doGet()");
+    } // doGet
+
+    private void service(String operation, String message, String remoteAddr, HttpServletResponse response) throws IOException {
+        try {
             if ((operation == null) || (message == null)) {
+                log.error("Got request missing operation and/or message parameters.");
                 response.sendError(HttpServletResponse.SC_BAD_REQUEST,
-                        "Parameters 'operation' and 'message' must be supplied!");
+                "Parameters 'operation' and 'message' must be supplied!");
                 return;
             }
-
-            Admin administrator = new Admin(Admin.TYPE_PUBLIC_WEB_USER, request.getRemoteAddr());
+            
+            Admin administrator = new Admin(Admin.TYPE_PUBLIC_WEB_USER, remoteAddr);
             log.debug("Got request '" + operation + "'");
             log.debug("Message: " + message);
-
+            
             if (operation.equals("PKIOperation")) {
                 byte[] scepmsg = Base64.decode(message.getBytes());
                 ISignSessionRemote signsession = signhome.create();
                 ScepPkiOpHelper helper = new ScepPkiOpHelper(administrator, signsession);
-
+                
                 // Read the message end get the cert, this also checksauthorization
                 byte[] reply = helper.scepCertRequest(scepmsg);
                 if (reply == null) {
                     // This is probably a getCert message?
                     response.sendError(HttpServletResponse.SC_NOT_IMPLEMENTED,
-                            "Can not handle request");
+                    "Can not handle request");
                     return;
                 }
                 // Send back Scep response, PKCS#7 which contains the end entity's certificate (or failure)
@@ -173,7 +209,7 @@
                 } else {
                     log.error("SCEP cert request for unknown CA '" + message + "'");
                     response.sendError(HttpServletResponse.SC_NOT_FOUND,
-                            "No CA certificates found.");
+                    "No CA certificates found.");
                 }
             } else if (operation.equals("GetCACertChain")) {
                 // The response for GetCACertChain is a certificates-only PKCS#7 
@@ -192,48 +228,63 @@
                 } else {
                     log.error("SCEP pkcs7 request for unknown CA '" + message + "'");
                     response.sendError(HttpServletResponse.SC_NOT_FOUND,
-                            "No CA certificates found.");
+                    "No CA certificates found.");
                 }
+            } else if (operation.equals("GetCACaps")) {
+                // The response for GetCACaps is a <lf> separated list of capabilities
+
+                /*
+                 "GetNextCACert"       CA Supports the GetNextCACert message.
+                 "POSTPKIOperation"    PKIOPeration messages may be sent via HTTP POST.
+                 "SHA-1"               CA Supports the SHA-1 hashing algorithm in 
+                                       signatures and fingerprints.  If present, the
+                                       client SHOULD use SHA-1.  If absent, the client
+                                       MUST use MD5 to maintain backward compatability.
+                 "Renewal"             Clients may use current certificate and key to
+                                       authenticate an enrollment request for a new
+                                       certificate.  
+                 */
+                log.debug("Got SCEP CACaps request for CA '" + message + "'");
+                response.setContentType("text/plain");
+                response.getOutputStream().print("POSTPKIOperation\nSHA-1");
             } else {
                 log.error("Invalid parameter '" + operation);
-
+                
                 // TODO: Send back proper Failure Response
                 response.sendError(HttpServletResponse.SC_BAD_REQUEST,
                         "Invalid parameter: " + operation);
             }
         } catch (CADoesntExistsException cae) {
             log.error("SCEP cert request for unknown CA, or can't find user.", cae);
-
+            
             // TODO: Send back proper Failure Response
             response.sendError(HttpServletResponse.SC_NOT_FOUND, cae.getMessage());
         } catch (java.lang.ArrayIndexOutOfBoundsException ae) {
             log.error("Empty or invalid request received.", ae);
-
+            
             // TODO: Send back proper Failure Response
             response.sendError(HttpServletResponse.SC_BAD_REQUEST, ae.getMessage());
         } catch (AuthorizationDeniedException ae) {
             log.error("Authorization denied.", ae);
-
+            
             // TODO: Send back proper Failure Response
             response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ae.getMessage());
         } catch (AuthLoginException ae) {
             log.error("Authorization denied.", ae);
-
+            
             // TODO: Send back proper Failure Response
             response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ae.getMessage());
         } catch (AuthStatusException ae) {
             log.error("Wrong client status.", ae);
-
+            
             // TODO: Send back proper Failure Response
             response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ae.getMessage());
         } catch (Exception e) {
             log.error("Error in ScepServlet:", e);
-
+            
             // TODO: Send back proper Failure Response
             response.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
         }
-
-        log.debug("<doGet()");
-    } // doGet
-
+    }
+    
 } // ScepServlet
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/ra/raadmin/EndEntityProfile.java ./src/java/se/anatom/ejbca/ra/raadmin/EndEntityProfile.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/ra/raadmin/EndEntityProfile.java	Mon May  2 18:18:23 2005
+++ ./src/java/se/anatom/ejbca/ra/raadmin/EndEntityProfile.java	Fri Jul 22 11:19:43 2005
@@ -31,7 +31,7 @@
  * of ejbca web interface.
  *
  * @author  Philip Vendil
- * @version $Id: EndEntityProfile.java,v 1.31 2005/05/02 16:18:23 anatom Exp $
+ * @version $Id: EndEntityProfile.java,v 1.31.2.1 2005/07/22 09:19:43 anatom Exp $
  */
 public class EndEntityProfile extends UpgradeableDataHashMap implements java.io.Serializable, Cloneable {
 
@@ -457,7 +457,7 @@
                                                                 int tokentype, int hardwaretokenissuerid, int caid) throws UserDoesntFullfillEndEntityProfile{
       DNFieldExtractor subjectdnfields = new DNFieldExtractor(dn, DNFieldExtractor.TYPE_SUBJECTDN);
       if (subjectdnfields.isIllegal()) {
-          throw new UserDoesntFullfillEndEntityProfile("Subject IS is illegal.");
+          throw new UserDoesntFullfillEndEntityProfile("Subject DN is illegal.");
       }
       DNFieldExtractor subjectaltnames   = new DNFieldExtractor(subjectaltname, DNFieldExtractor.TYPE_SUBJECTALTNAME);
       if (subjectaltnames.isIllegal()) {
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/util/CertTools.java ./src/java/se/anatom/ejbca/util/CertTools.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/util/CertTools.java	Sat Jun 11 14:50:06 2005
+++ ./src/java/se/anatom/ejbca/util/CertTools.java	Tue Aug  2 13:38:10 2005
@@ -46,6 +46,7 @@
 import java.util.List;
 import java.util.Vector;
 
+import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.bouncycastle.asn1.ASN1InputStream;
 import org.bouncycastle.asn1.ASN1OctetString;
@@ -73,7 +74,7 @@
 /**
  * Tools to handle common certificate operations.
  *
- * @version $Id: CertTools.java,v 1.76 2005/06/11 12:50:06 anatom Exp $
+ * @version $Id: CertTools.java,v 1.76.2.2 2005/08/02 11:38:10 anatom Exp $
  */
 public class CertTools {
     private static Logger log = Logger.getLogger(CertTools.class);
@@ -380,6 +381,34 @@
     } //getPartFromDN
 
     /**
+	 * Gets a specified parts of a DN. Returns all occurences as an ArrayList, also works if DN contains several
+	 * instances of a part (i.e. cn=x, cn=y returns {x, y, null}).
+	 *
+	 * @param dn String containing DN, The DN string has the format "C=SE, O=xx, OU=yy, CN=zz".
+	 * @param dnpart String specifying which part of the DN to get, should be "CN" or "OU" etc.
+	 *
+	 * @return ArrayList containing dnparts or empty list if dnpart is not present
+	 */
+	public static ArrayList getPartsFromDN(String dn, String dnpart) {
+		log.debug(">getPartsFromDN: dn:'" + dn + "', dnpart=" + dnpart);
+		ArrayList parts = new ArrayList();
+		if ((dn != null) && (dnpart != null)) {
+			String o;
+			dnpart += "="; // we search for 'CN=' etc.
+			X509NameTokenizer xt = new X509NameTokenizer(dn);
+			while (xt.hasMoreTokens()) {
+				o = xt.nextToken();
+				if ((o.length() > dnpart.length()) &&
+						o.substring(0, dnpart.length()).equalsIgnoreCase(dnpart)) {
+					parts.add(o.substring(dnpart.length()));
+				}
+			}
+		}
+		log.debug("<getpartsFromDN: resulting DN part=" + parts.toString());
+		return parts;
+	} //getPartFromDN
+
+    /**
      * Gets subject DN in the format we are sure about (BouncyCastle),supporting UTF8.
      *
      * @param cert X509Certificate
@@ -786,25 +815,35 @@
      * @return String with the UPN name
      */
     public static String getUPNAltName(X509Certificate cert)
-        throws IOException, CertificateParsingException {
+    throws IOException, CertificateParsingException {
         Collection altNames = cert.getSubjectAlternativeNames();
         if (altNames != null) {
             Iterator i = altNames.iterator();
             while (i.hasNext()) {
                 ASN1Sequence seq = getAltnameSequence((List)i.next());
-                if ( seq != null) {                    
-                    // First in sequence is the object identifier, that we must check
-                    DERObjectIdentifier id = DERObjectIdentifier.getInstance(seq.getObjectAt(0));
-                    if (id.getId().equals(CertTools.UPN_OBJECTID)) {
-                        ASN1TaggedObject obj = (ASN1TaggedObject) seq.getObjectAt(1);
-                        DERUTF8String str = DERUTF8String.getInstance(obj.getObject());
-                        return str.getString();                        
-                    }
+                String ret = getUPNStringFromSequence(seq);
+                if (ret != null) {
+                    return ret;
                 }
             }
         }
         return null;
     } // getUPNAltName
+    
+    /** Helper method for the above method
+     */
+    private static String getUPNStringFromSequence(ASN1Sequence seq) {
+        if ( seq != null) {                    
+            // First in sequence is the object identifier, that we must check
+            DERObjectIdentifier id = DERObjectIdentifier.getInstance(seq.getObjectAt(0));
+            if (id.getId().equals(CertTools.UPN_OBJECTID)) {
+                ASN1TaggedObject obj = (ASN1TaggedObject) seq.getObjectAt(1);
+                DERUTF8String str = DERUTF8String.getInstance(obj.getObject());
+                return str.getString();                        
+            }
+        }
+        return null;
+    }
 
     /**
      * Gets the Microsoft specific GUID altName, that is encoded as an octect string.
@@ -846,61 +885,85 @@
         return null;
     }
     
-	/**
-	 * SubjectAltName ::= GeneralNames
-	 
-	 GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
-	 
-	 GeneralName ::= CHOICE {
-	 otherName                       [0]     OtherName,
-	 rfc822Name                      [1]     IA5String,
-	 dNSName                         [2]     IA5String,
-	 x400Address                     [3]     ORAddress,
-	 directoryName                   [4]     Name,
-	 ediPartyName                    [5]     EDIPartyName,
-	 uniformResourceIdentifier       [6]     IA5String,
-	 iPAddress                       [7]     OCTET STRING,
-	 registeredID                    [8]     OBJECT IDENTIFIER}
-	 
-	 SubjectAltName is of form \"rfc822Name=<email>,
-	 dNSName=<host name>, uri=<http://host.com/>,
-	 ipaddress=<address>, guid=<globally unique id>
-	 
-	 * Marco Ferrante, (c) 2005 CSITA - University of Genoa (Italy)
-	 * @param certificate
-	 * @return String containing altNames of form "rfc822Name=email, dNSName=hostname, uri=uri, ipadsress=ip"  
-	 * @throws java.lang.Exception
-	 */
-	public static String getSubjectAlternativeName(X509Certificate certificate) throws Exception {
-		log.debug("Search for SubjectAltName");
-		if (certificate.getSubjectAlternativeNames() == null)
-			return null;
-		
-		java.util.Collection altNames = certificate.getSubjectAlternativeNames();
-		if (altNames.size() > 1) {
-			throw new Exception("Unable to handle multiple SubjectAltName.");
-		}
-		java.util.List item = (java.util.List)altNames.iterator().next();
-		Integer type = (Integer)item.get(0);
-		Object value = item.get(1);
-		String result = null;
-		switch (type.intValue()) {
-			case 0: throw new Exception("SubjectAltName of type OtherName not supported.");
-			case 1: result = "rfc822Name=" + (String)value;
-				break;
-			case 2: result = "dNSName=" + (String)value;
-				break;
-			case 3: throw new Exception("SubjectAltName of type x400Address not supported.");
-			case 4: throw new Exception("SubjectAltName of type directoryName not supported.");
-			case 5: throw new Exception("SubjectAltName of type ediPartyName not supported.");
-			case 6: result = "uri=" + (String)value;
-				break;
-			case 7: result = "ipaddress=" + (String)value;
-				break;
-			default: throw new Exception("SubjectAltName of unknown type.");
-		}
-		return result;
-	}
+    /**
+     * SubjectAltName ::= GeneralNames
+     *
+     * GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
+     *
+     * GeneralName ::= CHOICE {
+     * otherName                       [0]     OtherName,
+     * rfc822Name                      [1]     IA5String,
+     * dNSName                         [2]     IA5String,
+     * x400Address                     [3]     ORAddress,
+     * directoryName                   [4]     Name,
+     * ediPartyName                    [5]     EDIPartyName,
+     * uniformResourceIdentifier       [6]     IA5String,
+     * iPAddress                       [7]     OCTET STRING,
+     * registeredID                    [8]     OBJECT IDENTIFIER}
+     * 
+     * SubjectAltName is of form \"rfc822Name=<email>,
+     * dNSName=<host name>, uniformResourceIdentifier=<http://host.com/>,
+     * iPAddress=<address>, guid=<globally unique id>
+     * 
+     * Supported altNames are upn, rfc822Name, uniformResourceIdentifier, dNSName, iPAddress, 
+     *
+     * @author Marco Ferrante, (c) 2005 CSITA - University of Genoa (Italy)
+     * @author Tomas Gustavsson
+     * @param certificate containing alt names
+     * @return String containing altNames of form "rfc822Name=email, dNSName=hostname, uniformResourceIdentifier=uri, iPAddress=ip, upn=upn" or null if no altNames exist. Values in returned String is from CertTools constants. AltNames not supported are simply not shown in the resulting string.  
+     * @throws java.lang.Exception
+     */
+    public static String getSubjectAlternativeName(X509Certificate certificate) throws Exception {
+        log.debug("Search for SubjectAltName");
+        if (certificate.getSubjectAlternativeNames() == null)
+            return null;
+        
+        java.util.Collection altNames = certificate.getSubjectAlternativeNames();
+        if (altNames == null) {
+            return null;
+        }
+        Iterator iter = altNames.iterator();
+        String result = "";
+        String append = "";
+        while (iter.hasNext()) {
+            java.util.List item = (java.util.List)iter.next();
+            Integer type = (Integer)item.get(0);
+            Object value = item.get(1);
+            if (!StringUtils.isEmpty(result)) {
+                // Result already contains one altname, so we have to add comma if there are more altNames
+                append = ", ";
+            }
+            switch (type.intValue()) {
+                case 0: ASN1Sequence seq = getAltnameSequence(item);
+                    String upn = getUPNStringFromSequence(seq);
+                    // OtherName can be something else besides UPN
+                    if (upn != null) {
+                        result += append + CertTools.UPN+"="+upn;                        
+                    }
+                    break;
+                case 1: result += append + CertTools.EMAIL+"=" + (String)value;
+                    break;
+                case 2: result += append + CertTools.DNS+"=" + (String)value;
+                    break;
+                case 3: // SubjectAltName of type x400Address not supported
+                    break;
+                case 4: // SubjectAltName of type directoryName not supported
+                    break;
+                case 5: // SubjectAltName of type ediPartyName not supported
+                    break;
+                case 6: result += append + CertTools.URI+"=" + (String)value;
+                    break;
+                case 7: result += append + CertTools.IPADDR+"=" + (String)value;
+                    break;
+                default: // SubjectAltName of unknown type
+                    break;
+            }
+        }
+        if (StringUtils.isEmpty(result)) {
+            return null;
+        }
+        return result;            
+    }
 
 	/**
 	 * Search for e-mail address, first in SubjectAltName (as in PKIX
@@ -940,7 +1003,7 @@
 			// Create CertPath
 			certlist.add(certificate);
 			// Add other certs...			
-			CertificateFactory cf = CertificateFactory.getInstance("X.509");
+			CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
 			java.security.cert.CertPath cp = cf.generateCertPath(certlist);
 			// Create TrustAnchor. Since EJBCA use BouncyCastle provider, we assume
 			// certificate already in correct order
@@ -951,7 +1014,7 @@
 			java.security.cert.PKIXParameters params = new java.security.cert.PKIXParameters(java.util.Collections.singleton(anchor));
 			params.setRevocationEnabled(false);
 			java.security.cert.CertPathValidator cpv = java.security.cert.
-			CertPathValidator.getInstance("PKIX");
+			CertPathValidator.getInstance("PKIX", "BC");
 			java.security.cert.PKIXCertPathValidatorResult result =
 				(java.security.cert.PKIXCertPathValidatorResult) cpv.validate(cp, params);
 			log.debug("Certificate verify result: " + result.toString());
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/util/StringTools.java ./src/java/se/anatom/ejbca/util/StringTools.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/util/StringTools.java	Mon Jun 20 09:47:56 2005
+++ ./src/java/se/anatom/ejbca/util/StringTools.java	Thu Aug 18 09:32:40 2005
@@ -21,19 +21,19 @@
 /**
  * This class implements some utility functions that are useful when handling Strings.
  *
- * @version $Id: StringTools.java,v 1.24 2005/06/20 07:47:56 anatom Exp $
+ * @version $Id: StringTools.java,v 1.24.2.1 2005/08/18 07:32:40 anatom Exp $
  */
 public class StringTools {
     private static Logger log = Logger.getLogger(StringTools.class);
 
     // Characters that are not allowed in strings that may be stored in the db
     private static final char[] stripChars = {
-        '\"', '\n', '\r', '/', '\\', ';', '&', '|', '!', '\0', '%', '`', '<', '>', '?',
+        '\"', '\n', '\r', '\\', ';', '&', '|', '!', '\0', '%', '`', '<', '>', '?',
         '$', ':', '~'
     };
     // Characters that are not allowed in strings that may be used in db queries
     private static final char[] stripSqlChars = {
-        '\'', '\"', '\n', '\r', '/', '\\', ';', '&', '|', '!', '\0', '%', '`', '<', '>', '?',
+        '\'', '\"', '\n', '\r', '\\', ';', '&', '|', '!', '\0', '%', '`', '<', '>', '?',
         '$', ':', '~'
     };
     // Characters that are allowed to escape in strings
@@ -62,7 +62,7 @@
                     // If it is an escaped char, allow it if it is an allowed escapechar
                     int index = ret.indexOf('\\');
                     while (index > -1) {
-                    	if (isAllowed(ret.charAt(index+1))) {
+                    	if (!isAllowed(ret.charAt(index+1))) {
                             ret = StringUtils.overlay(ret,"/",index,index+1);
                         }
                         index = ret.indexOf('\\',index+1);
diff -urN ../../31/ejbca/src/java/se/anatom/ejbca/util/query/IllegalQueryException.java ./src/java/se/anatom/ejbca/util/query/IllegalQueryException.java
--- ../../31/ejbca/src/java/se/anatom/ejbca/util/query/IllegalQueryException.java	Fri Apr 16 09:39:01 2004
+++ ./src/java/se/anatom/ejbca/util/query/IllegalQueryException.java	Fri Apr 16 09:39:01 2004
@@ -17,7 +17,7 @@
  * An exception thrown if Query strucure is illegal.
  *
  * @author Philip Vendil
- * @version $Id$
+ * @version $Id: IllegalQueryException.java,v 1.3 2004/04/16 07:39:01 anatom Exp $
  */
 public class IllegalQueryException extends java.lang.Exception {
     /**
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/ca/sign/TestSignSession.java ./src/test/se/anatom/ejbca/ca/sign/TestSignSession.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/ca/sign/TestSignSession.java	Fri Apr 29 11:16:08 2005
+++ ./src/test/se/anatom/ejbca/ca/sign/TestSignSession.java	Tue Aug  2 13:38:10 2005
@@ -19,6 +19,7 @@
 import java.security.KeyPairGenerator;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPrivateKey;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Iterator;
@@ -43,6 +44,9 @@
 import se.anatom.ejbca.ra.IUserAdminSessionHome;
 import se.anatom.ejbca.ra.IUserAdminSessionRemote;
 import se.anatom.ejbca.ra.UserDataConstants;
+import se.anatom.ejbca.ra.raadmin.EndEntityProfile;
+import se.anatom.ejbca.ra.raadmin.IRaAdminSessionHome;
+import se.anatom.ejbca.ra.raadmin.IRaAdminSessionRemote;
 import se.anatom.ejbca.util.Base64;
 import se.anatom.ejbca.util.CertTools;
 
@@ -50,7 +54,7 @@
 /**
  * Tests signing session.
  *
- * @version $Id: TestSignSession.java,v 1.6 2005/04/29 09:16:08 anatom Exp $
+ * @version $Id: TestSignSession.java,v 1.6.2.1 2005/08/02 11:38:10 anatom Exp $
  */
 public class TestSignSession extends TestCase {
     static byte[] keytoolp10 = Base64.decode(("MIIBbDCB1gIBADAtMQ0wCwYDVQQDEwRUZXN0MQ8wDQYDVQQKEwZBbmFUb20xCzAJBgNVBAYTAlNF" +
@@ -125,6 +129,7 @@
     private static ISignSessionHome home;
     private static ISignSessionRemote remote;
     private static IUserAdminSessionRemote usersession;
+    private static IRaAdminSessionRemote rasession;
     private static KeyPair keys;
     private static int caid = 0;
     private Admin admin;
@@ -165,6 +170,10 @@
         IUserAdminSessionHome userhome = (IUserAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, IUserAdminSessionHome.class);
         usersession = userhome.create();
 
+        obj = ctx.lookup("RaAdminSession");
+        IRaAdminSessionHome rahome = (IRaAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, IRaAdminSessionHome.class);
+        rasession = rahome.create();
+
         log.debug("<setUp()");
     }
 
@@ -445,12 +454,75 @@
         log.debug("<test08SwedeChars()");
     }
 
+    /** Tests multiple instances of one altName
+     * 
+     */
+    public void test09TestMultipleAltNames() throws Exception {
+        log.debug(">test09TestMultipleAltNames()");
+
+        // Create a good end entity profile (good enough), allowing multiple UPN names
+        rasession.removeEndEntityProfile(admin, "TESTMULALTNAME");
+        EndEntityProfile profile = new EndEntityProfile();
+        profile.addField(EndEntityProfile.ORGANIZATION);
+        profile.addField(EndEntityProfile.COUNTRY);
+        profile.addField(EndEntityProfile.COMMONNAME);
+        profile.addField(EndEntityProfile.UNIFORMRESOURCEID);
+        profile.addField(EndEntityProfile.DNSNAME);
+        profile.addField(EndEntityProfile.DNSNAME);
+        profile.addField(EndEntityProfile.RFC822NAME);
+        profile.addField(EndEntityProfile.IPADDRESS);
+        profile.addField(EndEntityProfile.UPN);
+        profile.addField(EndEntityProfile.UPN);
+        profile.setValue(EndEntityProfile.AVAILCAS,0, Integer.toString(SecConst.ALLCAS));
+        rasession.addEndEntityProfile(admin, "TESTMULALTNAME", profile);
+        int eeprofile = rasession.getEndEntityProfileId(admin, "TESTMULALTNAME");
+        try {
+            // Change a user that we know...
+            usersession.changeUser(admin, "foo", "foo123", "C=SE,O=AnaTom,CN=foo",
+                    "uniformResourceIdentifier=http://www.a.se/,upn=foo@a.se,upn=foo@b.se,rfc822name=tomas@a.se,dNSName=www.a.se,dNSName=www.b.se,iPAddress=10.1.1.1",
+                    "foo@anatom.se", false,
+                    eeprofile,
+                    SecConst.CERTPROFILE_FIXED_ENDUSER,
+                    SecConst.USER_ENDUSER,
+                    SecConst.TOKEN_SOFT_PEM, 0, UserDataConstants.STATUS_NEW, caid);
+            log.debug("created user: foo, foo123, C=SE, O=AnaTom, CN=foo");
+        } catch (RemoteException re) {
+            assertTrue("User foo does not exist, or error changing user", false);
+        } 
+        X509Certificate cert = (X509Certificate) remote.createCertificate(admin, "foo", "foo123", keys.getPublic());
+        assertNotNull("Failed to create certificate", cert);
+        //FileOutputStream fos = new FileOutputStream("cert.crt");
+        //fos.write(cert.getEncoded());
+        //fos.close();
+        String altNames = CertTools.getSubjectAlternativeName(cert);
+        log.debug(altNames);
+        ArrayList list = CertTools.getPartsFromDN(altNames,CertTools.UPN);
+        assertEquals(2, list.size());
+        assertTrue(list.contains("foo@a.se"));
+        assertTrue(list.contains("foo@b.se"));
+        String name = CertTools.getPartFromDN(altNames,CertTools.URI);
+        assertEquals("http://www.a.se/", name);
+        name = CertTools.getPartFromDN(altNames,CertTools.EMAIL);
+        assertEquals("tomas@a.se", name);
+        list = CertTools.getPartsFromDN(altNames,CertTools.DNS);
+        assertEquals(2, list.size());
+        assertTrue(list.contains("www.a.se"));
+        assertTrue(list.contains("www.b.se"));
+        name = CertTools.getPartFromDN(altNames,CertTools.IPADDR);
+        assertEquals("10.1.1.1", name);
+
+        // Clean up
+        rasession.removeEndEntityProfile(admin, "TESTMULALTNAME");
+
+        log.debug("<test09TestMultipleAltNames()");        
+    }
+    
     /**
      * Tests scep message
      */
 /*
-    public void test09TestOpenScep() throws Exception {
-        log.debug(">test09TestOpenScep()");
+    public void test10TestOpenScep() throws Exception {
+        log.debug(">test10TestOpenScep()");
         UserDataPK pk = new UserDataPK("foo");
         UserDataRemote data = userhome.findByPrimaryKey(pk);
         data.setStatus(UserDataRemote.STATUS_NEW);
@@ -460,7 +532,7 @@
         byte[] msg = resp.getResponseMessage();
         log.debug("Message: "+new String(Base64.encode(msg,true)));
         assertNotNull("Failed to get encoded response message", msg);
-        log.debug("<test09TestOpenScep()");
+        log.debug("<test10TestOpenScep()");
     }
 */
 }
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ProtocolHttpTest.java ./src/test/se/anatom/ejbca/protocol/ProtocolHttpTest.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ProtocolHttpTest.java	Tue May 31 13:48:22 2005
+++ ./src/test/se/anatom/ejbca/protocol/ProtocolHttpTest.java	Thu Jan  1 01:00:00 1970
@@ -1,445 +0,0 @@
-/*************************************************************************
- *                                                                       *
- *  EJBCA: The OpenSource Certificate Authority                          *
- *                                                                       *
- *  This software is free software; you can redistribute it and/or       *
- *  modify it under the terms of the GNU Lesser General Public           *
- *  License as published by the Free Software Foundation; either         *
- *  version 2.1 of the License, or any later version.                    *
- *                                                                       *
- *  See terms of license at gnu.org.                                     *
- *                                                                       *
- *************************************************************************/
-
-package se.anatom.ejbca.protocol;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.math.BigInteger;
-import java.net.HttpURLConnection;
-import java.net.URL;
-import java.rmi.RemoteException;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.NoSuchProviderException;
-import java.security.cert.X509Certificate;
-import java.security.interfaces.RSAPrivateKey;
-import java.util.Collection;
-import java.util.Iterator;
-
-import javax.ejb.DuplicateKeyException;
-import javax.naming.Context;
-import javax.naming.NamingException;
-
-import junit.framework.TestCase;
-import junit.framework.TestSuite;
-
-import org.apache.log4j.Logger;
-import org.bouncycastle.ocsp.BasicOCSPResp;
-import org.bouncycastle.ocsp.CertificateID;
-import org.bouncycastle.ocsp.OCSPException;
-import org.bouncycastle.ocsp.OCSPReq;
-import org.bouncycastle.ocsp.OCSPReqGenerator;
-import org.bouncycastle.ocsp.OCSPResp;
-import org.bouncycastle.ocsp.RevokedStatus;
-import org.bouncycastle.ocsp.SingleResp;
-import org.bouncycastle.ocsp.UnknownStatus;
-
-import se.anatom.ejbca.SecConst;
-import se.anatom.ejbca.ca.caadmin.CAInfo;
-import se.anatom.ejbca.ca.caadmin.ICAAdminSessionHome;
-import se.anatom.ejbca.ca.caadmin.ICAAdminSessionRemote;
-import se.anatom.ejbca.ca.crl.RevokedCertInfo;
-import se.anatom.ejbca.ca.sign.ISignSessionHome;
-import se.anatom.ejbca.ca.sign.ISignSessionRemote;
-import se.anatom.ejbca.ca.store.CertificateDataPK;
-import se.anatom.ejbca.ca.store.ICertificateStoreSessionHome;
-import se.anatom.ejbca.ca.store.ICertificateStoreSessionRemote;
-import se.anatom.ejbca.log.Admin;
-import se.anatom.ejbca.ra.IUserAdminSessionHome;
-import se.anatom.ejbca.ra.IUserAdminSessionRemote;
-import se.anatom.ejbca.ra.UserDataConstants;
-import se.anatom.ejbca.util.Base64;
-import se.anatom.ejbca.util.CertTools;
-
-import com.meterware.httpunit.GetMethodWebRequest;
-import com.meterware.httpunit.HttpUnitOptions;
-import com.meterware.httpunit.WebConversation;
-import com.meterware.httpunit.WebRequest;
-import com.meterware.httpunit.WebResponse;
-
-/** Tests http pages of ocsp and scep
- **/
-public class ProtocolHttpTest extends TestCase {
-    private static Logger log = Logger.getLogger(TestMessages.class);
-
-    private static final String httpReqPath = "http://127.0.0.1:8080/ejbca";
-    private static final String resourceOcsp = "publicweb/status/ocsp";
-    private static final String resourceScep = "publicweb/apply/scep/pkiclient.exe";
-
-    static byte[] openscep = Base64.decode(("MIIGqwYJKoZIhvcNAQcCoIIGnDCCBpgCAQExDjAMBggqhkiG9w0CBQUAMIICuwYJ" +
-            "KoZIhvcNAQcBoIICrASCAqgwggKkBgkqhkiG9w0BBwOgggKVMIICkQIBADGB1TCB" +
-            "0gIBADA7MC8xDzANBgNVBAMTBlRlc3RDQTEPMA0GA1UEChMGQW5hVG9tMQswCQYD" +
-            "VQQGEwJTRQIIbzEhUVZYO3gwDQYJKoZIhvcNAQEBBQAEgYCksIoSXYsCQPot2DDW" +
-            "dexdFqLj1Fuz3xSpu/rLozXKxEY0n0W0JXRR9OxxuyqNw9cLZhiyWkNsJGbP/rEz" +
-            "yrXe9NXuLK5U8+qqE8OhnY9BhCxjeUJSLni6oCSi7YzwOqdg2KmifJrQQI/jZIiC" +
-            "tSISAtE6qi6DKQwLCkQLmokLrjCCAbIGCSqGSIb3DQEHATARBgUrDgMCBwQILYvZ" +
-            "rBWuC02AggGQW9o5MB/7LN4o9G4ZD1l2mHzS+g+Y/dT2qD/qIaQi1Mamv2oKx9eO" +
-            "uFtaGkBBGWZlIKg4mm/DFtvXqW8Y5ijAiQVHHPuRKNyIV6WVuFjNjhNlM+DWLJR+" +
-            "rpHEhvB6XeDo/pd+TyOKFcxedMPTD7U+j46yd46vKdmoKAiIF21R888uVSz3GDts" +
-            "NlqgvZ7VlaI++Tj7aPdOI7JTdQXZk2FWF7Ql0LBIPwk9keffptF5if5Y+aHqB0a2" +
-            "uQj1aE8Em15VG8p8MmLJOX0OA1aeqfxR0wk343r44UebliY2DE8cEnym/fmya30/" +
-            "7WYzJ7erWofO2ukg1yc93wUpyIKxt2RGIy5geqQCjCYSSGgaNFafEV2pnOVSx+7N" +
-            "9z/ICNQfDBD6b83MO7yPHC1cXcdREKHHeqaKyQLiVRk9+R/3D4vEZt682GRaUKOY" +
-            "PQXK1Be2nyZoo4gZs62nZVAliJ+chFkEUog9k9OsIvZRG7X+VEjVYBqxlE1S3ikt" +
-            "igFXiuLC/LDCi3IgVwQjfNx1/mhxsO7GSaCCAfswggH3MIIBYKADAgEDAiA4OEUy" +
-            "REVFNDcwNjhCQjM3RjE5QkE2NDdCRjAyRkQwRjANBgkqhkiG9w0BAQQFADAyMQsw" +
-            "CQYDVQQGEwJTZTERMA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcw" +
-            "HhcNMDMwNjAxMDgzNDQyWhcNMDMwNzAxMDgzNDQyWjAyMQswCQYDVQQGEwJTZTER" +
-            "MA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcwgZ8wDQYJKoZIhvcN" +
-            "AQEBBQADgY0AMIGJAoGBAOu47fpIQfzfSnEBTG2WJpKZz1891YLNulc7XgMk8hl3" +
-            "nVC4m34SaR7eXR3nCsorYEpPPmL3affaPFsBnNBQNoZLxKmQ1RKiDyu8dj90AKCP" +
-            "CFlIM2aJbKMiQad+dt45qse6k0yTrY3Yx0hMH76tRkDif4DjM5JUvdf4d/zlYcCz" +
-            "AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAGNoWI02kXNEA5sPHb3KEY8QZoYM5Kha1" +
-            "JA7HLmlXKy6geeJmk329CUnvF0Cr7zxbMkFRdUDUtR8omDDnGlBSOCkV6LLYH939" +
-            "Z8iysfaxigZkxUqUYGLtYHhsEjVgcpfKZVxTz0E2ocR2P+IuU04Duel/gU4My6Qv" +
-            "LDpwo1CQC10xggHDMIIBvwIBATBWMDIxCzAJBgNVBAYTAlNlMREwDwYDVQQKEwhQ" +
-            "cmltZUtleTEQMA4GA1UEAxMHVG9tYXMgRwIgODhFMkRFRTQ3MDY4QkIzN0YxOUJB" +
-            "NjQ3QkYwMkZEMEYwDAYIKoZIhvcNAgUFAKCBwTASBgpghkgBhvhFAQkCMQQTAjE5" +
-            "MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAzMDYw" +
-            "MTA4MzQ0MlowHwYJKoZIhvcNAQkEMRIEEBqGJFo7n4B8sFBCi54PckIwIAYKYIZI" +
-            "AYb4RQEJBTESBBA77Owxh2rbflhXsDYw3xsLMDAGCmCGSAGG+EUBCQcxIhMgODhF" +
-            "MkRFRTQ3MDY4QkIzN0YxOUJBNjQ3QkYwMkZEMEYwDQYJKoZIhvcNAQEBBQAEgYB4" +
-            "BPcw4NPIt4nMOFKSGg5oM1nGDPGFN7eorZV+/2uWiQfdtK4B4lzCTuNxWRT853dW" +
-            "dRDzXBCGEArlG8ef+vDD/HP9SX3MQ0NJWym48VI9bTpP/mJlUKSsfgDYHohvUlVI" +
-            "E5QFC6ILVLUmuWPGchUEAb8t30DDnmeXs8QxdqHfbQ==").getBytes());
-
-    static byte[] unknowncacertBytes = Base64.decode(("MIICLDCCAZWgAwIBAgIIbzEhUVZYO3gwDQYJKoZIhvcNAQEFBQAwLzEPMA0GA1UE" +
-            "AxMGVGVzdENBMQ8wDQYDVQQKEwZBbmFUb20xCzAJBgNVBAYTAlNFMB4XDTAyMDcw" +
-            "OTEyNDc1OFoXDTA0MDgxNTEyNTc1OFowLzEPMA0GA1UEAxMGVGVzdENBMQ8wDQYD" +
-            "VQQKEwZBbmFUb20xCzAJBgNVBAYTAlNFMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCB" +
-            "hwKBgQDZlACHRwJnQKlgpMqlZQmxvCrJPpPFyhxvjDHlryhp/AQ6GCm+IkGUVlwL" +
-            "sCnjgZH5BXDNaVXpkmME8334HFsxVlXqmZ2GqyP6kptMjbWZ2SRLBRKjAcI7EJIN" +
-            "FPDIep9ZHXw1JDjFGoJ4TLFd99w9rQ3cB6zixORoyCZMw+iebwIBEaNTMFEwDwYD" +
-            "VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUY3v0dqhUJI6ldKV3RKb0Xg9XklEwHwYD" +
-            "VR0jBBgwFoAUY3v0dqhUJI6ldKV3RKb0Xg9XklEwDQYJKoZIhvcNAQEFBQADgYEA" +
-            "i1P53jnSPLkyqm7i3nLNi+hG7rMgF+kRi6ZLKhzIPyKcAWV8iZCI8xl/GurbZ8zd" +
-            "nTiIOfQIP9eD/nhIIo7n4JOaTUeqgyafPsEgKdTiZfSdXjvy6rj5GiZ3DaGZ9SNK" +
-            "FgrCpX5kBKVbbQLO6TjJKCjX29CfoJ2TbP1QQ6UbBAY=").getBytes());
-
-    private static Context ctx;
-    private static ISignSessionHome home;
-    private static ISignSessionRemote remote;
-    private ICertificateStoreSessionHome storehome;
-    private static IUserAdminSessionRemote usersession;
-    private static int caid = 0;
-    private static Admin admin;
-    private static X509Certificate cacert = null;
-    private static X509Certificate ocspTestCert = null;
-    private static X509Certificate unknowncacert = null;
-
-    public static void main(String args[]) {
-        junit.textui.TestRunner.run(suite());
-    }
-
-
-    public static TestSuite suite() {
-        return new TestSuite(ProtocolHttpTest.class);
-    }
-
-
-    public ProtocolHttpTest(String name) {
-        super(name);
-    }
-
-    protected void setUp() throws Exception {
-        log.debug(">setUp()");
-
-        // Install BouncyCastle provider
-        CertTools.installBCProvider();
-
-        // We want to get error responses without exceptions
-        HttpUnitOptions.setExceptionsThrownOnErrorStatus(false);
-
-        admin = new Admin(Admin.TYPE_BATCHCOMMANDLINE_USER);
-
-        ctx = getInitialContext();
-        Object obj = ctx.lookup("CAAdminSession");
-        ICAAdminSessionHome cahome = (ICAAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, ICAAdminSessionHome.class);
-        ICAAdminSessionRemote casession = cahome.create();
-        Collection caids = casession.getAvailableCAs(admin);
-        Iterator iter = caids.iterator();
-        if (iter.hasNext()) {
-            caid = ((Integer) iter.next()).intValue();
-        } else {
-            assertTrue("No active CA! Must have at least one active CA to run tests!", false);
-        }
-        CAInfo cainfo = casession.getCAInfo(admin, caid);
-        Collection certs = cainfo.getCertificateChain();
-        if (certs.size() > 0) {
-            Iterator certiter = certs.iterator();
-            cacert = (X509Certificate) certiter.next();
-        } else {
-            log.error("NO CACERT for caid " + caid);
-        }
-        obj = ctx.lookup("RSASignSession");
-        home = (ISignSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, ISignSessionHome.class);
-        remote = home.create();
-        Object obj2 = ctx.lookup("CertificateStoreSession");
-        storehome = (ICertificateStoreSessionHome) javax.rmi.PortableRemoteObject.narrow(obj2, ICertificateStoreSessionHome.class);
-        obj = ctx.lookup("UserAdminSession");
-        IUserAdminSessionHome userhome = (IUserAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, IUserAdminSessionHome.class);
-        usersession = userhome.create();
-
-        unknowncacert = CertTools.getCertfromByteArray(unknowncacertBytes);
-        log.debug("<setUp()");
-    }
-
-    protected void tearDown() throws Exception {
-    }
-
-    private Context getInitialContext() throws NamingException {
-        log.debug(">getInitialContext");
-        Context ctx = new javax.naming.InitialContext();
-        log.debug("<getInitialContext");
-        return ctx;
-    }
-
-    /**
-     * Generates a RSA key pair.
-     *
-     * @return KeyPair the generated key pair
-     *
-     * @throws Exception if en error occurs...
-     */
-    private static KeyPair genKeys() throws Exception {
-        KeyPairGenerator keygen = KeyPairGenerator.getInstance("RSA", "BC");
-        keygen.initialize(512);
-        log.debug("Generating keys, please wait...");
-        KeyPair rsaKeys = keygen.generateKeyPair();
-        log.debug("Generated " + rsaKeys.getPrivate().getAlgorithm() + " keys with length" +
-                ((RSAPrivateKey) rsaKeys.getPrivate()).getModulus().bitLength());
-        return rsaKeys;
-    } // genKeys
-
-
-    public void test01Access() throws Exception {
-
-        WebConversation wc = new WebConversation();
-
-        // Hit with GET gives a 405 with OCSP: BAD_METHOD
-        WebRequest request = new GetMethodWebRequest(httpReqPath + '/' + resourceOcsp);
-        WebResponse response = wc.getResponse(request);
-        assertEquals("Response code", 405, response.getResponseCode());
-        // Hit scep, gives a 400: Bad Request
-        request = new GetMethodWebRequest(httpReqPath + '/' + resourceScep);
-        response = wc.getResponse(request);
-        assertEquals("Response code", 400, response.getResponseCode());
-    }
-
-    /** Tests scep message from OpenScep
-     * Prerequisites for running the tests is to have a CA setup with
-     * issuerDN: CN=TestCA,O=AnaTom,C=SE.
-     * @throws Exception error
-     */
-    public void test02OpenScep() throws Exception {
-        log.debug(">test02OpenScep()");
-        // send message to server and see what happens
-        WebConversation wc = new WebConversation();
-        WebRequest request = new GetMethodWebRequest(httpReqPath + '/' + resourceScep);
-        request.setParameter("operation", "PKIOperation");
-        request.setParameter("message", new String(Base64.encode(openscep)));
-        WebResponse response = wc.getResponse(request);
-        // TODO: since our request most certainly uses the wrong CA cert to encrypt the
-        // request, it will fail. If we get something back, we came a little bit at least :)
-        // We should get a NOT_FOUND error back.
-        assertEquals("Response code", 404, response.getResponseCode());
-        // TODO: send crap message and get good error
-
-        log.debug("<test02OpenScep()");
-    }
-
-
-    private SingleResp sendOCSPPost(byte[] ocspPackage) throws IOException, OCSPException, NoSuchProviderException {
-        // POST the OCSP request
-        URL url = new URL(httpReqPath + '/' + resourceOcsp);
-        HttpURLConnection con = (HttpURLConnection)url.openConnection();
-        // we are going to do a POST
-        con.setDoOutput(true);
-        con.setRequestMethod("POST");
-
-        // POST it
-        con.setRequestProperty("Content-Type", "application/ocsp-request");
-        OutputStream os = con.getOutputStream();
-        os.write(ocspPackage);
-        os.close();
-        assertEquals("Response code", 200, con.getResponseCode());
-        assertEquals("Content-Type", "application/ocsp-response", con.getContentType());
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        // This works for small requests, and OCSP requests are small
-        InputStream in = con.getInputStream();
-        int b = in.read();
-        while (b != -1) {
-            baos.write(b);
-            b = in.read();
-        }
-        baos.flush();
-        in.close();
-        byte[] respBytes = baos.toByteArray();
-        OCSPResp response = new OCSPResp(new ByteArrayInputStream(respBytes));
-        assertEquals("Response status not zero.", response.getStatus(), 0);
-        BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
-        X509Certificate[] chain = brep.getCerts("BC");
-        boolean verify = brep.verify(chain[0].getPublicKey(), "BC");
-        assertTrue("Response failed to verify.", verify);
-        SingleResp[] singleResps = brep.getResponses();
-        assertEquals("No of SingResps shoudl be 1.", singleResps.length, 1);
-        SingleResp singleResp = singleResps[0];
-        return singleResp;
-    }
-    /** Tests ocsp message
-     * @throws Exception error
-     */
-    public void test03OcspGood() throws Exception {
-        log.debug(">test03OcspGood()");
-
-        // find a CA (TestCA?) create a user and generate his cert
-        // send OCSP req to server and get good response
-        // change status of cert to bad status
-        // send OCSP req and get bad status
-        // (send crap message and get good error)
-
-        // Make user that we know...
-        boolean userExists = false;
-        try {
-            usersession.addUser(admin,"ocsptest","foo123","C=SE,O=AnaTom,CN=OCSPTest",null,"ocsptest@anatom.se",false,SecConst.EMPTY_ENDENTITYPROFILE,SecConst.CERTPROFILE_FIXED_ENDUSER,SecConst.USER_ENDUSER,SecConst.TOKEN_SOFT_PEM,0,caid);
-            log.debug("created user: ocsptest, foo123, C=SE, O=AnaTom, CN=OCSPTest");
-        } catch (RemoteException re) {
-            if (re.detail instanceof DuplicateKeyException) {
-                userExists = true;
-            }
-        } catch (DuplicateKeyException dke) {
-            userExists = true;
-        }
-
-        if (userExists) {
-            log.debug("User ocsptest already exists.");
-            usersession.setUserStatus(admin,"ocsptest",UserDataConstants.STATUS_NEW);
-            log.debug("Reset status to NEW");
-        }
-        // Generate certificate for the new user
-        KeyPair keys = genKeys();
-
-        // user that we know exists...
-        ocspTestCert = (X509Certificate) remote.createCertificate(admin, "ocsptest", "foo123", keys.getPublic());
-        assertNotNull("Misslyckades skapa cert", ocspTestCert);
-
-        // And an OCSP request
-        OCSPReqGenerator gen = new OCSPReqGenerator();
-        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, cacert, ocspTestCert.getSerialNumber()));
-        OCSPReq req = gen.generate();
-
-        // Send the request and receive a singleResponse
-        SingleResp singleResp = sendOCSPPost(req.getEncoded());
-        
-        CertificateID certId = singleResp.getCertID();
-        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), ocspTestCert.getSerialNumber());
-        Object status = singleResp.getCertStatus();
-        assertEquals("Status is not null (good)", status, null);
-        log.debug("<test03OcspGood()");
-    }
-
-    /** Tests ocsp message
-     * @throws Exception error
-     */
-    public void test04OcspRevoked() throws Exception {
-        log.debug(">test04OcspRevoked()");
-        // Now revoke the certificate and try again
-        CertificateDataPK pk = new CertificateDataPK();
-        pk.fingerprint = CertTools.getFingerprintAsString(ocspTestCert);
-        ICertificateStoreSessionRemote store = storehome.create();
-        store.revokeCertificate(admin, ocspTestCert,null,RevokedCertInfo.REVOKATION_REASON_KEYCOMPROMISE);
-        // And an OCSP request
-        OCSPReqGenerator gen = new OCSPReqGenerator();
-        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, cacert, ocspTestCert.getSerialNumber()));
-        OCSPReq req = gen.generate();
-
-        // Send the request and receive a singleResponse
-        SingleResp singleResp = sendOCSPPost(req.getEncoded());
-
-        CertificateID certId = singleResp.getCertID();
-        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), ocspTestCert.getSerialNumber());
-        Object status = singleResp.getCertStatus();
-        assertTrue("Status is not RevokedStatus", status instanceof RevokedStatus);
-        RevokedStatus rev = (RevokedStatus) status;
-        assertTrue("Status does not have reason", rev.hasRevocationReason());
-        int reason = rev.getRevocationReason();
-        assertEquals("Wrong revocation reason", reason, RevokedCertInfo.REVOKATION_REASON_KEYCOMPROMISE);
-        log.debug("<test04OcspRevoked()");
-    }
-
-    /** Tests ocsp message
-     * @throws Exception error
-     */
-    public void test05OcspUnknown() throws Exception {
-        log.debug(">test05OcspUnknown()");
-        // An OCSP request for an unknown certificate (not exist in db)
-        OCSPReqGenerator gen = new OCSPReqGenerator();
-        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, cacert, new BigInteger("1")));
-        OCSPReq req = gen.generate();
-        
-        // Send the request and receive a singleResponse
-        SingleResp singleResp = sendOCSPPost(req.getEncoded());
-
-        CertificateID certId = singleResp.getCertID();
-        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), new BigInteger("1"));
-        Object status = singleResp.getCertStatus();
-        assertTrue("Status is not Unknown", status instanceof UnknownStatus);
-
-        log.debug("<test05OcspUnknown()");
-    }
-
-    /** Tests ocsp message
-     * @throws Exception error
-     */
-    public void test06OcspUnknownCA() throws Exception {
-        log.debug(">test06OcspUnknownCA()");
-        // An OCSP request for a certificate from an unknwon CA
-        OCSPReqGenerator gen = new OCSPReqGenerator();
-        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, unknowncacert, new BigInteger("1")));
-        OCSPReq req = gen.generate();
-        
-        // Send the request and receive a singleResponse
-        SingleResp singleResp = sendOCSPPost(req.getEncoded());
-
-        CertificateID certId = singleResp.getCertID();
-        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), new BigInteger("1"));
-        Object status = singleResp.getCertStatus();
-        assertTrue("Status is not Unknown", status instanceof UnknownStatus);
-
-        log.debug("<test06OcspUnknownCA()");
-    }
-    
-    public void test07OcspSendWrongContentType() throws Exception {
-        // An OCSP request for a certificate from an unknwon CA
-        OCSPReqGenerator gen = new OCSPReqGenerator();
-        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, unknowncacert, new BigInteger("1")));
-        OCSPReq req = gen.generate();
-        // POST the OCSP request
-        URL url = new URL(httpReqPath + '/' + resourceOcsp);
-        HttpURLConnection con = (HttpURLConnection)url.openConnection();
-        // we are going to do a POST
-        con.setDoOutput(true);
-        con.setRequestMethod("POST");
-        // POST it, but don't add content type
-        OutputStream os = con.getOutputStream();
-        os.write(req.getEncoded());
-        os.close();
-        assertEquals("Response code", 400, con.getResponseCode());
-        
-    }
-
-}
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ProtocolOcspHttpTest.java ./src/test/se/anatom/ejbca/protocol/ProtocolOcspHttpTest.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ProtocolOcspHttpTest.java	Thu Jan  1 01:00:00 1970
+++ ./src/test/se/anatom/ejbca/protocol/ProtocolOcspHttpTest.java	Thu Aug 18 11:43:27 2005
@@ -0,0 +1,423 @@
+/*************************************************************************
+ *                                                                       *
+ *  EJBCA: The OpenSource Certificate Authority                          *
+ *                                                                       *
+ *  This software is free software; you can redistribute it and/or       *
+ *  modify it under the terms of the GNU Lesser General Public           *
+ *  License as published by the Free Software Foundation; either         *
+ *  version 2.1 of the License, or any later version.                    *
+ *                                                                       *
+ *  See terms of license at gnu.org.                                     *
+ *                                                                       *
+ *************************************************************************/
+
+package se.anatom.ejbca.protocol;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.math.BigInteger;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.rmi.RemoteException;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchProviderException;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPrivateKey;
+import java.util.Collection;
+import java.util.Iterator;
+
+import javax.ejb.DuplicateKeyException;
+import javax.naming.Context;
+import javax.naming.NamingException;
+
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+import org.apache.log4j.Logger;
+import org.bouncycastle.ocsp.BasicOCSPResp;
+import org.bouncycastle.ocsp.CertificateID;
+import org.bouncycastle.ocsp.OCSPException;
+import org.bouncycastle.ocsp.OCSPReq;
+import org.bouncycastle.ocsp.OCSPReqGenerator;
+import org.bouncycastle.ocsp.OCSPResp;
+import org.bouncycastle.ocsp.RevokedStatus;
+import org.bouncycastle.ocsp.SingleResp;
+import org.bouncycastle.ocsp.UnknownStatus;
+
+import se.anatom.ejbca.SecConst;
+import se.anatom.ejbca.ca.caadmin.CAInfo;
+import se.anatom.ejbca.ca.caadmin.ICAAdminSessionHome;
+import se.anatom.ejbca.ca.caadmin.ICAAdminSessionRemote;
+import se.anatom.ejbca.ca.crl.RevokedCertInfo;
+import se.anatom.ejbca.ca.sign.ISignSessionHome;
+import se.anatom.ejbca.ca.sign.ISignSessionRemote;
+import se.anatom.ejbca.ca.store.CertificateDataPK;
+import se.anatom.ejbca.ca.store.ICertificateStoreSessionHome;
+import se.anatom.ejbca.ca.store.ICertificateStoreSessionRemote;
+import se.anatom.ejbca.log.Admin;
+import se.anatom.ejbca.ra.IUserAdminSessionHome;
+import se.anatom.ejbca.ra.IUserAdminSessionRemote;
+import se.anatom.ejbca.ra.UserDataConstants;
+import se.anatom.ejbca.util.Base64;
+import se.anatom.ejbca.util.CertTools;
+
+import com.meterware.httpunit.GetMethodWebRequest;
+import com.meterware.httpunit.HttpUnitOptions;
+import com.meterware.httpunit.WebConversation;
+import com.meterware.httpunit.WebRequest;
+import com.meterware.httpunit.WebResponse;
+
+/** Tests http pages of ocsp and scep
+ **/
+public class ProtocolOcspHttpTest extends TestCase {
+    private static Logger log = Logger.getLogger(TestMessages.class);
+
+    private static final String httpReqPath = "http://127.0.0.1:8080/ejbca";
+    private static final String resourceOcsp = "publicweb/status/ocsp";
+
+    static byte[] openscep = Base64.decode(("MIIGqwYJKoZIhvcNAQcCoIIGnDCCBpgCAQExDjAMBggqhkiG9w0CBQUAMIICuwYJ" +
+            "KoZIhvcNAQcBoIICrASCAqgwggKkBgkqhkiG9w0BBwOgggKVMIICkQIBADGB1TCB" +
+            "0gIBADA7MC8xDzANBgNVBAMTBlRlc3RDQTEPMA0GA1UEChMGQW5hVG9tMQswCQYD" +
+            "VQQGEwJTRQIIbzEhUVZYO3gwDQYJKoZIhvcNAQEBBQAEgYCksIoSXYsCQPot2DDW" +
+            "dexdFqLj1Fuz3xSpu/rLozXKxEY0n0W0JXRR9OxxuyqNw9cLZhiyWkNsJGbP/rEz" +
+            "yrXe9NXuLK5U8+qqE8OhnY9BhCxjeUJSLni6oCSi7YzwOqdg2KmifJrQQI/jZIiC" +
+            "tSISAtE6qi6DKQwLCkQLmokLrjCCAbIGCSqGSIb3DQEHATARBgUrDgMCBwQILYvZ" +
+            "rBWuC02AggGQW9o5MB/7LN4o9G4ZD1l2mHzS+g+Y/dT2qD/qIaQi1Mamv2oKx9eO" +
+            "uFtaGkBBGWZlIKg4mm/DFtvXqW8Y5ijAiQVHHPuRKNyIV6WVuFjNjhNlM+DWLJR+" +
+            "rpHEhvB6XeDo/pd+TyOKFcxedMPTD7U+j46yd46vKdmoKAiIF21R888uVSz3GDts" +
+            "NlqgvZ7VlaI++Tj7aPdOI7JTdQXZk2FWF7Ql0LBIPwk9keffptF5if5Y+aHqB0a2" +
+            "uQj1aE8Em15VG8p8MmLJOX0OA1aeqfxR0wk343r44UebliY2DE8cEnym/fmya30/" +
+            "7WYzJ7erWofO2ukg1yc93wUpyIKxt2RGIy5geqQCjCYSSGgaNFafEV2pnOVSx+7N" +
+            "9z/ICNQfDBD6b83MO7yPHC1cXcdREKHHeqaKyQLiVRk9+R/3D4vEZt682GRaUKOY" +
+            "PQXK1Be2nyZoo4gZs62nZVAliJ+chFkEUog9k9OsIvZRG7X+VEjVYBqxlE1S3ikt" +
+            "igFXiuLC/LDCi3IgVwQjfNx1/mhxsO7GSaCCAfswggH3MIIBYKADAgEDAiA4OEUy" +
+            "REVFNDcwNjhCQjM3RjE5QkE2NDdCRjAyRkQwRjANBgkqhkiG9w0BAQQFADAyMQsw" +
+            "CQYDVQQGEwJTZTERMA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcw" +
+            "HhcNMDMwNjAxMDgzNDQyWhcNMDMwNzAxMDgzNDQyWjAyMQswCQYDVQQGEwJTZTER" +
+            "MA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcwgZ8wDQYJKoZIhvcN" +
+            "AQEBBQADgY0AMIGJAoGBAOu47fpIQfzfSnEBTG2WJpKZz1891YLNulc7XgMk8hl3" +
+            "nVC4m34SaR7eXR3nCsorYEpPPmL3affaPFsBnNBQNoZLxKmQ1RKiDyu8dj90AKCP" +
+            "CFlIM2aJbKMiQad+dt45qse6k0yTrY3Yx0hMH76tRkDif4DjM5JUvdf4d/zlYcCz" +
+            "AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAGNoWI02kXNEA5sPHb3KEY8QZoYM5Kha1" +
+            "JA7HLmlXKy6geeJmk329CUnvF0Cr7zxbMkFRdUDUtR8omDDnGlBSOCkV6LLYH939" +
+            "Z8iysfaxigZkxUqUYGLtYHhsEjVgcpfKZVxTz0E2ocR2P+IuU04Duel/gU4My6Qv" +
+            "LDpwo1CQC10xggHDMIIBvwIBATBWMDIxCzAJBgNVBAYTAlNlMREwDwYDVQQKEwhQ" +
+            "cmltZUtleTEQMA4GA1UEAxMHVG9tYXMgRwIgODhFMkRFRTQ3MDY4QkIzN0YxOUJB" +
+            "NjQ3QkYwMkZEMEYwDAYIKoZIhvcNAgUFAKCBwTASBgpghkgBhvhFAQkCMQQTAjE5" +
+            "MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAzMDYw" +
+            "MTA4MzQ0MlowHwYJKoZIhvcNAQkEMRIEEBqGJFo7n4B8sFBCi54PckIwIAYKYIZI" +
+            "AYb4RQEJBTESBBA77Owxh2rbflhXsDYw3xsLMDAGCmCGSAGG+EUBCQcxIhMgODhF" +
+            "MkRFRTQ3MDY4QkIzN0YxOUJBNjQ3QkYwMkZEMEYwDQYJKoZIhvcNAQEBBQAEgYB4" +
+            "BPcw4NPIt4nMOFKSGg5oM1nGDPGFN7eorZV+/2uWiQfdtK4B4lzCTuNxWRT853dW" +
+            "dRDzXBCGEArlG8ef+vDD/HP9SX3MQ0NJWym48VI9bTpP/mJlUKSsfgDYHohvUlVI" +
+            "E5QFC6ILVLUmuWPGchUEAb8t30DDnmeXs8QxdqHfbQ==").getBytes());
+
+    static byte[] unknowncacertBytes = Base64.decode(("MIICLDCCAZWgAwIBAgIIbzEhUVZYO3gwDQYJKoZIhvcNAQEFBQAwLzEPMA0GA1UE" +
+            "AxMGVGVzdENBMQ8wDQYDVQQKEwZBbmFUb20xCzAJBgNVBAYTAlNFMB4XDTAyMDcw" +
+            "OTEyNDc1OFoXDTA0MDgxNTEyNTc1OFowLzEPMA0GA1UEAxMGVGVzdENBMQ8wDQYD" +
+            "VQQKEwZBbmFUb20xCzAJBgNVBAYTAlNFMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCB" +
+            "hwKBgQDZlACHRwJnQKlgpMqlZQmxvCrJPpPFyhxvjDHlryhp/AQ6GCm+IkGUVlwL" +
+            "sCnjgZH5BXDNaVXpkmME8334HFsxVlXqmZ2GqyP6kptMjbWZ2SRLBRKjAcI7EJIN" +
+            "FPDIep9ZHXw1JDjFGoJ4TLFd99w9rQ3cB6zixORoyCZMw+iebwIBEaNTMFEwDwYD" +
+            "VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUY3v0dqhUJI6ldKV3RKb0Xg9XklEwHwYD" +
+            "VR0jBBgwFoAUY3v0dqhUJI6ldKV3RKb0Xg9XklEwDQYJKoZIhvcNAQEFBQADgYEA" +
+            "i1P53jnSPLkyqm7i3nLNi+hG7rMgF+kRi6ZLKhzIPyKcAWV8iZCI8xl/GurbZ8zd" +
+            "nTiIOfQIP9eD/nhIIo7n4JOaTUeqgyafPsEgKdTiZfSdXjvy6rj5GiZ3DaGZ9SNK" +
+            "FgrCpX5kBKVbbQLO6TjJKCjX29CfoJ2TbP1QQ6UbBAY=").getBytes());
+
+    private static Context ctx;
+    private static ISignSessionHome home;
+    private static ISignSessionRemote remote;
+    private ICertificateStoreSessionHome storehome;
+    private static IUserAdminSessionRemote usersession;
+    private static int caid = 0;
+    private static Admin admin;
+    private static X509Certificate cacert = null;
+    private static X509Certificate ocspTestCert = null;
+    private static X509Certificate unknowncacert = null;
+
+    public static void main(String args[]) {
+        junit.textui.TestRunner.run(suite());
+    }
+
+
+    public static TestSuite suite() {
+        return new TestSuite(ProtocolOcspHttpTest.class);
+    }
+
+
+    public ProtocolOcspHttpTest(String name) {
+        super(name);
+    }
+
+    protected void setUp() throws Exception {
+        log.debug(">setUp()");
+
+        // Install BouncyCastle provider
+        CertTools.installBCProvider();
+
+        // We want to get error responses without exceptions
+        HttpUnitOptions.setExceptionsThrownOnErrorStatus(false);
+
+        admin = new Admin(Admin.TYPE_BATCHCOMMANDLINE_USER);
+
+        ctx = getInitialContext();
+        Object obj = ctx.lookup("CAAdminSession");
+        ICAAdminSessionHome cahome = (ICAAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, ICAAdminSessionHome.class);
+        ICAAdminSessionRemote casession = cahome.create();
+        Collection caids = casession.getAvailableCAs(admin);
+        Iterator iter = caids.iterator();
+        if (iter.hasNext()) {
+            caid = ((Integer) iter.next()).intValue();
+        } else {
+            assertTrue("No active CA! Must have at least one active CA to run tests!", false);
+        }
+        CAInfo cainfo = casession.getCAInfo(admin, caid);
+        Collection certs = cainfo.getCertificateChain();
+        if (certs.size() > 0) {
+            Iterator certiter = certs.iterator();
+            cacert = (X509Certificate) certiter.next();
+        } else {
+            log.error("NO CACERT for caid " + caid);
+        }
+        obj = ctx.lookup("RSASignSession");
+        home = (ISignSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, ISignSessionHome.class);
+        remote = home.create();
+        Object obj2 = ctx.lookup("CertificateStoreSession");
+        storehome = (ICertificateStoreSessionHome) javax.rmi.PortableRemoteObject.narrow(obj2, ICertificateStoreSessionHome.class);
+        obj = ctx.lookup("UserAdminSession");
+        IUserAdminSessionHome userhome = (IUserAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, IUserAdminSessionHome.class);
+        usersession = userhome.create();
+
+        unknowncacert = CertTools.getCertfromByteArray(unknowncacertBytes);
+        log.debug("<setUp()");
+    }
+
+    protected void tearDown() throws Exception {
+    }
+
+    private Context getInitialContext() throws NamingException {
+        log.debug(">getInitialContext");
+        Context ctx = new javax.naming.InitialContext();
+        log.debug("<getInitialContext");
+        return ctx;
+    }
+
+    /**
+     * Generates a RSA key pair.
+     *
+     * @return KeyPair the generated key pair
+     *
+     * @throws Exception if en error occurs...
+     */
+    private static KeyPair genKeys() throws Exception {
+        KeyPairGenerator keygen = KeyPairGenerator.getInstance("RSA", "BC");
+        keygen.initialize(512);
+        log.debug("Generating keys, please wait...");
+        KeyPair rsaKeys = keygen.generateKeyPair();
+        log.debug("Generated " + rsaKeys.getPrivate().getAlgorithm() + " keys with length" +
+                ((RSAPrivateKey) rsaKeys.getPrivate()).getModulus().bitLength());
+        return rsaKeys;
+    } // genKeys
+
+
+    public void test01Access() throws Exception {
+
+        WebConversation wc = new WebConversation();
+
+        // Hit with GET gives a 405 with OCSP: BAD_METHOD
+        WebRequest request = new GetMethodWebRequest(httpReqPath + '/' + resourceOcsp);
+        WebResponse response = wc.getResponse(request);
+        assertEquals("Response code", 405, response.getResponseCode());
+    }
+
+
+    /** Tests ocsp message
+     * @throws Exception error
+     */
+    public void test02OcspGood() throws Exception {
+        log.debug(">test02OcspGood()");
+
+        // find a CA (TestCA?) create a user and generate his cert
+        // send OCSP req to server and get good response
+        // change status of cert to bad status
+        // send OCSP req and get bad status
+        // (send crap message and get good error)
+
+        // Make user that we know...
+        boolean userExists = false;
+        try {
+            usersession.addUser(admin,"ocsptest","foo123","C=SE,O=AnaTom,CN=OCSPTest",null,"ocsptest@anatom.se",false,SecConst.EMPTY_ENDENTITYPROFILE,SecConst.CERTPROFILE_FIXED_ENDUSER,SecConst.USER_ENDUSER,SecConst.TOKEN_SOFT_PEM,0,caid);
+            log.debug("created user: ocsptest, foo123, C=SE, O=AnaTom, CN=OCSPTest");
+        } catch (RemoteException re) {
+            if (re.detail instanceof DuplicateKeyException) {
+                userExists = true;
+            }
+        } catch (DuplicateKeyException dke) {
+            userExists = true;
+        }
+
+        if (userExists) {
+            log.debug("User ocsptest already exists.");
+            usersession.changeUser(admin, "ocsptest", "foo123", "C=SE,O=AnaTom,CN=OCSPTest",null,"ocsptest@anatom.se",false, SecConst.EMPTY_ENDENTITYPROFILE,SecConst.CERTPROFILE_FIXED_ENDUSER,SecConst.USER_ENDUSER,SecConst.TOKEN_SOFT_PEM,0,UserDataConstants.STATUS_NEW, caid);
+            //usersession.setUserStatus(admin,"ocsptest",UserDataConstants.STATUS_NEW);
+            log.debug("Reset status to NEW");
+        }
+        // Generate certificate for the new user
+        KeyPair keys = genKeys();
+
+        // user that we know exists...
+        ocspTestCert = (X509Certificate) remote.createCertificate(admin, "ocsptest", "foo123", keys.getPublic());
+        assertNotNull("Misslyckades skapa cert", ocspTestCert);
+
+        // And an OCSP request
+        OCSPReqGenerator gen = new OCSPReqGenerator();
+        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, cacert, ocspTestCert.getSerialNumber()));
+        OCSPReq req = gen.generate();
+
+        // Send the request and receive a singleResponse
+        SingleResp singleResp = sendOCSPPost(req.getEncoded());
+        
+        CertificateID certId = singleResp.getCertID();
+        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), ocspTestCert.getSerialNumber());
+        Object status = singleResp.getCertStatus();
+        assertEquals("Status is not null (good)", status, null);
+        log.debug("<test02OcspGood()");
+    }
+
+    /** Tests ocsp message
+     * @throws Exception error
+     */
+    public void test03OcspRevoked() throws Exception {
+        log.debug(">test03OcspRevoked()");
+        // Now revoke the certificate and try again
+        CertificateDataPK pk = new CertificateDataPK();
+        pk.fingerprint = CertTools.getFingerprintAsString(ocspTestCert);
+        ICertificateStoreSessionRemote store = storehome.create();
+        store.revokeCertificate(admin, ocspTestCert,null,RevokedCertInfo.REVOKATION_REASON_KEYCOMPROMISE);
+        // And an OCSP request
+        OCSPReqGenerator gen = new OCSPReqGenerator();
+        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, cacert, ocspTestCert.getSerialNumber()));
+        OCSPReq req = gen.generate();
+
+        // Send the request and receive a singleResponse
+        SingleResp singleResp = sendOCSPPost(req.getEncoded());
+
+        CertificateID certId = singleResp.getCertID();
+        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), ocspTestCert.getSerialNumber());
+        Object status = singleResp.getCertStatus();
+        assertTrue("Status is not RevokedStatus", status instanceof RevokedStatus);
+        RevokedStatus rev = (RevokedStatus) status;
+        assertTrue("Status does not have reason", rev.hasRevocationReason());
+        int reason = rev.getRevocationReason();
+        assertEquals("Wrong revocation reason", reason, RevokedCertInfo.REVOKATION_REASON_KEYCOMPROMISE);
+        log.debug("<test03OcspRevoked()");
+    }
+
+    /** Tests ocsp message
+     * @throws Exception error
+     */
+    public void test04OcspUnknown() throws Exception {
+        log.debug(">test04OcspUnknown()");
+        // An OCSP request for an unknown certificate (not exist in db)
+        OCSPReqGenerator gen = new OCSPReqGenerator();
+        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, cacert, new BigInteger("1")));
+        OCSPReq req = gen.generate();
+        
+        // Send the request and receive a singleResponse
+        SingleResp singleResp = sendOCSPPost(req.getEncoded());
+
+        CertificateID certId = singleResp.getCertID();
+        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), new BigInteger("1"));
+        Object status = singleResp.getCertStatus();
+        assertTrue("Status is not Unknown", status instanceof UnknownStatus);
+
+        log.debug("<test04OcspUnknown()");
+    }
+
+    /** Tests ocsp message
+     * @throws Exception error
+     */
+    public void test05OcspUnknownCA() throws Exception {
+        log.debug(">test05OcspUnknownCA()");
+        // An OCSP request for a certificate from an unknwon CA
+        OCSPReqGenerator gen = new OCSPReqGenerator();
+        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, unknowncacert, new BigInteger("1")));
+        OCSPReq req = gen.generate();
+        
+        // Send the request and receive a singleResponse
+        SingleResp singleResp = sendOCSPPost(req.getEncoded());
+
+        CertificateID certId = singleResp.getCertID();
+        assertEquals("Serno in response does not match serno in request.", certId.getSerialNumber(), new BigInteger("1"));
+        Object status = singleResp.getCertStatus();
+        assertTrue("Status is not Unknown", status instanceof UnknownStatus);
+
+        log.debug("<test05OcspUnknownCA()");
+    }
+    
+    public void test06OcspSendWrongContentType() throws Exception {
+        // An OCSP request for a certificate from an unknwon CA
+        OCSPReqGenerator gen = new OCSPReqGenerator();
+        gen.addRequest(new CertificateID(CertificateID.HASH_SHA1, unknowncacert, new BigInteger("1")));
+        OCSPReq req = gen.generate();
+        // POST the OCSP request
+        URL url = new URL(httpReqPath + '/' + resourceOcsp);
+        HttpURLConnection con = (HttpURLConnection)url.openConnection();
+        // we are going to do a POST
+        con.setDoOutput(true);
+        con.setRequestMethod("POST");
+        // POST it, but don't add content type
+        OutputStream os = con.getOutputStream();
+        os.write(req.getEncoded());
+        os.close();
+        assertEquals("Response code", 400, con.getResponseCode());
+        
+    }
+
+    //
+    // Private helper methods
+    //
+    
+    private SingleResp sendOCSPPost(byte[] ocspPackage) throws IOException, OCSPException, NoSuchProviderException {
+        // POST the OCSP request
+        URL url = new URL(httpReqPath + '/' + resourceOcsp);
+        HttpURLConnection con = (HttpURLConnection)url.openConnection();
+        // we are going to do a POST
+        con.setDoOutput(true);
+        con.setRequestMethod("POST");
+
+        // POST it
+        con.setRequestProperty("Content-Type", "application/ocsp-request");
+        OutputStream os = con.getOutputStream();
+        os.write(ocspPackage);
+        os.close();
+        assertEquals("Response code", 200, con.getResponseCode());
+        assertEquals("Content-Type", "application/ocsp-response", con.getContentType());
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        // This works for small requests, and OCSP requests are small
+        InputStream in = con.getInputStream();
+        int b = in.read();
+        while (b != -1) {
+            baos.write(b);
+            b = in.read();
+        }
+        baos.flush();
+        in.close();
+        byte[] respBytes = baos.toByteArray();
+        OCSPResp response = new OCSPResp(new ByteArrayInputStream(respBytes));
+        assertEquals("Response status not zero.", response.getStatus(), 0);
+        BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
+        X509Certificate[] chain = brep.getCerts("BC");
+        boolean verify = brep.verify(chain[0].getPublicKey(), "BC");
+        assertTrue("Response failed to verify.", verify);
+        SingleResp[] singleResps = brep.getResponses();
+        assertEquals("No of SingResps shoudl be 1.", singleResps.length, 1);
+        SingleResp singleResp = singleResps[0];
+        return singleResp;
+    }
+}
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ProtocolScepHttpTest.java ./src/test/se/anatom/ejbca/protocol/ProtocolScepHttpTest.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ProtocolScepHttpTest.java	Thu Jan  1 01:00:00 1970
+++ ./src/test/se/anatom/ejbca/protocol/ProtocolScepHttpTest.java	Thu Aug 11 11:06:05 2005
@@ -0,0 +1,573 @@
+/*************************************************************************
+ *                                                                       *
+ *  EJBCA: The OpenSource Certificate Authority                          *
+ *                                                                       *
+ *  This software is free software; you can redistribute it and/or       *
+ *  modify it under the terms of the GNU Lesser General Public           *
+ *  License as published by the Free Software Foundation; either         *
+ *  version 2.1 of the License, or any later version.                    *
+ *                                                                       *
+ *  See terms of license at gnu.org.                                     *
+ *                                                                       *
+ *************************************************************************/
+
+package se.anatom.ejbca.protocol;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.rmi.RemoteException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyPair;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.cert.CRLException;
+import java.security.cert.CertStore;
+import java.security.cert.CertStoreException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import java.util.Collection;
+import java.util.Iterator;
+
+import javax.ejb.DuplicateKeyException;
+import javax.ejb.FinderException;
+import javax.naming.Context;
+import javax.naming.NamingException;
+
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+import org.apache.log4j.Logger;
+import org.bouncycastle.asn1.ASN1OctetString;
+import org.bouncycastle.asn1.ASN1Set;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.DERPrintableString;
+import org.bouncycastle.asn1.DERString;
+import org.bouncycastle.asn1.cms.Attribute;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.cms.CMSEnvelopedData;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessable;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.RecipientInformation;
+import org.bouncycastle.cms.RecipientInformationStore;
+import org.bouncycastle.cms.SignerId;
+import org.bouncycastle.cms.SignerInformation;
+import org.bouncycastle.cms.SignerInformationStore;
+import org.bouncycastle.ocsp.OCSPException;
+
+import se.anatom.ejbca.SecConst;
+import se.anatom.ejbca.authorization.AuthorizationDeniedException;
+import se.anatom.ejbca.ca.caadmin.CAInfo;
+import se.anatom.ejbca.ca.caadmin.ICAAdminSessionHome;
+import se.anatom.ejbca.ca.caadmin.ICAAdminSessionRemote;
+import se.anatom.ejbca.log.Admin;
+import se.anatom.ejbca.ra.IUserAdminSessionHome;
+import se.anatom.ejbca.ra.IUserAdminSessionRemote;
+import se.anatom.ejbca.ra.UserDataConstants;
+import se.anatom.ejbca.ra.raadmin.UserDoesntFullfillEndEntityProfile;
+import se.anatom.ejbca.util.Base64;
+import se.anatom.ejbca.util.CertTools;
+import se.anatom.ejbca.util.KeyTools;
+
+import com.meterware.httpunit.GetMethodWebRequest;
+import com.meterware.httpunit.HttpUnitOptions;
+import com.meterware.httpunit.WebConversation;
+import com.meterware.httpunit.WebRequest;
+import com.meterware.httpunit.WebResponse;
+
+/** Tests http pages of ocsp and scep
+ **/
+public class ProtocolScepHttpTest extends TestCase {
+    private static Logger log = Logger.getLogger(TestMessages.class);
+
+    private static final String httpReqPath = "http://127.0.0.1:8080/ejbca";
+    private static final String resourceScep = "publicweb/apply/scep/pkiclient.exe";
+
+    static byte[] openscep = Base64.decode(("MIIGqwYJKoZIhvcNAQcCoIIGnDCCBpgCAQExDjAMBggqhkiG9w0CBQUAMIICuwYJ" +
+            "KoZIhvcNAQcBoIICrASCAqgwggKkBgkqhkiG9w0BBwOgggKVMIICkQIBADGB1TCB" +
+            "0gIBADA7MC8xDzANBgNVBAMTBlRlc3RDQTEPMA0GA1UEChMGQW5hVG9tMQswCQYD" +
+            "VQQGEwJTRQIIbzEhUVZYO3gwDQYJKoZIhvcNAQEBBQAEgYCksIoSXYsCQPot2DDW" +
+            "dexdFqLj1Fuz3xSpu/rLozXKxEY0n0W0JXRR9OxxuyqNw9cLZhiyWkNsJGbP/rEz" +
+            "yrXe9NXuLK5U8+qqE8OhnY9BhCxjeUJSLni6oCSi7YzwOqdg2KmifJrQQI/jZIiC" +
+            "tSISAtE6qi6DKQwLCkQLmokLrjCCAbIGCSqGSIb3DQEHATARBgUrDgMCBwQILYvZ" +
+            "rBWuC02AggGQW9o5MB/7LN4o9G4ZD1l2mHzS+g+Y/dT2qD/qIaQi1Mamv2oKx9eO" +
+            "uFtaGkBBGWZlIKg4mm/DFtvXqW8Y5ijAiQVHHPuRKNyIV6WVuFjNjhNlM+DWLJR+" +
+            "rpHEhvB6XeDo/pd+TyOKFcxedMPTD7U+j46yd46vKdmoKAiIF21R888uVSz3GDts" +
+            "NlqgvZ7VlaI++Tj7aPdOI7JTdQXZk2FWF7Ql0LBIPwk9keffptF5if5Y+aHqB0a2" +
+            "uQj1aE8Em15VG8p8MmLJOX0OA1aeqfxR0wk343r44UebliY2DE8cEnym/fmya30/" +
+            "7WYzJ7erWofO2ukg1yc93wUpyIKxt2RGIy5geqQCjCYSSGgaNFafEV2pnOVSx+7N" +
+            "9z/ICNQfDBD6b83MO7yPHC1cXcdREKHHeqaKyQLiVRk9+R/3D4vEZt682GRaUKOY" +
+            "PQXK1Be2nyZoo4gZs62nZVAliJ+chFkEUog9k9OsIvZRG7X+VEjVYBqxlE1S3ikt" +
+            "igFXiuLC/LDCi3IgVwQjfNx1/mhxsO7GSaCCAfswggH3MIIBYKADAgEDAiA4OEUy" +
+            "REVFNDcwNjhCQjM3RjE5QkE2NDdCRjAyRkQwRjANBgkqhkiG9w0BAQQFADAyMQsw" +
+            "CQYDVQQGEwJTZTERMA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcw" +
+            "HhcNMDMwNjAxMDgzNDQyWhcNMDMwNzAxMDgzNDQyWjAyMQswCQYDVQQGEwJTZTER" +
+            "MA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcwgZ8wDQYJKoZIhvcN" +
+            "AQEBBQADgY0AMIGJAoGBAOu47fpIQfzfSnEBTG2WJpKZz1891YLNulc7XgMk8hl3" +
+            "nVC4m34SaR7eXR3nCsorYEpPPmL3affaPFsBnNBQNoZLxKmQ1RKiDyu8dj90AKCP" +
+            "CFlIM2aJbKMiQad+dt45qse6k0yTrY3Yx0hMH76tRkDif4DjM5JUvdf4d/zlYcCz" +
+            "AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAGNoWI02kXNEA5sPHb3KEY8QZoYM5Kha1" +
+            "JA7HLmlXKy6geeJmk329CUnvF0Cr7zxbMkFRdUDUtR8omDDnGlBSOCkV6LLYH939" +
+            "Z8iysfaxigZkxUqUYGLtYHhsEjVgcpfKZVxTz0E2ocR2P+IuU04Duel/gU4My6Qv" +
+            "LDpwo1CQC10xggHDMIIBvwIBATBWMDIxCzAJBgNVBAYTAlNlMREwDwYDVQQKEwhQ" +
+            "cmltZUtleTEQMA4GA1UEAxMHVG9tYXMgRwIgODhFMkRFRTQ3MDY4QkIzN0YxOUJB" +
+            "NjQ3QkYwMkZEMEYwDAYIKoZIhvcNAgUFAKCBwTASBgpghkgBhvhFAQkCMQQTAjE5" +
+            "MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAzMDYw" +
+            "MTA4MzQ0MlowHwYJKoZIhvcNAQkEMRIEEBqGJFo7n4B8sFBCi54PckIwIAYKYIZI" +
+            "AYb4RQEJBTESBBA77Owxh2rbflhXsDYw3xsLMDAGCmCGSAGG+EUBCQcxIhMgODhF" +
+            "MkRFRTQ3MDY4QkIzN0YxOUJBNjQ3QkYwMkZEMEYwDQYJKoZIhvcNAQEBBQAEgYB4" +
+            "BPcw4NPIt4nMOFKSGg5oM1nGDPGFN7eorZV+/2uWiQfdtK4B4lzCTuNxWRT853dW" +
+            "dRDzXBCGEArlG8ef+vDD/HP9SX3MQ0NJWym48VI9bTpP/mJlUKSsfgDYHohvUlVI" +
+            "E5QFC6ILVLUmuWPGchUEAb8t30DDnmeXs8QxdqHfbQ==").getBytes());
+
+    private static Context ctx;
+    private static IUserAdminSessionRemote usersession;
+    private static int caid = 0;
+    private static Admin admin;
+    private static X509Certificate cacert = null;
+    private static KeyPair keys = null;
+    private static String caname = null;
+    private String transId = null;
+    private String senderNonce = null;
+
+    public static void main(String args[]) {
+        junit.textui.TestRunner.run(suite());
+    }
+
+
+    public static TestSuite suite() {
+        return new TestSuite(ProtocolScepHttpTest.class);
+    }
+
+
+    public ProtocolScepHttpTest(String name) {
+        super(name);
+    }
+
+    protected void setUp() throws Exception {
+        log.debug(">setUp()");
+
+        // Install BouncyCastle provider
+        CertTools.installBCProvider();
+
+        // We want to get error responses without exceptions
+        HttpUnitOptions.setExceptionsThrownOnErrorStatus(false);
+
+        admin = new Admin(Admin.TYPE_BATCHCOMMANDLINE_USER);
+
+        ctx = getInitialContext();
+        Object obj = ctx.lookup("CAAdminSession");
+        ICAAdminSessionHome cahome = (ICAAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, ICAAdminSessionHome.class);
+        ICAAdminSessionRemote casession = cahome.create();
+        Collection caids = casession.getAvailableCAs(admin);
+        Iterator iter = caids.iterator();
+        if (iter.hasNext()) {
+            caid = ((Integer) iter.next()).intValue();
+        } else {
+            assertTrue("No active CA! Must have at least one active CA to run tests!", false);
+        }
+        CAInfo cainfo = casession.getCAInfo(admin, caid);
+        caname = cainfo.getName();
+        Collection certs = cainfo.getCertificateChain();
+        if (certs.size() > 0) {
+            Iterator certiter = certs.iterator();
+            X509Certificate cert = (X509Certificate) certiter.next();
+            // Make sure we have a BC certificate
+            cacert = CertTools.getCertfromByteArray(cert.getEncoded());
+        } else {
+            log.error("NO CACERT for caid " + caid);
+        }
+        obj = ctx.lookup("UserAdminSession");
+        IUserAdminSessionHome userhome = (IUserAdminSessionHome) javax.rmi.PortableRemoteObject.narrow(obj, IUserAdminSessionHome.class);
+        usersession = userhome.create();
+
+        log.debug("<setUp()");
+    }
+
+    protected void tearDown() throws Exception {
+    }
+
+    private Context getInitialContext() throws NamingException {
+        log.debug(">getInitialContext");
+        Context ctx = new javax.naming.InitialContext();
+        log.debug("<getInitialContext");
+        return ctx;
+    }
+ 
+    public void test01Access() throws Exception {
+        WebConversation wc = new WebConversation();
+        // Hit scep, gives a 400: Bad Request
+        WebRequest request = new GetMethodWebRequest(httpReqPath + '/' + resourceScep);
+        WebResponse response = wc.getResponse(request);
+        assertEquals("Response code", 400, response.getResponseCode());
+    }
+
+    /** Tests a random old scep message from OpenScep
+     * @throws Exception error
+     */
+    public void test02OpenScep() throws Exception {
+        log.debug(">test02OpenScep()");
+        // send message to server and see what happens
+        WebConversation wc = new WebConversation();
+        WebRequest request = new GetMethodWebRequest(httpReqPath + '/' + resourceScep);
+        request.setParameter("operation", "PKIOperation");
+        request.setParameter("message", new String(Base64.encode(openscep)));
+        WebResponse response = wc.getResponse(request);
+        // TODO: since our request most certainly uses the wrong CA cert to encrypt the
+        // request, it will fail. If we get something back, we came a little bit at least :)
+        // We should get a NOT_FOUND error back.
+        assertEquals("Response code", 404, response.getResponseCode());
+        log.debug("<test02OpenScep()");
+    }
+
+    public void test03ScepRequestOK() throws Exception {
+        log.debug(">test03ScepRequestOK()");
+        // find a CA create a user and
+        // send SCEP req to server and get good response with cert
+
+        // Make user that we know...
+        createScepUser();
+        
+        // Pre-generate key for all requests to speed things up a bit
+        keys = KeyTools.genKeys(512);
+        byte[] msgBytes = genScepRequest(false);
+        // Send message with GET
+        byte[] retMsg = sendScep(false, msgBytes);
+        assertNotNull(retMsg);
+        checkScepResponse(retMsg, "C=SE,O=PrimeKey,CN=sceptest", senderNonce, transId, false);
+        log.debug("<test03ScepRequestOK()");
+    }
+
+    public void test04ScepRequestPostOK() throws Exception {
+        log.debug(">test04ScepRequestPostOK()");
+        // find a CA, create a user and
+        // send SCEP req to server and get good response with cert
+
+        createScepUser();
+        
+        byte[] msgBytes = genScepRequest(false);
+        // Send message with GET
+        byte[] retMsg = sendScep(true, msgBytes);
+        assertNotNull(retMsg);
+        checkScepResponse(retMsg, "C=SE,O=PrimeKey,CN=sceptest", senderNonce, transId, false);
+        log.debug(">test04ScepRequestPostOK()");
+    }
+
+    public void test05ScepGetCACert() throws Exception {
+        log.debug(">test05ScepGetCACert()");
+        String reqUrl = httpReqPath + '/' + resourceScep+"?operation=GetCACert&message="+caname;
+        URL url = new URL(reqUrl);
+        HttpURLConnection con = (HttpURLConnection)url.openConnection();
+        con.setRequestMethod("GET");
+        con.getDoOutput();
+        con.connect();
+        assertEquals("Response code", 200, con.getResponseCode());
+        assertEquals("Content-Type", "application/x-x509-ca-cert", con.getContentType());
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        // This works for small requests, and SCEP requests are small enough
+        InputStream in = con.getInputStream();
+        int b = in.read();
+        while (b != -1) {
+            baos.write(b);
+            b = in.read();
+        }
+        baos.flush();
+        in.close();
+        byte[] respBytes = baos.toByteArray();
+        assertNotNull("Response can not be null.", respBytes);
+        assertTrue(respBytes.length > 0);
+        X509Certificate cert = CertTools.getCertfromByteArray(respBytes);
+        // Check that we got the right cert back
+        assertEquals(cacert.getSubjectDN().getName(), cert.getSubjectDN().getName());
+        log.debug(">test05ScepGetCACert()");
+    }
+
+    public void test06ScepGetCrl() throws Exception {
+        log.debug(">test06ScepGetCrl()");
+        byte[] msgBytes = genScepRequest(true);
+        // Send message with GET
+        byte[] retMsg = sendScep(false, msgBytes);
+        assertNotNull(retMsg);
+        checkScepResponse(retMsg, "C=SE,O=PrimeKey,CN=sceptest", senderNonce, transId, true);
+        log.debug(">test06ScepGetCrl()");
+    }
+    public void test07ScepGetCACaps() throws Exception {
+        log.debug(">test07ScepGetCACaps()");
+        String reqUrl = httpReqPath + '/' + resourceScep+"?operation=GetCACaps&message="+caname;
+        URL url = new URL(reqUrl);
+        HttpURLConnection con = (HttpURLConnection)url.openConnection();
+        con.setRequestMethod("GET");
+        con.getDoOutput();
+        con.connect();
+        assertEquals("Response code", 200, con.getResponseCode());
+        assertEquals("Content-Type", "text/plain", con.getContentType());
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        // This works for small requests, and SCEP requests are small enough
+        InputStream in = con.getInputStream();
+        int b = in.read();
+        while (b != -1) {
+            baos.write(b);
+            b = in.read();
+        }
+        baos.flush();
+        in.close();
+        byte[] respBytes = baos.toByteArray();
+        assertNotNull("Response can not be null.", respBytes);
+        assertTrue(respBytes.length > 0);
+        assertEquals(new String(respBytes), "POSTPKIOperation\nSHA-1");
+        log.debug(">test07ScepGetCACaps()");
+    }
+    public void test99CleanUp() throws Exception {
+        // remove user
+        usersession.deleteUser(admin,"sceptest");
+        log.debug("deleted user: sceptest");
+    }
+    
+    //
+    // Private helper methods
+    //
+    private void createScepUser() throws RemoteException, AuthorizationDeniedException, FinderException, UserDoesntFullfillEndEntityProfile {
+        // Make user that we know...
+        boolean userExists = false;
+        try {
+            usersession.addUser(admin,"sceptest","foo123","C=SE,O=PrimeKey,CN=sceptest",null,"ocsptest@anatom.se",false,SecConst.EMPTY_ENDENTITYPROFILE,SecConst.CERTPROFILE_FIXED_ENDUSER,SecConst.USER_ENDUSER,SecConst.TOKEN_SOFT_PEM,0,caid);
+            log.debug("created user: sceptest, foo123, C=SE, O=PrimeKey, CN=sceptest");
+        } catch (RemoteException re) {
+            if (re.detail instanceof DuplicateKeyException) {
+                userExists = true;
+            }
+        } catch (DuplicateKeyException dke) {
+            userExists = true;
+        }
+
+        if (userExists) {
+            log.debug("User sceptest already exists.");
+            usersession.setUserStatus(admin,"sceptest",UserDataConstants.STATUS_NEW);
+            log.debug("Reset status to NEW");
+        }
+        
+    }
+
+    private byte[] genScepRequest(boolean makeCrlReq) throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException, SignatureException, InvalidAlgorithmParameterException, CertStoreException, IOException, CMSException {
+        ScepRequestGenerator gen = new ScepRequestGenerator();
+        gen.setKeys(keys);
+        byte[] msgBytes = null;
+        if (makeCrlReq) {
+            msgBytes = gen.generateCrlReq("C=SE, O=PrimeKey, CN=sceptest", cacert);
+        } else {
+            msgBytes = gen.generateCertReq("C=SE, O=PrimeKey, CN=sceptest", "foo123", cacert);            
+        }
+        assertNotNull(msgBytes);
+        transId = gen.getTransactionId();
+        assertNotNull(transId);
+        byte[] idBytes = Base64.decode(transId.getBytes());
+        assertTrue(idBytes.length == 16);
+        senderNonce = gen.getSenderNonce();
+        byte[] nonceBytes = Base64.decode(senderNonce.getBytes());
+        assertTrue(nonceBytes.length == 16); 
+        return msgBytes;
+    }
+    
+    private void checkScepResponse(byte[] retMsg, String userDN, String senderNonce, String transId, boolean crlRep) throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException, SignatureException, CRLException {
+        //
+        // Parse response message
+        //
+        CMSSignedData s = new CMSSignedData(retMsg);
+        // The signer, i.e. the CA, check it's the right CA
+        SignerInformationStore signers = s.getSignerInfos();
+        Collection col = signers.getSigners();
+        assertTrue(col.size() > 0);
+        Iterator iter = col.iterator();
+        SignerInformation signerInfo = (SignerInformation)iter.next();
+        SignerId sinfo = signerInfo.getSID();
+        // Check that the signer is the expected CA
+        assertEquals(CertTools.stringToBCDNString(cacert.getIssuerDN().getName()), CertTools.stringToBCDNString(sinfo.getIssuerAsString()));
+        // Get authenticated attributes
+        AttributeTable tab = signerInfo.getSignedAttributes();
+        // --Fail info
+        Attribute attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_failInfo));
+        // No failInfo on this success message
+        assertNull(attr); 
+        // --Message type
+        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_messageType));
+        assertNotNull(attr);
+        ASN1Set values = attr.getAttrValues();
+        assertEquals(values.size(), 1);
+        DERString str = DERPrintableString.getInstance((values.getObjectAt(0)));
+        String messageType = str.getString();
+        assertEquals("3", messageType);
+        // --Success status
+        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_pkiStatus));
+        assertNotNull(attr);
+        values = attr.getAttrValues();
+        assertEquals(values.size(), 1);
+        str = DERPrintableString.getInstance((values.getObjectAt(0)));
+        assertEquals(ResponseStatus.SUCCESS.getValue(), str.getString());
+        // --SenderNonce
+        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_senderNonce));
+        assertNotNull(attr);
+        values = attr.getAttrValues();
+        assertEquals(values.size(), 1);
+        ASN1OctetString octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
+        // SenderNonce is something the server came up with, but it should be 16 chars
+        assertTrue(octstr.getOctets().length == 16);
+        // --Recipient Nonce
+        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_recipientNonce));
+        assertNotNull(attr);
+        values = attr.getAttrValues();
+        assertEquals(values.size(), 1);
+        octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
+        // recipient nonce should be the same as we sent away as sender nonce
+        assertEquals(senderNonce, new String(Base64.encode(octstr.getOctets())));
+        // --Transaction ID
+        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_transId));
+        assertNotNull(attr);
+        values = attr.getAttrValues();
+        assertEquals(values.size(), 1);
+        str = DERPrintableString.getInstance((values.getObjectAt(0)));
+        // transid should be the same as the one we sent
+        assertEquals(transId, str.getString());
+        
+        //
+        // Check different message types
+        //
+        if (messageType.equals("3")) {
+            // First we extract the encrypted data from the CMS enveloped data contained
+            // within the CMS signed data
+            CMSProcessable sp = s.getSignedContent();
+            byte[] content = (byte[])sp.getContent();
+            CMSEnvelopedData ed = new CMSEnvelopedData(content);
+            RecipientInformationStore recipients = ed.getRecipientInfos();
+            Collection c = recipients.getRecipients();
+            assertEquals(c.size(), 1);
+            Iterator it = c.iterator();
+            byte[] decBytes = null;
+            RecipientInformation recipient = (RecipientInformation) it.next();
+            decBytes = recipient.getContent(keys.getPrivate(), "BC");
+            // This is yet another CMS signed data
+            CMSSignedData sd = new CMSSignedData(decBytes);
+            // Get certificates from the signed data
+            CertStore certstore = sd.getCertificatesAndCRLs("Collection","BC");
+            if (crlRep) {
+                // We got a reply with a requested CRL
+                Collection crls = certstore.getCRLs(null);
+                assertEquals(crls.size(), 1);
+                it = crls.iterator();
+                X509CRL retCrl = null;
+                // CRL is first (and only)
+                retCrl = (X509CRL)it.next();
+                System.out.println("Got CRL with DN: "+ retCrl.getIssuerDN().getName());
+//                try {
+//                    FileOutputStream fos = new FileOutputStream("sceptest.der");
+//                    fos.write(retCrl.getEncoded());
+//                    fos.close();
+//                } catch (Exception e) {}
+                // check the returned CRL
+                assertEquals(cacert.getSubjectDN().getName(), retCrl.getIssuerDN().getName());
+                retCrl.verify(cacert.getPublicKey());
+            } else {
+                // We got a reply with a requested certificate 
+                Collection certs = certstore.getCertificates(null);
+                // EJBCA returns the issued cert and the CA cert (cisco vpn client requires that the ca cert is included)
+                assertEquals(certs.size(), 2);
+                it = certs.iterator();
+                // Issued certificate must be first
+                boolean verified = false;
+                boolean gotcacert = false;
+                String mysubjectdn = CertTools.stringToBCDNString("C=SE,O=PrimeKey,CN=sceptest");
+                while (it.hasNext()) {
+                    X509Certificate retcert = (X509Certificate)it.next();
+                    System.out.println("Got cert with DN: "+ retcert.getSubjectDN().getName());
+//                    try {
+//                        FileOutputStream fos = new FileOutputStream("sceptest.der");
+//                        fos.write(retcert.getEncoded());
+//                        fos.close();
+//                    } catch (Exception e) {}
+                
+                    // check the returned certificate
+                    String subjectdn = CertTools.stringToBCDNString(retcert.getSubjectDN().getName());
+                    if (mysubjectdn.equals(subjectdn)) {
+                        // issued certificate
+                        assertEquals(CertTools.stringToBCDNString("C=SE,O=PrimeKey,CN=sceptest"), subjectdn);
+                        retcert.verify(cacert.getPublicKey());
+                        assertTrue(checkKeys(keys.getPrivate(), retcert.getPublicKey()));
+                        verified = true;
+                    } else {
+                        // ca certificate
+                        assertEquals(cacert.getSubjectDN().getName(), retcert.getIssuerDN().getName());
+                        gotcacert = true;
+                    }
+                }
+                assertTrue(verified);
+                assertTrue(gotcacert);
+            }
+        }
+        
+    }
+    /**
+     * checks that a public and private key matches by signing and verifying a message
+     */
+    private boolean checkKeys(PrivateKey priv, PublicKey pub) throws SignatureException, NoSuchAlgorithmException, InvalidKeyException {
+        Signature signer = Signature.getInstance("SHA1WithRSA");
+        signer.initSign(priv);
+        signer.update("PrimeKey".getBytes());
+        byte[] signature = signer.sign();
+        
+        Signature signer2 = Signature.getInstance("SHA1WithRSA");
+        signer2.initVerify(pub);
+        signer2.update("PrimeKey".getBytes());
+        return signer2.verify(signature);
+    }
+    private byte[] sendScep(boolean post, byte[] scepPackage) throws IOException, OCSPException, NoSuchProviderException {
+        // POST the OCSP request
+        // we are going to do a POST
+        HttpURLConnection con = null;
+        if (post) {
+            URL url = new URL(httpReqPath + '/' + resourceScep+"?operation=PKIOperation");
+            con = (HttpURLConnection)url.openConnection();
+            con.setDoOutput(true);
+            con.setRequestMethod("POST");
+            con.connect();
+            // POST it
+            OutputStream os = con.getOutputStream();
+            os.write(scepPackage);
+            os.close();
+        } else {
+            String reqUrl = httpReqPath + '/' + resourceScep+"?operation=PKIOperation&message=" + URLEncoder.encode(new String(Base64.encode(scepPackage)),"UTF-8");
+            URL url = new URL(reqUrl);
+            con = (HttpURLConnection)url.openConnection();
+            con.setRequestMethod("GET");
+            con.getDoOutput();
+            con.connect();
+        }
+
+        assertEquals("Response code", 200, con.getResponseCode());
+        assertEquals("Content-Type", "application/x-pki-message", con.getContentType());
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        // This works for small requests, and SCEP requests are small enough
+        InputStream in = con.getInputStream();
+        int b = in.read();
+        while (b != -1) {
+            baos.write(b);
+            b = in.read();
+        }
+        baos.flush();
+        in.close();
+        byte[] respBytes = baos.toByteArray();
+        assertNotNull("Response can not be null.", respBytes);
+        assertTrue(respBytes.length > 0);
+        return respBytes;
+    }
+
+}
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ScepRequestGenerator.java ./src/test/se/anatom/ejbca/protocol/ScepRequestGenerator.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/protocol/ScepRequestGenerator.java	Thu Jan  1 01:00:00 1970
+++ ./src/test/se/anatom/ejbca/protocol/ScepRequestGenerator.java	Thu Aug 11 11:06:05 2005
@@ -0,0 +1,189 @@
+package se.anatom.ejbca.protocol;
+
+import java.io.IOException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyPair;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.SecureRandom;
+import java.security.SignatureException;
+import java.security.cert.CertStore;
+import java.security.cert.CertStoreException;
+import java.security.cert.CollectionCertStoreParameters;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Hashtable;
+
+import org.apache.log4j.Logger;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERPrintableString;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERSet;
+import org.bouncycastle.asn1.DERUTF8String;
+import org.bouncycastle.asn1.cms.Attribute;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.cms.IssuerAndSerialNumber;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.smime.SMIMECapability;
+import org.bouncycastle.asn1.x509.X509Name;
+import org.bouncycastle.cms.CMSEnvelopedData;
+import org.bouncycastle.cms.CMSEnvelopedDataGenerator;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessable;
+import org.bouncycastle.cms.CMSProcessableByteArray;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.CMSSignedDataGenerator;
+import org.bouncycastle.jce.PKCS10CertificationRequest;
+
+import se.anatom.ejbca.util.Base64;
+import se.anatom.ejbca.util.CertTools;
+import se.anatom.ejbca.util.KeyTools;
+
+public class ScepRequestGenerator {
+    private static Logger log = Logger.getLogger(ScepResponseMessage.class);
+
+    private X509Certificate cert = null;
+    private X509Certificate cacert = null;
+    private String reqdn = null;
+    private KeyPair keys = null;
+    private PKCS10CertificationRequest p10request;
+    int keysize = 1024;
+    private String senderNonce = null;
+    private String transactionId = null;
+    
+    public void setKeySize(int size) {
+        this.keysize = size;
+    }
+    public void setKeys(KeyPair myKeys) {
+        this.keys = myKeys;
+    }
+    /** Base 64 encode senderNonce
+     */
+    public String getSenderNonce() {
+        return senderNonce;
+    }
+    public String getTransactionId() {
+        return transactionId;
+    }
+    public byte[] generateCrlReq(String dn, X509Certificate ca) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException, SignatureException, IOException, CMSException, InvalidAlgorithmParameterException, CertStoreException {
+        this.cacert = ca;
+        this.reqdn = dn;
+        X509Name name = CertTools.stringToBcX509Name(cacert.getIssuerDN().getName());
+        IssuerAndSerialNumber ias = new IssuerAndSerialNumber(name, cacert.getSerialNumber());
+        // Create self signed cert, validity 1 day
+        cert = CertTools.genSelfCert(reqdn,24*60*60*1000,null,keys.getPrivate(),keys.getPublic(),false);
+        
+        // wrap message in pkcs#7
+        byte[] msg = wrap(ias.getEncoded(), "22");        
+        return msg;
+    }
+    public byte[] generateCertReq(String dn, String password, X509Certificate ca) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException, SignatureException, IOException, CMSException, InvalidAlgorithmParameterException, CertStoreException {
+        this.cacert = ca;
+        this.reqdn = dn;
+        // Generate keys
+        if (keys == null) {
+            keys = KeyTools.genKeys(keysize);            
+        }
+
+        // Create challenge password attribute for PKCS10
+        // Attributes { ATTRIBUTE:IOSet } ::= SET OF Attribute{{ IOSet }}
+        //
+        // Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
+        //    type    ATTRIBUTE.&id({IOSet}),
+        //    values  SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{\@type})
+        // }
+        ASN1EncodableVector vec = new ASN1EncodableVector();
+        vec.add(PKCSObjectIdentifiers.pkcs_9_at_challengePassword); 
+        ASN1EncodableVector values = new ASN1EncodableVector();
+        values.add(new DERUTF8String(password));
+        vec.add(new DERSet(values));
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(new DERSequence(vec));
+        DERSet set = new DERSet(v);
+        // Create PKCS#10 certificate request
+        p10request = new PKCS10CertificationRequest("SHA1WithRSA",
+                CertTools.stringToBcX509Name(reqdn), keys.getPublic(), set, keys.getPrivate());
+        
+        // Create self signed cert, validity 1 day
+        cert = CertTools.genSelfCert(reqdn,24*60*60*1000,null,keys.getPrivate(),keys.getPublic(),false);
+        
+        // wrap message in pkcs#7
+        byte[] msg = wrap(p10request.getEncoded(), "19");
+        return msg;        
+    }
+    
+    private CMSEnvelopedData envelope(CMSProcessable envThis) throws NoSuchAlgorithmException, NoSuchProviderException, CMSException {
+        CMSEnvelopedDataGenerator edGen = new CMSEnvelopedDataGenerator();
+        // Envelope the CMS message
+        edGen.addKeyTransRecipient(cacert);
+        CMSEnvelopedData ed = edGen.generate(envThis, SMIMECapability.dES_CBC.getId(), "BC");
+        return ed;
+    }
+    private CMSSignedData sign(CMSProcessable signThis, String messageType) throws NoSuchAlgorithmException, NoSuchProviderException, CMSException, IOException, InvalidAlgorithmParameterException, CertStoreException {
+        CMSSignedDataGenerator gen1 = new CMSSignedDataGenerator();
+
+        // add authenticated attributes...status, transactionId, sender- and more...
+        Hashtable attributes = new Hashtable();
+        DERObjectIdentifier oid;
+        Attribute attr;
+        DERSet value;
+        
+        // Message type (certreq)
+        oid = new DERObjectIdentifier(ScepRequestMessage.id_messageType);
+        value = new DERSet(new DERPrintableString(messageType));
+        attr = new Attribute(oid, value);
+        attributes.put(attr.getAttrType(), attr);
+
+        // TransactionId
+        byte[] digest = CertTools.generateMD5Fingerprint(cert.getPublicKey().getEncoded());
+        transactionId = new String(Base64.encode(digest));
+        oid = new DERObjectIdentifier(ScepRequestMessage.id_transId);
+        value = new DERSet(new DERPrintableString(Base64.encode(digest)));
+        attr = new Attribute(oid, value);
+        attributes.put(attr.getAttrType(), attr);
+
+        // senderNonce
+        byte[] nonce = new byte[16];
+        SecureRandom randomSource = SecureRandom.getInstance("SHA1PRNG");
+        randomSource.nextBytes(nonce);
+        senderNonce = new String(Base64.encode(nonce));
+        if (nonce != null) {
+            oid = new DERObjectIdentifier(ScepRequestMessage.id_senderNonce);
+            log.debug("Added senderNonce: " + senderNonce);
+            value = new DERSet(new DEROctetString(nonce));
+            attr = new Attribute(oid, value);
+            attributes.put(attr.getAttrType(), attr);
+        }
+
+        // Add our signer info and sign the message
+        ArrayList certList = new ArrayList();
+        certList.add(cert);
+        CertStore certs = CertStore.getInstance("Collection", new CollectionCertStoreParameters(certList), "BC");
+        gen1.addCertificatesAndCRLs(certs);
+        gen1.addSigner(keys.getPrivate(), cert, CMSSignedDataGenerator.DIGEST_SHA1,
+                new AttributeTable(attributes), null);
+        // The signed data to be enveloped
+        CMSSignedData s = gen1.generate(signThis, true, "BC");
+        return s;
+    }
+    private byte[] wrap(byte[] envBytes, String messageType) throws IOException, NoSuchAlgorithmException, NoSuchProviderException, CMSException, InvalidAlgorithmParameterException, CertStoreException {
+
+        // 
+        // Create inner enveloped data
+        //
+        CMSEnvelopedData ed = envelope(new CMSProcessableByteArray(envBytes));
+        log.debug("Enveloped data is " + ed.getEncoded().length + " bytes long");
+        CMSProcessable msg = new CMSProcessableByteArray(ed.getEncoded());
+        //
+        // Create the outer signed data
+        //
+        CMSSignedData s = sign(msg, messageType);
+        
+        byte[] ret = s.getEncoded();
+        return ret;
+        
+    }
+}
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/protocol/TestMessages.java ./src/test/se/anatom/ejbca/protocol/TestMessages.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/protocol/TestMessages.java	Thu Jun 10 18:17:44 2004
+++ ./src/test/se/anatom/ejbca/protocol/TestMessages.java	Thu Aug  4 16:59:14 2005
@@ -17,165 +17,26 @@
 import java.io.InputStream;
 import java.security.KeyStore;
 import java.security.PrivateKey;
+import java.security.PublicKey;
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 
 import junit.framework.TestCase;
+
 import org.apache.log4j.Logger;
+
 import se.anatom.ejbca.util.Base64;
 import se.anatom.ejbca.util.CertTools;
 import se.anatom.ejbca.util.KeyTools;
 
 
 /**
- * Tests signing session.
+ * Protocol messages.
  *
- * @version $Id: TestMessages.java,v 1.1 2004/06/10 16:17:44 sbailliez Exp $
+ * @version $Id: TestMessages.java,v 1.1.2.1 2005/08/04 14:59:14 anatom Exp $
  */
 public class TestMessages extends TestCase {
-    static byte[] keytoolp10 = Base64.decode(("MIIBbDCB1gIBADAtMQ0wCwYDVQQDEwRUZXN0MQ8wDQYDVQQKEwZBbmFUb20xCzAJBgNVBAYTAlNF" +
-            "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY+ATE4ZB0oKfmXStu8J+do0GhTag6rOGtoydI" +
-            "eNX9DdytlsmXDyONKl8746478/3HXdx9rA0RevUizKSataMpDsb3TjprRjzBTvYPZSIfzko6s8g6" +
-            "AZLO07xCFOoDmyRzb9k/KEZsMls0ujx79CQ9p5K4rg2ksjmDeW7DaPMphQIDAQABoAAwDQYJKoZI" +
-            "hvcNAQEFBQADgYEAyJVobqn6wGRoEsdHxjoqPXw8fLrQyBGEwXccnVpI4kv9iIZ45Xres0LrOwtS" +
-            "kFLbpn0guEzhxPBbL6mhhmDDE4hbbHJp1Kh6gZ4Bmbb5FrwpvUyrSjTIwwRC7GAT00A1kOjl9jCC" +
-            "XCfJkJH2QleCy7eKANq+DDTXzpEOvL/UqN0=").getBytes());
-    static byte[] oldbcp10 = Base64.decode(("MIIBbDCB1gIBADAtMQswCQYDVQQGEwJTRTEPMA0GA1UEChMGQW5hVG9tMQ0wCwYDVQQDEwRUZXN0" +
-            "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzN9nDdwmq23/RLGisvR3CRO9JSem2QZ7JC7nr" +
-            "NlbxQBLVqlkypT/lxMMur+lTX1S+jBaqXjtirhZTVaV5C/+HObWZ5vrj30lmsCdgzFybSzVxBz0l" +
-            "XC0UEDbgBml/hO70cSDdmyw3YE9g5eH3wdYs2FCTzexRF3kNAVHNUa8svwIDAQABoAAwDQYJKoZI" +
-            "hvcNAQEFBQADgYEAm6uRSyEmyCcs652Ttg2npm6JZPFT2qwSl4dviyIKJbn6j+meCzvn2TMP10d8" +
-            "7Ak5sv5NJew1XGkM4mGpF9cfcVshxLVlW+cgq0749fWbyS8KlgQP/ANh3DkLl8k5E+3Wnbi0JjCV" +
-            "Xe1s44+K2solX8jOtryoR4TMJ6p9HpsuO68=").getBytes());
-    static byte[] iep10 = Base64.decode(("MIICnTCCAgYCAQAwGzEZMBcGA1UEAxMQNkFFSzM0N2Z3OHZXRTQyNDCBnzANBgkq" +
-            "hkiG9w0BAQEFAAOBjQAwgYkCgYEAukW70HN9bt5x2AiSZm7y8GXQuyp1jN2OIvqU" +
-            "sr0dzLIOFt1H8GPJkL80wx3tLDj3xJfWJdww3TqExsxMSP+qScoYKIOeNBb/2OMW" +
-            "p/k3DThCOewPebmt+M08AClq5WofXTG+YxyJgXWbMTNfXKIUyR0Ju4Spmg6Y4eJm" +
-            "GXTG7ZUCAwEAAaCCAUAwGgYKKwYBBAGCNw0CAzEMFgo1LjAuMjE5NS4yMCAGCisG" +
-            "AQQBgjcCAQ4xEjAQMA4GA1UdDwEB/wQEAwIE8DCB/wYKKwYBBAGCNw0CAjGB8DCB" +
-            "7QIBAR5cAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBuAGgAYQBuAGMAZQBkACAAQwBy" +
-            "AHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAgAHYAMQAu" +
-            "ADADgYkAjuYPzZPpbLgCWYnXoNeX2gS6nuI4osrWHlQQKcS67VJclhELlnT3hBb9" +
-            "Blr7I0BsJ/lguZvZFTZnC1bMeNULRg17bhExTg+nUovzPcJhMvG7G3DR17PrJ7V+" +
-            "egHAsQV4dQC2hOGGhOnv88JhP9Pwpso3t2tqJROa5ZNRRSJSkw8AAAAAAAAAADAN" +
-            "BgkqhkiG9w0BAQQFAAOBgQCL5k4bJt265j63qB/9GoQb1XFOPSar1BDFi+veCPA2" +
-            "GJ/vRXt77Vcr4inx9M51iy87FNcGGsmyesBoDg73p06UxpIDhkL/WpPwZAfQhWGe" +
-            "o/gWydmP/hl3uEfE0E4WG02UXtNwn3ziIiJM2pBCGQQIN2rFggyD+aTxwAwOU7Z2" + "fw==").getBytes());
-    static byte[] openscep = Base64.decode(("MIIGqwYJKoZIhvcNAQcCoIIGnDCCBpgCAQExDjAMBggqhkiG9w0CBQUAMIICuwYJ" +
-            "KoZIhvcNAQcBoIICrASCAqgwggKkBgkqhkiG9w0BBwOgggKVMIICkQIBADGB1TCB" +
-            "0gIBADA7MC8xDzANBgNVBAMTBlRlc3RDQTEPMA0GA1UEChMGQW5hVG9tMQswCQYD" +
-            "VQQGEwJTRQIIbzEhUVZYO3gwDQYJKoZIhvcNAQEBBQAEgYCksIoSXYsCQPot2DDW" +
-            "dexdFqLj1Fuz3xSpu/rLozXKxEY0n0W0JXRR9OxxuyqNw9cLZhiyWkNsJGbP/rEz" +
-            "yrXe9NXuLK5U8+qqE8OhnY9BhCxjeUJSLni6oCSi7YzwOqdg2KmifJrQQI/jZIiC" +
-            "tSISAtE6qi6DKQwLCkQLmokLrjCCAbIGCSqGSIb3DQEHATARBgUrDgMCBwQILYvZ" +
-            "rBWuC02AggGQW9o5MB/7LN4o9G4ZD1l2mHzS+g+Y/dT2qD/qIaQi1Mamv2oKx9eO" +
-            "uFtaGkBBGWZlIKg4mm/DFtvXqW8Y5ijAiQVHHPuRKNyIV6WVuFjNjhNlM+DWLJR+" +
-            "rpHEhvB6XeDo/pd+TyOKFcxedMPTD7U+j46yd46vKdmoKAiIF21R888uVSz3GDts" +
-            "NlqgvZ7VlaI++Tj7aPdOI7JTdQXZk2FWF7Ql0LBIPwk9keffptF5if5Y+aHqB0a2" +
-            "uQj1aE8Em15VG8p8MmLJOX0OA1aeqfxR0wk343r44UebliY2DE8cEnym/fmya30/" +
-            "7WYzJ7erWofO2ukg1yc93wUpyIKxt2RGIy5geqQCjCYSSGgaNFafEV2pnOVSx+7N" +
-            "9z/ICNQfDBD6b83MO7yPHC1cXcdREKHHeqaKyQLiVRk9+R/3D4vEZt682GRaUKOY" +
-            "PQXK1Be2nyZoo4gZs62nZVAliJ+chFkEUog9k9OsIvZRG7X+VEjVYBqxlE1S3ikt" +
-            "igFXiuLC/LDCi3IgVwQjfNx1/mhxsO7GSaCCAfswggH3MIIBYKADAgEDAiA4OEUy" +
-            "REVFNDcwNjhCQjM3RjE5QkE2NDdCRjAyRkQwRjANBgkqhkiG9w0BAQQFADAyMQsw" +
-            "CQYDVQQGEwJTZTERMA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcw" +
-            "HhcNMDMwNjAxMDgzNDQyWhcNMDMwNzAxMDgzNDQyWjAyMQswCQYDVQQGEwJTZTER" +
-            "MA8GA1UEChMIUHJpbWVLZXkxEDAOBgNVBAMTB1RvbWFzIEcwgZ8wDQYJKoZIhvcN" +
-            "AQEBBQADgY0AMIGJAoGBAOu47fpIQfzfSnEBTG2WJpKZz1891YLNulc7XgMk8hl3" +
-            "nVC4m34SaR7eXR3nCsorYEpPPmL3affaPFsBnNBQNoZLxKmQ1RKiDyu8dj90AKCP" +
-            "CFlIM2aJbKMiQad+dt45qse6k0yTrY3Yx0hMH76tRkDif4DjM5JUvdf4d/zlYcCz" +
-            "AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAGNoWI02kXNEA5sPHb3KEY8QZoYM5Kha1" +
-            "JA7HLmlXKy6geeJmk329CUnvF0Cr7zxbMkFRdUDUtR8omDDnGlBSOCkV6LLYH939" +
-            "Z8iysfaxigZkxUqUYGLtYHhsEjVgcpfKZVxTz0E2ocR2P+IuU04Duel/gU4My6Qv" +
-            "LDpwo1CQC10xggHDMIIBvwIBATBWMDIxCzAJBgNVBAYTAlNlMREwDwYDVQQKEwhQ" +
-            "cmltZUtleTEQMA4GA1UEAxMHVG9tYXMgRwIgODhFMkRFRTQ3MDY4QkIzN0YxOUJB" +
-            "NjQ3QkYwMkZEMEYwDAYIKoZIhvcNAgUFAKCBwTASBgpghkgBhvhFAQkCMQQTAjE5" +
-            "MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAzMDYw" +
-            "MTA4MzQ0MlowHwYJKoZIhvcNAQkEMRIEEBqGJFo7n4B8sFBCi54PckIwIAYKYIZI" +
-            "AYb4RQEJBTESBBA77Owxh2rbflhXsDYw3xsLMDAGCmCGSAGG+EUBCQcxIhMgODhF" +
-            "MkRFRTQ3MDY4QkIzN0YxOUJBNjQ3QkYwMkZEMEYwDQYJKoZIhvcNAQEBBQAEgYB4" +
-            "BPcw4NPIt4nMOFKSGg5oM1nGDPGFN7eorZV+/2uWiQfdtK4B4lzCTuNxWRT853dW" +
-            "dRDzXBCGEArlG8ef+vDD/HP9SX3MQ0NJWym48VI9bTpP/mJlUKSsfgDYHohvUlVI" +
-            "E5QFC6ILVLUmuWPGchUEAb8t30DDnmeXs8QxdqHfbQ==").getBytes());
-    static byte[] pixscep = Base64.decode(("MIAGCSqGSIb3DQEHAqCAMIACAQExDjAMBggqhkiG9w0CBQUAMIAGCSqGSIb3DQEH" +
-            "AaCAJIAEggOZMIAGCSqGSIb3DQEHA6CAMIACAQAxgDCCAYMCAQAwazBfMSYwJAYJ" +
-            "KoZIhvcNAQkBFhdwb3N0bWFzdGVyQHRkY29ubGluZS5kazEPMA0GA1UEAxMGdGRj" +
-            "b2NhMRYwFAYDVQQLEw1PbmxpbmUgUHJpdmF0MQwwCgYDVQQKEwNUREMCCD7fK8fm" +
-            "K2DpMA0GCSqGSIb3DQEBAQUABIIBABlqDG3Jx7NJ4VLTb38JxUB3hhpRx+TUMmjZ" +
-            "PG64gFDcK8aNSW5O8dIG09GcfD1dyaW1lwVRUpcFlraEWWCV3xjpM2wPARZ169dL" +
-            "j1K/Y+s4mZsqppm45d0KT7jQ/e0oBJUukJq67rtc90Qyst4W9eGYERulxiQTOILD" +
-            "x43IpHOGlr9ta1oTsxVKvB6mxdGSSdlkem6eozEkKe2cUbDPGVvc4/O5F/zK7jrb" +
-            "L6woflqhwOc+faEOnuCETlr9MUvyN0XdMUbp6Rc3YQkfZj0otgPQ4GjCKfwtui2R" +
-            "LT4eD4m0TOuwFlsV+E0YJJFMLxrhjowIeZap2HKSpZ6Qmhmv0EQAADCABgkqhkiG" +
-            "9w0BBwEwEQYFKw4DAgcECB3fKGT54qD/oIAEggHAA1e6sQ+qC5YZ0BsYz2tKpWHk" +
-            "+dTCsKvRByxTDTjz5xm21pVvyd5iM/k08S674uuxW+V91Rt4OJ13YOUuZ27dyfz8" +
-            "rf/1kRFI0Y8He8Ye5mwJ5beAHiv4gb2hlci8doPp8FkeerB/HM1JxBV0/GQWugyo" +
-            "b6Z3clqXa3WkTI1Pa8dIKql4a1QBi+iXiz+Tg8BR+yUIKHdmfc6HISOqGGmthB5+" +
-            "x7uOjqK4unI3LILauAfRbeQQalFn/PUxQuxNJWf2A0lOwxxtIEVBX0XwxKkejuX6" +
-            "CVxDKaTkt90g3zeZLYvsEdLieGPnw4NhC91/+NycQdjoOpEQCGHjgUGRwX2v0CKg" +
-            "hMSpFLTrsWB/o5X6G/Z5mdAKGKVIoBIj15BxesJAAx8KI3Rni8opie/EWjiXOEwb" +
-            "d6+Ie80jxxyccsXgpBLNnx8EUmQzU1RwWOq3jmzJCtDzKHljaqCxTi6uyFAbsCF9" +
-            "Okl2Qj1qc+rX9ah+F53BDHfXuV3WpCFBSCxi7/G48LXc7Lna6vcEY9eYR3alpUDW" +
-            "ciV7k92bQgBwwHuaXh4brb0MytCcgVUXEwHL6+GI9CHsMT6JlMezIsCTlqZlIwQI" +
-            "57+qPArzctYAAAAAAAAAAAAAAAAAAAAAoIAwggI0MIIBnQIgNzBiNDg2ZmZmMmYy" +
-            "ZWIxYzAzZmRiYjljOWFjNmE2MmEwDQYJKoZIhvcNAQEEBQAwUzFRMA8GA1UEBRMI" +
-            "MzAxYjJkODkwGwYDVQQDExRodWwudGVrbmV0Lm9wYXNpYS5kazAhBgkqhkiG9w0B" +
-            "CQIWFGh1bC50ZWtuZXQub3Bhc2lhLmRrMB4XDTA0MDMxMTA5MTQ1NFoXDTE0MDMw" +
-            "OTA5MTQ1NFowUzFRMA8GA1UEBRMIMzAxYjJkODkwGwYDVQQDExRodWwudGVrbmV0" +
-            "Lm9wYXNpYS5kazAhBgkqhkiG9w0BCQIWFGh1bC50ZWtuZXQub3Bhc2lhLmRrMIGf" +
-            "MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/AtkNDP14TWSkJqDCtPu3T3JeqvyY" +
-            "3Jqww+3ZNfUbs9njCycuiajHbbDVKEyffXCOtzE7GtkcSXJZKntbTICT7N4M+eot" +
-            "EHOtri3l9DkvXWqdvHw21d4i83q+NKPkaXmo6h5yIwmtDQEVIccLDwQydMb0XDgK" +
-            "PjCOm9MC33Pm2wIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAAzXcoUUTmNV4UyxZ/01" +
-            "FHafeqQJmmq66+TrIXUAcwfWyvtgIRGDb/kif2NsjDtvFvnlXUiM57K/I+/qVqQm" +
-            "HF1Thx1L/sbvNwWqYZxyWJPm1TQaw2zvAu0Hpc53/T49dH8LgYYrwEOXRTyW5YE1" +
-            "9fMRCmp78VeN/nJyoOGcJKigAAAxgDCCAcICAQEwdzBTMVEwDwYDVQQFEwgzMDFi" +
-            "MmQ4OTAbBgNVBAMTFGh1bC50ZWtuZXQub3Bhc2lhLmRrMCEGCSqGSIb3DQEJAhYU" +
-            "aHVsLnRla25ldC5vcGFzaWEuZGsCIDcwYjQ4NmZmZjJmMmViMWMwM2ZkYmI5Yzlh" +
-            "YzZhNjJhMAwGCCqGSIb3DQIFBQCggaMwEgYKYIZIAYb4RQEJAjEEEwIxOTAYBgkq" +
-            "hkiG9w0BCQMxCwYJKoZIhvcNAQcBMB8GCSqGSIb3DQEJBDESBBCQVbLp6teJEWNq" +
-            "nBD/Kr1GMCAGCmCGSAGG+EUBCQUxEgQQbpDDbO95LE1U7ZbbEe2p8TAwBgpghkgB" +
-            "hvhFAQkHMSITIDcwYjQ4NmZmZjJmMmViMWMwM2ZkYmI5YzlhYzZhNjJhMA0GCSqG" +
-            "SIb3DQEBAQUABIGAfiGzBNxJiy4XI3DG13Osso4qV+7rvwg+CVbe0gqt01s1kd5A" +
-            "LxwTYVhXXKG1spaBnebu+T9xZDZqvF9eY1ANJVNSIpNygKmJdhjsJivKFkD9Jz2y" +
-            "F/BYZzv618HlvZQj9Sbv7PaODRU4xqGVifa6LllK/572uQdUQj3FTkssqFQAAAAA" +
-            "AAAAAA==").getBytes());
-    static byte[] p12 = Base64.decode(("MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCAy4wgDCABgkqhkiG9w0BBwGggCSABIID" +
-            "FjCCAxIwggMOBgsqhkiG9w0BDAoBAqCCArEwggKtMCcGCiqGSIb3DQEMAQMwGQQU" +
-            "VnhToLFkCvaqCu8OkXi6Jljy/Y8CAWQEggKAv4LDUWwUi7eZKiCoYsqevVUAEOwE" +
-            "dy8xOmtyjzEPO0W8pltybVk2nfEaS6CrPQLvi1aAQD/5NjkO0agfgwS8gOZPIRaX" +
-            "HzETkxsR6tNd1eP5jGXOYfxhQGGL3laVvvGhrNFbx7AW/ugMgBPMj+OWRkuSMVBY" +
-            "uZgmBX3CM14UFl1X4jVG/nX/eS1LKIdDI2hcebWvkpuOWR46LxH1yXgSqW0RYjCV" +
-            "ZhNvsQtvQGfgMBgGOhjec+p6xMiw8OXSR6kfDVHJyJfFwqz2DTz1zIfi28WPVCSv" +
-            "2TmMPvPFGjbE5bo8PlVh5Gu5sX9DzQQ41Vio/c1dxwBDe4CgAYuDfI0Fu0ZVSMZM" +
-            "TSDt7lC4t/YoxqFCxSBn9pmYOCLBiBmQgtzJZfQYrMJSdaBqXWNx5vUibd+K/tzL" +
-            "Hfik1SmH+MY8bjBC/PSlCz8cbAwAdqGKCN5kjT+RcPM5oRIAc4isXs+epApzf4jF" +
-            "AKqgNFnHKfgTEabVT9E/QUEwS7PfDi2jzID/8a3LUQvjp95B9kD6DJH4nlIZVT+2" +
-            "aHzOooZ2K54pqq2OlS6yeYKRo2GcGdVcm13zw+wBnw+2Zz34zrzd1Uq9wGuoduNF" +
-            "VJNKqNkLvva94InFAaiPbHgAkH179pVF8oTeFOh0NXBTj4mZQgpgYPO1ASMZEvY7" +
-            "5nC/Uf+6kyr92qc0s4GpAV1Sm2lsSyBdINAxSnzW2XSJ389RztAN5H6ycUcJBbaG" +
-            "N9DfBSxK8kkFRW7b8dx7PXd2ofe9U/pIJgRlscPSC30cRRp4jT2JXvpW+D3EocI8" +
-            "uUEzRSliEpec1zn2SrPUKCCQVc6BoBHsN62/I1LtM2+Wybx5fyRGsw7i4zFKMCMG" +
-            "CSqGSIb3DQEJFDEWHhQAcAByAGkAdgBhAHQAZQBLAGUAeTAjBgkqhkiG9w0BCRUx" +
-            "FgQUY3v0dqhUJI6ldKV3RKb0Xg9XklEABAEABAEABAEABAEABIIDAgAwgAYJKoZI" +
-            "hvcNAQcGoIAwgAIBADCABgkqhkiG9w0BBwEwJwYKKoZIhvcNAQwBBjAZBBTDw4v0" +
-            "l2xpgaM/AkWLRwcyAaI5lQIBZKCABIICsEY/4hTSq1sKzRlg+oP1Cu/fGipwALox" +
-            "HFj5wvC+hN78ZMjFYAK3b61ft0hUKeqtmzDDzgbMn9qEjsV3WERKID1AqNy18a2j" +
-            "i7MuR2sidbz7H7pOr2QrKajmiFf4IKiXXiqrx9qnF40l3HzUGaiGw36BvFZ1lXkJ" +
-            "HRA97mTcuEczZXkp5N+U9e7sztQE0b7MYcGPYi01CpJzYSRryU4BRG4a0vRhEJFp" +
-            "mHu+mfpaBux93HvOeOFD/bb59EUuoGgog2dYUFRL4ZTH99I0MpcHbRp/wIeNdMpJ" +
-            "KOjzrw1OHzkkqLOTC/m4nI+da3OXShPdByTHHdZ29fNYCVxdOgqUtym1PP7cHsUn" +
-            "Y5PThfXM5ZXV0G7pvC0zVz+qTS6G+Xg8bu91g07jh5HOSHOUfa/XMhhLZFUgYr9r" +
-            "7ZId98C+lg7atW3LjhJ9FPawogXpDXp+wo/NNp2Lq7KHyevJSfwkrLMOeETo9tMY" +
-            "NUv/zPPGpiVUZX75zNkOx+YlL0dUJ4VcorXpDRs/OwM7CEGJSuGytXLz7eNEYVak" +
-            "iLhlb8vwJrkrlhFDd7vu9G5UAOb4Sp7IWwEooO/yo6/rDusXoT6+jFJ6bt27lEFj" +
-            "3PUYSijBCbVtn7Wqd6sKWqeCd10RZjz5AME3xiOcKWPtIYfFsztJmvjuRBxM5gi0" +
-            "QOwqdNd63apOv1I/nzPDgBYlIhH7kn+5jMb0RHJarMWuSTJQDpQYctRnpvPSM1HE" +
-            "srjxQ8n4Ukbg+XoUHTS4VPuxGf0NYakW5CZDJeKaJ+a/R3oU37esYOikmMJPnSUa" +
-            "PKZ1XJeHqK7kCrnbiw/WOYowaUw+BuIjpqSwgNyWktKLXWKreMtKjGtbxZ01BSsM" +
-            "VhyB+EXgjzqMBGGnCxbJ0aA4AoSBS73XvqlB+S8FUbmi7XfzPvKM4XMABAEABAEA" +
-            "BAEABAEABAEABAEABAEABAEABAEABAEABAEAAAAAAAAAMDwwITAJBgUrDgMCGgUA" +
-            "BBQ/qUCCCV8/5FhF5438mA7FYj0eKQQUC1bpAMlQMV4fwFz/nNVuiJUqmkYCAWQA" + "AA==").getBytes());
+
     private PrivateKey privateKey = null;
     private X509Certificate caCert = null;
     private static Logger log = Logger.getLogger(TestMessages.class);
@@ -200,7 +61,7 @@
         String keyStorePass = "foo123";
         keyStore.load(is, keyStorePass.toCharArray());
 
-        String privateKeyAlias = "privateKey";
+        String privateKeyAlias = "privatesignkeyalias";
         char[] pkPass = null;
         privateKey = (PrivateKey) keyStore.getKey(privateKeyAlias, pkPass);
 
@@ -213,6 +74,7 @@
         Certificate[] certchain = KeyTools.getCertChain(keyStore, privateKeyAlias);
         caCert = (X509Certificate) certchain[0];
 
+        
         //System.out.println(caCert.toString());
         log.debug("<setUp()");
     }
@@ -229,25 +91,114 @@
         // You should be able to get issuer DN before anything else
         String issuerdn = msg.getIssuerDN();
         log.debug("IssuerDN: " + issuerdn);
-        assertEquals("CN=TestCA,O=AnaTom,C=SE", issuerdn);
+        assertEquals("CN=AdminCA1,O=EJBCA Sample,C=SE", issuerdn);
         if (msg.requireKeyInfo()) {
             msg.setKeyInfo(caCert, privateKey);
         }
         boolean ret = msg.verify();
+        assertTrue("Failed to verify SCEP message from OpenSCEP.", ret);
         String dn = msg.getRequestDN();
         log.debug("DN: " + dn);
-        assertEquals("C=Se,O=PrimeKey,CN=Tomas G", dn);
+        assertEquals("C=SE,O=Foo,CN=openscep", dn);
+        String username = msg.getUsername();
+        assertEquals("openscep", username);
         String pwd = msg.getPassword();
         log.debug("Pwd: " + pwd);
         assertEquals("foo123", pwd);
-        assertTrue("Failed to verify SCEP message from OpenSCEP.", ret);
         log.debug("<test01TestOpenScep()");
     }
 
+    /** Tests scep message from Simple Scep
+     * @throws Exception error
+     */
+    public void test02TestSimpleScep() throws Exception {
+        log.debug(">test02TestSimpleScep()");
+        ScepRequestMessage msg = new ScepRequestMessage(sscep);
+        // You should be able to get issuer DN before anything else
+        String issuerdn = msg.getIssuerDN();
+        log.debug("IssuerDN: " + issuerdn);
+        assertEquals("CN=AdminCA1,O=EJBCA Sample,C=SE", issuerdn);
+        if (msg.requireKeyInfo()) {
+            msg.setKeyInfo(caCert, privateKey);
+        }
+        boolean ret = msg.verify();
+        assertTrue("Failed to verify SCEP message from Simple Scep.", ret);
+        String dn = msg.getRequestDN();
+        log.debug("DN: " + dn);
+        assertEquals("C=SE,O=Foo,CN=openscep", dn);
+        String username = msg.getUsername();
+        assertEquals("openscep", username);
+        String pwd = msg.getPassword();
+        log.debug("Pwd: " + pwd);
+        assertEquals("foo123", pwd);
+        log.debug("<test02TestSimpleScep()");
+    }
+
+    /** Tests scep message from Java Scep Client
+     * @throws Exception error
+     */
+    public void test03TestJavaScepClient() throws Exception {
+        log.debug(">test03TestJavaScepClient()");
+        ScepRequestMessage msg = new ScepRequestMessage(scepclient);
+        // You should be able to get issuer DN before anything else
+        String issuerdn = msg.getIssuerDN();
+        log.debug("IssuerDN: " + issuerdn);
+        assertEquals("CN=AdminCA1,O=EJBCA Sample,C=SE", issuerdn);
+        if (msg.requireKeyInfo()) {
+            msg.setKeyInfo(caCert, privateKey);
+        }
+        boolean thrown = false;
+        try {
+            // We know this will throw an exception since scepclient doesn't work
+            // If it starts working we know there is something wrong
+            boolean ret = msg.verify();  
+            assertTrue("Failed to verify SCEP message from Java Scep Client.", ret);
+        } catch (IllegalArgumentException e) {
+            thrown = true;
+        }
+        assertTrue(thrown);
+        /*
+        String dn = msg.getRequestDN();
+        log.debug("DN: " + dn);
+        assertEquals("C=SE,O=Foo,CN=openscep", dn);
+        String username = msg.getUsername();
+        assertEquals("openvpn", username);
+        String pwd = msg.getPassword();
+        log.debug("Pwd: " + pwd);
+        assertEquals("foo123", pwd);
+        */
+        log.debug("<test03TestJavaScepClient()");
+    }
+    /** Tests scep message from Cisco VPN client
+     * @throws Exception error
+     */
+    public void test03TestCiscoVPNScep() throws Exception {
+        log.debug(">test03TestCiscoVPNScep()");
+        ScepRequestMessage msg = new ScepRequestMessage(ciscovpnscep);
+        // You should be able to get issuer DN before anything else
+        String issuerdn = msg.getIssuerDN();
+        log.debug("IssuerDN: " + issuerdn);
+        assertEquals("CN=AdminCA1,O=EJBCA Sample,C=SE", issuerdn);
+        if (msg.requireKeyInfo()) {
+            msg.setKeyInfo(caCert, privateKey);
+        }
+        boolean ret = msg.verify();
+        assertTrue("Failed to verify SCEP message from Cisco VPN client.", ret);
+        String dn = msg.getRequestDN();
+        log.debug("DN: " + dn);
+        assertEquals("CN=ciscovpn", dn);
+        String username = msg.getUsername();
+        assertEquals("ciscovpn", username);
+        String pwd = msg.getPassword();
+        log.debug("Pwd: " + pwd);
+        assertEquals("foo123", pwd);
+        log.debug("<test03TestCiscoVPNScep()");
+    }
     /** Tests scep message from Cisco PIX
      * @throws Exception error
      */
-    public void test02TestPixScep() throws Exception {
+    /* This doesn't work because we don't have the right CA
+    public void test04TestPixScep() throws Exception {
         log.debug(">test02TestPixScep()");
         ScepRequestMessage msg = new ScepRequestMessage(pixscep);
         // You should be able to get issuer DN before anything else
@@ -258,6 +209,7 @@
             msg.setKeyInfo(caCert, privateKey);
         }
         boolean ret = msg.verify();
+        assertTrue(ret);
         String dn = msg.getRequestDN();
         log.debug("DN: " + dn);
         assertEquals("C=Se,O=PrimeKey,CN=Tomas G", dn);
@@ -265,7 +217,379 @@
         log.debug("Pwd: " + pwd);
         assertEquals("foo123", pwd);
         assertTrue("Failed to verify SCEP message from PIX.", ret);
-        log.debug("<test02TestPixScep()");
+        log.debug("<test04TestPixScep()");
+    } */
+    
+    public void test05KeyToolP10() throws Exception {
+        log.debug(">test05KeyToolP10()");
+        PKCS10RequestMessage msg = new PKCS10RequestMessage(keytoolp10);
+
+        boolean ret = msg.verify();
+        assertTrue(ret);
+        String dn = msg.getRequestDN();
+        log.debug("DN: " + dn);
+        assertEquals("CN=Test,O=AnaTom,C=SE", dn);
+        String pwd = msg.getPassword();
+        assertNull(pwd);
+        String username = msg.getUsername();
+        assertEquals("Test", username);
+        PublicKey pk = msg.getRequestPublicKey();
+        assertNotNull(pk);
+        String alg = pk.getAlgorithm();
+        assertEquals("RSA",alg);
+        
+        log.debug("<test05KeyToolP10()");        
     }
 
+    public void test06OldBCP10() throws Exception {
+        log.debug(">test06OldBCP10()");
+        PKCS10RequestMessage msg = new PKCS10RequestMessage(oldbcp10);
+
+        boolean ret = msg.verify();
+        assertTrue(ret);
+        String dn = msg.getRequestDN();
+        log.debug("DN: " + dn);
+        assertEquals("C=SE,O=AnaTom,CN=Test", dn);
+        String pwd = msg.getPassword();
+        assertNull(pwd);
+        String username = msg.getUsername();
+        assertEquals("Test", username);
+        PublicKey pk = msg.getRequestPublicKey();
+        assertNotNull(pk);
+        String alg = pk.getAlgorithm();
+        assertEquals("RSA",alg);
+        
+        log.debug("<test06OldBCP10()");        
+    }
+    public void test07IEP10() throws Exception {
+        log.debug(">test07IEP10()");
+        PKCS10RequestMessage msg = new PKCS10RequestMessage(iep10);
+
+        boolean ret = msg.verify();
+        assertTrue(ret);
+        String dn = msg.getRequestDN();
+        log.debug("DN: " + dn);
+        assertEquals("CN=6AEK347fw8vWE424", dn);
+        String pwd = msg.getPassword();
+        assertNull(pwd);
+        String username = msg.getUsername();
+        assertEquals("6AEK347fw8vWE424", username);
+        PublicKey pk = msg.getRequestPublicKey();
+        assertNotNull(pk);
+        String alg = pk.getAlgorithm();
+        assertEquals("RSA",alg);
+        
+        log.debug("<test07IEP10()");        
+    }
+    
+    static byte[] keytoolp10 = Base64.decode(("MIIBbDCB1gIBADAtMQ0wCwYDVQQDEwRUZXN0MQ8wDQYDVQQKEwZBbmFUb20xCzAJBgNVBAYTAlNF" +
+            "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY+ATE4ZB0oKfmXStu8J+do0GhTag6rOGtoydI" +
+            "eNX9DdytlsmXDyONKl8746478/3HXdx9rA0RevUizKSataMpDsb3TjprRjzBTvYPZSIfzko6s8g6" +
+            "AZLO07xCFOoDmyRzb9k/KEZsMls0ujx79CQ9p5K4rg2ksjmDeW7DaPMphQIDAQABoAAwDQYJKoZI" +
+            "hvcNAQEFBQADgYEAyJVobqn6wGRoEsdHxjoqPXw8fLrQyBGEwXccnVpI4kv9iIZ45Xres0LrOwtS" +
+            "kFLbpn0guEzhxPBbL6mhhmDDE4hbbHJp1Kh6gZ4Bmbb5FrwpvUyrSjTIwwRC7GAT00A1kOjl9jCC" +
+    "XCfJkJH2QleCy7eKANq+DDTXzpEOvL/UqN0=").getBytes());
+    static byte[] oldbcp10 = Base64.decode(("MIIBbDCB1gIBADAtMQswCQYDVQQGEwJTRTEPMA0GA1UEChMGQW5hVG9tMQ0wCwYDVQQDEwRUZXN0" +
+            "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzN9nDdwmq23/RLGisvR3CRO9JSem2QZ7JC7nr" +
+            "NlbxQBLVqlkypT/lxMMur+lTX1S+jBaqXjtirhZTVaV5C/+HObWZ5vrj30lmsCdgzFybSzVxBz0l" +
+            "XC0UEDbgBml/hO70cSDdmyw3YE9g5eH3wdYs2FCTzexRF3kNAVHNUa8svwIDAQABoAAwDQYJKoZI" +
+            "hvcNAQEFBQADgYEAm6uRSyEmyCcs652Ttg2npm6JZPFT2qwSl4dviyIKJbn6j+meCzvn2TMP10d8" +
+            "7Ak5sv5NJew1XGkM4mGpF9cfcVshxLVlW+cgq0749fWbyS8KlgQP/ANh3DkLl8k5E+3Wnbi0JjCV" +
+    "Xe1s44+K2solX8jOtryoR4TMJ6p9HpsuO68=").getBytes());
+    static byte[] iep10 = Base64.decode(("MIICnTCCAgYCAQAwGzEZMBcGA1UEAxMQNkFFSzM0N2Z3OHZXRTQyNDCBnzANBgkq" +
+            "hkiG9w0BAQEFAAOBjQAwgYkCgYEAukW70HN9bt5x2AiSZm7y8GXQuyp1jN2OIvqU" +
+            "sr0dzLIOFt1H8GPJkL80wx3tLDj3xJfWJdww3TqExsxMSP+qScoYKIOeNBb/2OMW" +
+            "p/k3DThCOewPebmt+M08AClq5WofXTG+YxyJgXWbMTNfXKIUyR0Ju4Spmg6Y4eJm" +
+            "GXTG7ZUCAwEAAaCCAUAwGgYKKwYBBAGCNw0CAzEMFgo1LjAuMjE5NS4yMCAGCisG" +
+            "AQQBgjcCAQ4xEjAQMA4GA1UdDwEB/wQEAwIE8DCB/wYKKwYBBAGCNw0CAjGB8DCB" +
+            "7QIBAR5cAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBuAGgAYQBuAGMAZQBkACAAQwBy" +
+            "AHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAgAHYAMQAu" +
+            "ADADgYkAjuYPzZPpbLgCWYnXoNeX2gS6nuI4osrWHlQQKcS67VJclhELlnT3hBb9" +
+            "Blr7I0BsJ/lguZvZFTZnC1bMeNULRg17bhExTg+nUovzPcJhMvG7G3DR17PrJ7V+" +
+            "egHAsQV4dQC2hOGGhOnv88JhP9Pwpso3t2tqJROa5ZNRRSJSkw8AAAAAAAAAADAN" +
+            "BgkqhkiG9w0BAQQFAAOBgQCL5k4bJt265j63qB/9GoQb1XFOPSar1BDFi+veCPA2" +
+            "GJ/vRXt77Vcr4inx9M51iy87FNcGGsmyesBoDg73p06UxpIDhkL/WpPwZAfQhWGe" +
+            "o/gWydmP/hl3uEfE0E4WG02UXtNwn3ziIiJM2pBCGQQIN2rFggyD+aTxwAwOU7Z2" + 
+            "fw==").getBytes());
+    static byte[] openscep = Base64.decode(("MIIF3AYJKoZIhvcNAQcCoIIFzTCCBckCAQExDjAMBggqhkiG9w0CBQUAMIICvgYJ"+
+            "KoZIhvcNAQcBoIICrwSCAqswggKnBgkqhkiG9w0BBwOgggKYMIIClAIBADGCAV8w"+
+            "ggFbAgEAMEMwNzERMA8GA1UEAxMIQWRtaW5DQTExFTATBgNVBAoTDEVKQkNBIFNh"+
+            "bXBsZTELMAkGA1UEBhMCU0UCCFKNUA0mbQyIMA0GCSqGSIb3DQEBAQUABIIBADv6"+
+            "P/L3m1syqxfcN8hTnLhEKDpV2381g6/C7TDHTI/2Ro8C8x1p9FP9AFJQv4XDCncB"+
+            "EMeTyJxjuaHLdbx35uAZdOex38zwrczaaT+uf74OUVuyTKrRofctqjLFlaTXy8WL"+
+            "KqUXwt0fefDmnZhThiXXcplnTs5/CgfQAyHOYI9/PvdUyIqEfK+/ixvVWSYk0vp6"+
+            "jlYVwkSm06LiOysYbYp9B7nnbxBjjqKxK8vT7zjoId1U1ip2XB8mmfpw8Ahf3Mr2"+
+            "508krK+pen3uwawVaeucqN2b1xySKxox/FFwkHfif1L33esx65mp4661SFUdHjOH"+
+            "zuijrocx+Rj3S0w5/LUwggEqBgkqhkiG9w0BBwEwEQYFKw4DAgcECAMrD4EmoGjY"+
+            "gIIBCJYOYZ8RkGoH/U9j7rzMxWPGbUmlEtNERUowB9dg+lWftUHuWwmao8uGwRHr"+
+            "rPQ+QhTkGdMzwNG0PRAsG61M4Z7cF1o3URmAsXJpb/LiCGJoTX91L4SLtmBH9MRr"+
+            "ZGPFWKzm7kzVWpcpXO2+/Gv9bdSt8hJWWaceZFJeB6q7yHu/Y/Eofj7biz5C3+v8"+
+            "NcmDwsmNwBQwjTqpAVQ/1x52uA1lvaw7SKQ24L1kqm6nWA1XipbYRxBwvo23S5yb"+
+            "CJrEwp4swLkccesTESOLoN4gM0WN2EBHnpdOL7ZcWQBOg/+/6oxeaXPw96lW1Q77"+
+            "tYZuTnOfeaP5DY5lkUIEL4Yr81VloaPzsXo81qCCAW4wggFqMIIBFKADAgEDAiAw"+
+            "QzUyMzQzNjcyNzEyRjczNEQ4M0M1MkRBMTg3RkExNDANBgkqhkiG9w0BAQQFADAu"+
+            "MQswCQYDVQQGEwJTRTEMMAoGA1UEChMDRm9vMREwDwYDVQQDEwhvcGVuc2NlcDAe"+
+            "Fw0wNTA4MDMxMTI4MTVaFw0wNTA5MDIxMTI4MTVaMC4xCzAJBgNVBAYTAlNFMQww"+
+            "CgYDVQQKEwNGb28xETAPBgNVBAMTCG9wZW5zY2VwMFwwDQYJKoZIhvcNAQEBBQAD"+
+            "SwAwSAJBAKk7hSPJ2yobo/jFJTucp6fjO+w//giNNloBR66DvFKkuJrmrf59Li8J"+
+            "QXE3hOXWHgXUokYm3aVhMm9zomDh+F0CAwEAATANBgkqhkiG9w0BAQQFAANBADCU"+
+            "MOSzoqI97EYM7ut0FzsKKe4MWr4ftMKyK/1if6ZmrqKhB5W/k7yHfmrFXc5PySAE"+
+            "9NkIlvSO+ve9MTV1rkAxggF+MIIBegIBATBSMC4xCzAJBgNVBAYTAlNFMQwwCgYD"+
+            "VQQKEwNGb28xETAPBgNVBAMTCG9wZW5zY2VwAiAwQzUyMzQzNjcyNzEyRjczNEQ4"+
+            "M0M1MkRBMTg3RkExNDAMBggqhkiG9w0CBQUAoIHBMBIGCmCGSAGG+EUBCQIxBBMC"+
+            "MTkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUw"+
+            "ODAzMTEyODE1WjAfBgkqhkiG9w0BCQQxEgQQpw/eMRfE6qbrkh3Aw7ByQjAgBgpg"+
+            "hkgBhvhFAQkFMRIEEDBi3ch9EaexEb/QHSvGkqIwMAYKYIZIAYb4RQEJBzEiEyAw"+
+            "QzUyMzQzNjcyNzEyRjczNEQ4M0M1MkRBMTg3RkExNDANBgkqhkiG9w0BAQEFAARA"+
+            "Y5xIjYsxIQLVM8M3B9/mxni08SEqVSXwWJYjFfg9ISx/j/IaDwHCisn7by4zW06e"+
+    "4JaIa/rgTnUOJCZnLf4IuA==").getBytes());
+    static byte[] sscep = Base64.decode(("MIIF3AYJKoZIhvcNAQcCoIIFzTCCBckCAQExDjAMBggqhkiG9w0CBQUAMIICvgYJ"+
+            "KoZIhvcNAQcBoIICrwSCAqswggKnBgkqhkiG9w0BBwOgggKYMIIClAIBADGCAV8w"+
+            "ggFbAgEAMEMwNzERMA8GA1UEAxMIQWRtaW5DQTExFTATBgNVBAoTDEVKQkNBIFNh"+
+            "bXBsZTELMAkGA1UEBhMCU0UCCFKNUA0mbQyIMA0GCSqGSIb3DQEBAQUABIIBACje"+
+            "wUlnG2qbzoLZ0ZFovNZCtWbvEJKbYLX0sl7DUAzmGIjoEfQE1THar7Xzgj+xwnEk"+
+            "ZoxJCu3JwzElpXd8ptPCe3gvdRv7XAqh0kZ2hgrHa51D/xX1j2pU0Fl6IkbEzFej"+
+            "V8pN/7IqgB81g/neleo+k2UA0Jn2afKRoUZlZDidJz9tK+fumWOfPJBqTPghsVxx"+
+            "+LPFZEeE1OOT/fnH0uuNRiFj43vY+CfY+YrspSadthRdWbDJTUJ+sBVBnh1xX83Q"+
+            "6CjG22A4b+q8FUUta3+H8nnVLtAZfAwaU5/beTiw1t3UPMoJn8judZun2otWQbN0"+
+            "az2XiiYvhapEvwLth2wwggEqBgkqhkiG9w0BBwEwEQYFKw4DAgcECPHxpAekbhIP"+
+            "gIIBCKmFl5f+6wl04t9g2mD5vGwe1Nn/nG7tFn+m78HBdm+2DA03B+fCUu/Qvqnb"+
+            "CeTd5qnLD90nOqzX73BUSTTnlttKG4kN4wmdTd603saz3OeCV3urrnRpVh7SIeAh"+
+            "QMCG/Ul6XHTTCS1eVR88IbJmaLjNFeePQe1jz+yuJA/sikOlWPFiFkfJMMRhxxev"+
+            "4+VOcpi+z4jKzQhkNkWUA2HqutnE7GZg4wiyn+iIXXHCeT4HnrqIIgEcuiJRVUIu"+
+            "V/ySyE8TWg7mkJFEn/1rKo6J1V6Q8svFaziMvYFPw6h4ZHGJT6buTrjIEP6hZN+P"+
+            "nf9ePrjLunkqexpIR+Ejrzlg4KYef692PEny9qCCAW4wggFqMIIBFKADAgECAiAw"+
+            "QzUyMzQzNjcyNzEyRjczNEQ4M0M1MkRBMTg3RkExNDANBgkqhkiG9w0BAQQFADAu"+
+            "MQswCQYDVQQGEwJTRTEMMAoGA1UEChMDRm9vMREwDwYDVQQDEwhvcGVuc2NlcDAe"+
+            "Fw0wNTA4MDMxMTI2NTNaFw0wNTA4MDkxMzI2NTNaMC4xCzAJBgNVBAYTAlNFMQww"+
+            "CgYDVQQKEwNGb28xETAPBgNVBAMTCG9wZW5zY2VwMFwwDQYJKoZIhvcNAQEBBQAD"+
+            "SwAwSAJBAKk7hSPJ2yobo/jFJTucp6fjO+w//giNNloBR66DvFKkuJrmrf59Li8J"+
+            "QXE3hOXWHgXUokYm3aVhMm9zomDh+F0CAwEAATANBgkqhkiG9w0BAQQFAANBADU3"+
+            "m4OiT5RxWBb8tJE5LqQuz/kBH9qdwG+Bws/qVtsQjNGby1cY7QXNcBiUtmv3DTCo"+
+            "WPWuJdJCC7C8s+iiAokxggF+MIIBegIBATBSMC4xCzAJBgNVBAYTAlNFMQwwCgYD"+
+            "VQQKEwNGb28xETAPBgNVBAMTCG9wZW5zY2VwAiAwQzUyMzQzNjcyNzEyRjczNEQ4"+
+            "M0M1MkRBMTg3RkExNDAMBggqhkiG9w0CBQUAoIHBMBIGCmCGSAGG+EUBCQIxBBMC"+
+            "MTkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUw"+
+            "ODAzMTEyNjUzWjAfBgkqhkiG9w0BCQQxEgQQNE7agWOiOWxGiuNFoVJ5vTAgBgpg"+
+            "hkgBhvhFAQkFMRIEENX1p6qK9g+/tP1K8FPkOzwwMAYKYIZIAYb4RQEJBzEiEyAw"+
+            "QzUyMzQzNjcyNzEyRjczNEQ4M0M1MkRBMTg3RkExNDANBgkqhkiG9w0BAQEFAARA"+
+            "huyzMfvqURfBh3YZLyzLiKjucS2b72/TsN4Wo6Bes9mxIZOjc+BZ60M1MVhJtq0/"+
+    "1ttZ62RT+p4E0axVW1bwWw==").getBytes());
+    static byte[] scepclient = Base64.decode(("MIIGjgYJKoZIhvcNAQcCoIIGfzCCBnsCAQExDDAKBggqhkiG9w0CBTCCA1IGCSqG"+
+            "SIb3DQEHAaCCA0MEggM/MIIDOwYJKoZIhvcNAQcDoIIDLDCCAygCAQAxggFdMIIB"+
+            "WQIBADBDMDcxETAPBgNVBAMTCEFkbWluQ0ExMRUwEwYDVQQKEwxFSkJDQSBTYW1w"+
+            "bGUxCzAJBgNVBAYTAlNFAghSjVANJm0MiDALBgkqhkiG9w0BAQEEggEAn/Gnirf+"+
+            "lms6CcU5/d8JV7i9XJVVNbv478NcGRU61BsuSolLBeUWIhoVwVFIcV6P8qEjl2CH"+
+            "dpnMWgvQpwmmG2KJqq6dqkLS3HES6ucrs20r5OpHd8F/thk46UvHc61HhIiGXspp"+
+            "xAwHrCKSCKE5m/yH0ZVnSzaGOWdd9TQwJ/+7zDxAeRbrouAFN8oniTi4bHqBOyT9"+
+            "Wm7bKxO3GdoeESigrWtzuxIPbsVy31MHQ+MidHx7RzaAWnZHH6xMvu4yx6T9vxc0"+
+            "t/GVbfBl/ocDI0iPBhcW2G4s4sO/KCFA4bmzF1ROTYqEyvCEG9REihjX9CyOBk+K"+
+            "T9w/vRsu2scnrTCCAcAGCSqGSIb3DQEHATAHBgUrDgMCB4CCAaj66BdC8chDp2dP"+
+            "gpEdWfO5RnjdU5CATmSaMn72pW6cWYYo+ATyOCWMLTNUxDknNyETyB8yahHff8Yd"+
+            "vmwddAvh9Doj/FJlHgtnvOmy1338pbZXOf78/haoGycHdYuy76XeJGgRZbhhX9L5"+
+            "tg3j8drcuJ2AZaKxQrxzO+RM5Qhqp9EolD1mHkgw7hEnmhLftZ1fJIPIrBbflqHp"+
+            "6TsvpbRpht/dyLEFj3UoMIeLL8o7hDIXO9iSYd+4mroQL4juGZDZ+VKHDIbw/7dN"+
+            "IIJPMMxgYqfXxgvzbGrh4SWQggPEbDLS6Qe41eBBPnc6uIHljT3H1dSaYDDCFJ2E"+
+            "ZybSqlTF4EpaHqVpQRylQya2zh9RTbwMKt+3D/vJtn8bNN4GA2DP3k2wuWax644j"+
+            "6yL1gjSL1HNYgd8Mn+2jDLul3oMoFQXarWf9qJnwm8jSrINTlfB/IgQBwaIcu4Ah"+
+            "8wTBCaSYGskxfGXvI/O7z1uYhR9JPA9QZiQzoE8Ix3X+RteDjQem5PrxSAy0uChB"+
+            "6ibJyF61E854Xli4r0buHAncd1LF5VH6ZUJcStlaoIIBozCCAZ8wggEKoAMCAQIC"+
+            "AhJnMAsGCSqGSIb3DQEBBDAYMRYwFAYDVQQDEw1vcGVuc2NlcHByb3h5MB4XDTA1"+
+            "MDgwMzExMTYyM1oXDTA1MDgwMzEyMjMwM1owGDEWMBQGA1UEAxMNb3BlbnNjZXBw"+
+            "cm94eTCBnTALBgkqhkiG9w0BAQEDgY0AMIGJAoGBAMXz6rZ3GcZ+X2aj75ua4TyL"+
+            "UGO8EHk5mshcazBZNX8QBT0BttuZgIoEmBte/4/BUG21Xcd2945H2mFoZQoseO0I"+
+            "oaefFMynenXZaUhSt+RNku/HUCcZoKum54jqrC6pgTgK0JkI9X2W/rkaxN4iaCzh"+
+            "GUoF0+zojckuIAUiFoynAgMBAAEwCwYJKoZIhvcNAQEEA4GBAF7FhYDUYgZV5b8e"+
+            "j6xj5mZ5z3NZnskrX8vmCULIV0S3VbPFAu2oC4dVpjjvy2dmn+GaRiOnBxZXnsD7"+
+            "PUA3Z7HAevN/behPXSN2caqcibMEw9/Uohs5bqLteVDWaoiORK+xcTfB1Hho28l4"+
+            "7QRYwa8tpEJ73/uJllM4bcqVZ2CZMYIBaTCCAWUCAQEwHjAYMRYwFAYDVQQDEw1v"+
+            "cGVuc2NlcHByb3h5AgISZzAKBggqhkiG9w0CBaCBozAYBgkqhkiG9w0BCQMxCwYJ"+
+            "KoZIhvcNAQcBMB8GCSqGSIb3DQEJBDESBBDnITiTC5U++NTUz4UFD98oMDAGCmCG"+
+            "SAGG+EUBCQcxIhMgQzk5M0JCMjBDODdCRjAwN0NFNTQ4RUZGMjUzM0Y5RjgwEgYK"+
+            "YIZIAYb4RQEJAjEEEwIxOTAgBgpghkgBhvhFAQkFMRIEEHuGVM2E/7ZErCqymL4g"+
+            "lCAwCwYJKoZIhvcNAQEBBIGAYGUu23CZnLS1H0MV80xPpMWFgjtLFeC4J3AcnzBh"+
+            "E432HHpGan4pabNkOcF7S95F96lymo6CVJtadDqSxHuuQ0G/Oa9HlzuM1KAmYWwl"+
+            "Pb7v/Q+xlKVKQhDNWLukTl3PrBjtaArEnAQaYLsXjxVQU5HSiReFujsBFEsqOwYZ"+
+    "hQo=").getBytes());
+    static byte[] ciscovpnscep = Base64.decode(("MIIGewYJKoZIhvcNAQcCoIIGbDCCBmgCAQExDjAMBggqhkiG9w0CBQUAMIIDJgYJ"+
+            "KoZIhvcNAQcBoIIDFwSCAxMwggMPBgkqhkiG9w0BBwOgggMAMIIC/AIBADGCAV8w"+
+            "ggFbAgEAMEMwNzERMA8GA1UEAxMIQWRtaW5DQTExFTATBgNVBAoTDEVKQkNBIFNh"+
+            "bXBsZTELMAkGA1UEBhMCU0UCCFKNUA0mbQyIMA0GCSqGSIb3DQEBAQUABIIBAGnE"+
+            "mtuxxdoWr+dr8OikckNWTQqT0JQoYh4sQRfE/PdQk1LEnkecdexEWCE51q+r2WN4"+
+            "9iyUWOvmBA+xZEaZlFxTTZDx4YWJ/RDU91ZuVdLBxtCsSBo8p9gxMIWJCaqm+CMJ"+
+            "R7jvUBWFUtI/0Z1ED7a/mYtI7OSc/awYAgjDEyCwxJIg9BYuPGJUxCuLdcQw2jHg"+
+            "VLWfeZSnJyNoL+xCF53bvH8NG31ipfihpqlbbZLcigt9irxHst7d0VQdOVe0GH1z"+
+            "TDW8yGNEwLB0+gCoGPnbzG6vMBURQtwS6cBBmWy5n/G5t1iS4IgITkqzE5VDdUsO"+
+            "cAsJC0CFmooc2R1Kj1YwggGSBgkqhkiG9w0BBwEwEQYFKw4DAgcECE6lRDTM/hQ3"+
+            "gIIBcM/ZXsVuwI/V1xPXJP4zjK3kiT5YM59ahj3Q+cL1eo7b9hYW9jqhczMsJP4B"+
+            "Bt5slCouugiiinwQjkft5fdR95qAJx7LfG2T5KF+PiGIoeKWBduuoV8tdvyhE8Ag"+
+            "0t9o9y43CdCQkA9OfHzGdS4QrpkaS3DlVUlD1QIQCTERCnOQvptIWkF3mDpbtjwM"+
+            "PvmjiZXK1N+AoBmU0RFBqtrIySNRoZn4f+h/oUIfaJ2AUraPY9518ZRNQjbPoLMM"+
+            "wdwQ8KuXgv0Ah7BR3ccDE+2Nen+k+8CAqJI73nxe6/Eq4VX32hwYmTkPY9dN1WtQ"+
+            "sSIq8oFa2NhASc68FiNJEDDbdTgNvuIperePC/I/CzfRcBDAjGpCRioI8lymNQDA"+
+            "xeWXHqGZjzs8h9FFF+5xM6SYSH9WRMmBCZGnayYMRvzVYpcp5tYkPI9OnPGwxKNw"+
+            "dORv3INxwEoXtF8i0Pyc6138ZXgZ1l+sOjVYnmCkvMfZ8dQuoIIBrTCCAakwggES"+
+            "oAMCAQICEF2HNzgvaHHRvp9UVOGL41IwDQYJKoZIhvcNAQEEBQAwEzERMA8GA1UE"+
+            "AxMIY2lzY292cG4wHhcNMDUwODA0MTQzOTUyWhcNMDUwOTAzMTQzOTUyWjATMREw"+
+            "DwYDVQQDEwhjaXNjb3ZwbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAp2LH"+
+            "i5opb2EfEeVLiWNAYX8bM+Me5WQt2txneT0zfvoMmQixLIIMBzLlcsKrkATI/Ber"+
+            "PgDNWlW9f0zXk71lYufijtf7TMNcwrjdDLQ3q9B1/PELkFicKpGLZ1z7Y4890pq0"+
+            "YYIModioC5TxnSB/rSAG5VPIR9IeDirXQ19+wbMCAwEAATANBgkqhkiG9w0BAQQF"+
+            "AAOBgQBa7jf/YY6mnP991J8HwWvHMs1gdMDLaBlA3ypQ9MYwUaNqduZDPnEAxhPz"+
+            "fMuQncB1TIjAGbK24NtV3IOWWu+JMQmT2OL7Z8md5j/sVMAvlaVzWjAEfKq2dgEV"+
+            "spo/lDwwbW8+WMgEnDrXOao/5zy1H0SB8XVsC+Jk9r8yT7eO+TGCAXYwggFyAgEB"+
+            "MCcwEzERMA8GA1UEAxMIY2lzY292cG4CEF2HNzgvaHHRvp9UVOGL41IwDAYIKoZI"+
+            "hvcNAgUFAKCBozASBgpghkgBhvhFAQkCMQQTAjE5MBgGCSqGSIb3DQEJAzELBgkq"+
+            "hkiG9w0BBwEwHwYJKoZIhvcNAQkEMRIEELGqr8B3gk4zDxcuarvrVXIwIAYKYIZI"+
+            "AYb4RQEJBTESBBDSWdNXDqxf6kR0/lhgow/mMDAGCmCGSAGG+EUBCQcxIhMgNUQ4"+
+            "NzM3MzgyRjY4NzFEMUJFOUY1NDU0RTE4QkUzNTIwDQYJKoZIhvcNAQEBBQAEgYBt"+
+            "aq3dXfzHpidRFn0iLdjlar0IqQVSyOiQHEaUanmCCk39QJ3pWmnXiPQCQfE9cptI"+
+            "BpykteSCQxMvzTjEpGpZINObz1A9y/h3LtMidSsaxvMRxJSEapl50GzcLj0fhbSh"+
+    "oCNO9WsRgdZH2qf4iZrHFefSN90eKifkzcyTyKLmIw==").getBytes());
+    static byte[] pixscep = Base64.decode(("MIAGCSqGSIb3DQEHAqCAMIACAQExDjAMBggqhkiG9w0CBQUAMIAGCSqGSIb3DQEH" +
+            "AaCAJIAEggOZMIAGCSqGSIb3DQEHA6CAMIACAQAxgDCCAYMCAQAwazBfMSYwJAYJ" +
+            "KoZIhvcNAQkBFhdwb3N0bWFzdGVyQHRkY29ubGluZS5kazEPMA0GA1UEAxMGdGRj" +
+            "b2NhMRYwFAYDVQQLEw1PbmxpbmUgUHJpdmF0MQwwCgYDVQQKEwNUREMCCD7fK8fm" +
+            "K2DpMA0GCSqGSIb3DQEBAQUABIIBABlqDG3Jx7NJ4VLTb38JxUB3hhpRx+TUMmjZ" +
+            "PG64gFDcK8aNSW5O8dIG09GcfD1dyaW1lwVRUpcFlraEWWCV3xjpM2wPARZ169dL" +
+            "j1K/Y+s4mZsqppm45d0KT7jQ/e0oBJUukJq67rtc90Qyst4W9eGYERulxiQTOILD" +
+            "x43IpHOGlr9ta1oTsxVKvB6mxdGSSdlkem6eozEkKe2cUbDPGVvc4/O5F/zK7jrb" +
+            "L6woflqhwOc+faEOnuCETlr9MUvyN0XdMUbp6Rc3YQkfZj0otgPQ4GjCKfwtui2R" +
+            "LT4eD4m0TOuwFlsV+E0YJJFMLxrhjowIeZap2HKSpZ6Qmhmv0EQAADCABgkqhkiG" +
+            "9w0BBwEwEQYFKw4DAgcECB3fKGT54qD/oIAEggHAA1e6sQ+qC5YZ0BsYz2tKpWHk" +
+            "+dTCsKvRByxTDTjz5xm21pVvyd5iM/k08S674uuxW+V91Rt4OJ13YOUuZ27dyfz8" +
+            "rf/1kRFI0Y8He8Ye5mwJ5beAHiv4gb2hlci8doPp8FkeerB/HM1JxBV0/GQWugyo" +
+            "b6Z3clqXa3WkTI1Pa8dIKql4a1QBi+iXiz+Tg8BR+yUIKHdmfc6HISOqGGmthB5+" +
+            "x7uOjqK4unI3LILauAfRbeQQalFn/PUxQuxNJWf2A0lOwxxtIEVBX0XwxKkejuX6" +
+            "CVxDKaTkt90g3zeZLYvsEdLieGPnw4NhC91/+NycQdjoOpEQCGHjgUGRwX2v0CKg" +
+            "hMSpFLTrsWB/o5X6G/Z5mdAKGKVIoBIj15BxesJAAx8KI3Rni8opie/EWjiXOEwb" +
+            "d6+Ie80jxxyccsXgpBLNnx8EUmQzU1RwWOq3jmzJCtDzKHljaqCxTi6uyFAbsCF9" +
+            "Okl2Qj1qc+rX9ah+F53BDHfXuV3WpCFBSCxi7/G48LXc7Lna6vcEY9eYR3alpUDW" +
+            "ciV7k92bQgBwwHuaXh4brb0MytCcgVUXEwHL6+GI9CHsMT6JlMezIsCTlqZlIwQI" +
+            "57+qPArzctYAAAAAAAAAAAAAAAAAAAAAoIAwggI0MIIBnQIgNzBiNDg2ZmZmMmYy" +
+            "ZWIxYzAzZmRiYjljOWFjNmE2MmEwDQYJKoZIhvcNAQEEBQAwUzFRMA8GA1UEBRMI" +
+            "MzAxYjJkODkwGwYDVQQDExRodWwudGVrbmV0Lm9wYXNpYS5kazAhBgkqhkiG9w0B" +
+            "CQIWFGh1bC50ZWtuZXQub3Bhc2lhLmRrMB4XDTA0MDMxMTA5MTQ1NFoXDTE0MDMw" +
+            "OTA5MTQ1NFowUzFRMA8GA1UEBRMIMzAxYjJkODkwGwYDVQQDExRodWwudGVrbmV0" +
+            "Lm9wYXNpYS5kazAhBgkqhkiG9w0BCQIWFGh1bC50ZWtuZXQub3Bhc2lhLmRrMIGf" +
+            "MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/AtkNDP14TWSkJqDCtPu3T3JeqvyY" +
+            "3Jqww+3ZNfUbs9njCycuiajHbbDVKEyffXCOtzE7GtkcSXJZKntbTICT7N4M+eot" +
+            "EHOtri3l9DkvXWqdvHw21d4i83q+NKPkaXmo6h5yIwmtDQEVIccLDwQydMb0XDgK" +
+            "PjCOm9MC33Pm2wIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAAzXcoUUTmNV4UyxZ/01" +
+            "FHafeqQJmmq66+TrIXUAcwfWyvtgIRGDb/kif2NsjDtvFvnlXUiM57K/I+/qVqQm" +
+            "HF1Thx1L/sbvNwWqYZxyWJPm1TQaw2zvAu0Hpc53/T49dH8LgYYrwEOXRTyW5YE1" +
+            "9fMRCmp78VeN/nJyoOGcJKigAAAxgDCCAcICAQEwdzBTMVEwDwYDVQQFEwgzMDFi" +
+            "MmQ4OTAbBgNVBAMTFGh1bC50ZWtuZXQub3Bhc2lhLmRrMCEGCSqGSIb3DQEJAhYU" +
+            "aHVsLnRla25ldC5vcGFzaWEuZGsCIDcwYjQ4NmZmZjJmMmViMWMwM2ZkYmI5Yzlh" +
+            "YzZhNjJhMAwGCCqGSIb3DQIFBQCggaMwEgYKYIZIAYb4RQEJAjEEEwIxOTAYBgkq" +
+            "hkiG9w0BCQMxCwYJKoZIhvcNAQcBMB8GCSqGSIb3DQEJBDESBBCQVbLp6teJEWNq" +
+            "nBD/Kr1GMCAGCmCGSAGG+EUBCQUxEgQQbpDDbO95LE1U7ZbbEe2p8TAwBgpghkgB" +
+            "hvhFAQkHMSITIDcwYjQ4NmZmZjJmMmViMWMwM2ZkYmI5YzlhYzZhNjJhMA0GCSqG" +
+            "SIb3DQEBAQUABIGAfiGzBNxJiy4XI3DG13Osso4qV+7rvwg+CVbe0gqt01s1kd5A" +
+            "LxwTYVhXXKG1spaBnebu+T9xZDZqvF9eY1ANJVNSIpNygKmJdhjsJivKFkD9Jz2y" +
+            "F/BYZzv618HlvZQj9Sbv7PaODRU4xqGVifa6LllK/572uQdUQj3FTkssqFQAAAAA" +
+    "AAAAAA==").getBytes());
+    static byte[] p12 = Base64.decode(("MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCCvIwgDCABgkqhkiG9w0BBwGggCSABIIK" +
+            "2jCCCtYwggVmBgsqhkiG9w0BDAoBAqCCBPkwggT1MCcGCiqGSIb3DQEMAQMwGQQU" +
+            "M9v7H78lfcE5imiW09/BzSilz+0CAWQEggTIq8j9XRSKczoqkW8oBbYpLUM2F3ic" +
+            "alq86KdAsJPhiKlxYmf56ylUg8c1DBJIIw9/kj84rZ3YMzTenWCvroa7KIZdGoIy" +
+            "lWMUcKgYD/0dzR+tApz7WQMs7MA7eaEx6w1O/ppdEI5ISDb38uR8xDAuPxsRYavV" +
+            "tFDJs6f9GBdyfhSJsX+FJv7NcoEPRw6As8+SJzFMRHj8+VvtUgE8BFAXsZ8C5DkF" +
+            "e0fO0nISJEHOPRDoWH3o0MXKSm3HBPIDZjvlb3Wg9Rv08gOf1kcRpu6OI89dloo5" +
+            "wX4NRq/j+aA6Q+AWCH148DfGK1a455d847N36gMwsTRFnyOx1rSTIoSXI/2kPCN5" +
+            "dvylCbLxQuo+qEY+SHvBFP9t3GvE/dIYHz1hq3Ze8/Buf4HOL7HUW6WwcabYjZx/" +
+            "xGpSHUSwGnhYRyyVpWEQySIa0/QKijJsNBK7Y/GCus4w0pNeTYwP1HCrEDupRgFF" +
+            "IG3bSUFCH7kjr3IfAGP45PJXlFkqQna92NEFHOfT3LupE/gkwdPr2iGlOps9v9Jw" +
+            "aKWF+dNgoTSGV39cxVNJ8nn4qpetfTOLNxvTC7cK1mMaGPLytB7GV4rkp34PY5JR" +
+            "HDg5svKFRgp184wZgD/9MoRLU0JT9RfnY6DFJOUoA6R1L3SkoY4cvJQDgK5YaXyY" +
+            "uyYKfJGcX6I/g2eZuYvooWk+jM2XFuWEQxpF3GgwenvWh0sQfOBE91Afh17z7lHx" +
+            "1/4zJE6YUjHYyed0mUQQs/imoLgxzvHZ29vGU1qj6gtxyYdQaXnUpHrnvJeR7Q8g" +
+            "XgF7YzTbitx6y12pP+zIXkIiigTTxYrF3+adkacAqLM7mNk7IMFLjv/N7AcUrAkK" +
+            "+EUeH27cQB27yfjEX0wqxUSrV9DS1uwTwqvS6UFWVZP1G/VkBpc/A+MAwekUGGH9" +
+            "ByQimhHeg3tIeQ4bSAXr9pM/xzi8dk8MYJw1+l8az5LaYsgbO9iFUwUVDZfwuOD7" +
+            "8FRQKmEx9Q7+jeCd7j6o/B/AnDL9dmpc/n1nnC0zKkROEI8ZU2ErkCcnOFnvAMW+" +
+            "Gzjz769KGMO59iZRXC8YjL2T8iB5SH9wgrGH+pZ4HRGtnoHsrwhXMmPshsR+USNs" +
+            "V3/HH+5XgU9HQukHxVd6lwI3jvJbtO4jvzPpH2Uj6poNAL3+pNrRshNRc54gNOuz" +
+            "pwtTAS9e6SKBU3D44KZ//RYpKMYm+Or5gfNTYJN8lSCRtD0/iD32V5LOwnPK2PZi" +
+            "G0DAZ6ne37IUWS4p5yjeCqZDzhjh37z+D7sbyqVPSR5TzdN7Tjyv7BSe73XWbVME" +
+            "qxyVmiXYaTYMdQ2KpfPfTSQTKJhyAhBbwEYE3E0me9UVz3syJc/UBkodxKJPiTJo" +
+            "VIWEfZ6AxxhqMhJGy2gDZgR/nn518EI21Pca99ehwfBakJc2qDAUYYFkT3laL1ks" +
+            "YP/OT0vAqqiqT/J08owUcxO4cRCZVk2zz94bq/SggQ1T5DuliZaMJ43TcBeW2hzr" +
+            "DH9Qra3MoBdJu+F+Dw9YXMpZv+97fOnpTwBWBgz/LkDf4/OMDy0CAgN8V9lzwg0w" +
+            "vNw/PemztRpGnLI9xR77iZ4LB+iyeDtALyaznqnnKf4oZP1Uhds2mgsNxNAa1Om0" +
+            "EWkuMVowIwYJKoZIhvcNAQkVMRYEFGdq7yBdfjk4/bYULRgeEaIt3crGMDMGCSqG" +
+            "SIb3DQEJFDEmHiQAcAByAGkAdgBhAHQAZQBkAGUAYwBrAGUAeQBhAGwAaQBhAHMw" +
+            "ggVoBgsqhkiG9w0BDAoBAqCCBPkwggT1MCcGCiqGSIb3DQEMAQMwGQQU897tECd+" +
+            "HTblVRmacnpGAAanf6YCAWQEggTIyiJzXF0VFCH9y94VtbDlHhA74rJ3GY2HG6js" +
+            "dgTuPrs6WL1qGzVqyBh0K/No5WHGggxXtr0tNirGAY+OxWzCPeROqCDudsCHp9vP" +
+            "aZPBojPTdXH/ZBj0JNUYCnmIg3Z29u2l7HR/d92qH02Su4PnwyyrjMUHuFys6ltF" +
+            "IsvXfv87oWlfE777jDh3qQcfBSF6C/aZH/kuVmvPIEVl0MbBdOFrScK3gJOTapeS" +
+            "bb/JwGXzV63tJD+s5LqkEPkLTEFK8jMikVvmhVlbUL8Wcd4bve3coFSZ01QwxJBG" +
+            "6i9R4C7SOU05IcKCWlOrqefkv/gVZOfWAWvlCwizXIusYi0vOAcTK/1FBfMXtkDj" +
+            "LP2xMRrSlNUVFhj22ZTo2/xxwWu6gxFO72bP00CLIFB2GIW7tT18v7FNll5Kd9mB" +
+            "naHFikeE+JsXeywxsUVSTwSDeR8+kT1ObPFR6oIDGz9JKkJ/l5cAWlkSmz4PCiU4" +
+            "my4jEoZZMO/mGSL5RWMjQKPNd0evijHul0KA5Q3E1lQDWPFb4j5VSne88C6vDdt3" +
+            "4FQPe/+d0VPMKZKeWkVRiOm61V/RB+7EEskNbAUEASeiSPvLb/1abUCiTVZhExra" +
+            "be0T3KY+yqeXRIvraSED/+8wKZfmpL6aV0VXjtfs+zfE23anAv6FZMG/Br+zP+AN" +
+            "WjIgCy0WqG4r6OsCAWQGz0kv5m43fP/PouCyMwolqwlO48YGARTp0dN7/0ZIymft" +
+            "HslyOTm2nIAWJL3F2Um+ij5jr7zFZU5Y0VW327iIkN9Z7jQezULu2nRpY2HKNvB5" +
+            "WNNTf+k0H3L6bsjeQ0xCru4o1fTw+jyYs0oTThmrzdg4zMCZo73ZvvLGUwPrVeGm" +
+            "Dc7hX2Ladf/e0fAJGZWEhyxQDwWAYgxaJQJ3HxnHc5dlAFgendwxvc2DbWVQGxCo" +
+            "IOngMB5oCabMurHeKrqSlNeKq3NqzirDnrMzAe+6eigXd3X8YCCcgSeV8mf2n+lN" +
+            "VluUepojm6CZpauWEJsffLG2I+sglxNYv4YeiIcvpRj9+2Y9ngJ30aZm+YUZ7dBl" +
+            "Dnsh85bhLeApG65h9j8Gv4Hg8pdCSF4qdYOx/5ewfHXctAEBZNUi9ON0UB0mKSw4" +
+            "ISQYyBTtrUvTPqJwTsiq3k7Y52j4rBrIJyIIn3ffYGZPDpXFmrI4a73heNbT2kTD" +
+            "+NJVRSwZfX+4qykP0PIrxAupW28MQR7N67NmpgTeNmQyP2k2GbqhwMUkRxjaZk0e" +
+            "zM2ErY6PMIOgxUDMYakCC0STfoA5svp1bPhKINqhQHp63EWMbEVAVBUX2IGZ1nfY" +
+            "YS3W3lXbKowdnGfuhFkNg8NnMD8CEsmVCULj2LuxEFH+KWVzNnCJ1e1X07ygSUKL" +
+            "z3RJqMDL8DOA6kxSYRICL8WaNuJIAIDrVq4jNG/2QXvLqfgySNmiEka+A/wGqBFm" +
+            "GmzaptwyXbgwY9LnHpl90FFuCM/FIB83l1MFWflf+iTpfK3cZ6AlNyPN9xZ+ANRg" +
+            "gUz626jNa+nUgWcNMRaVCYHcjJAAsVdqYjO7Cn6iHrE5jzAKYSTn8d7Twm1e9a8+" +
+            "LeiG7UfPILknNwqbdarj5tS+/44f/t5iYqxMfknPYriBvj3b2QSyPp8RWEy/MVww" +
+            "IwYJKoZIhvcNAQkVMRYEFAf9ikWDTmcUQ5CeaAoYzXl4MLQnMDUGCSqGSIb3DQEJ" +
+            "FDEoHiYAcAByAGkAdgBhAHQAZQBzAGkAZwBuAGsAZQB5AGEAbABpAGEAcwAEAQAE" +
+            "AQAEAQAEAQAEggeKADCABgkqhkiG9w0BBwaggDCAAgEAMIAGCSqGSIb3DQEHATAn" +
+            "BgoqhkiG9w0BDAEGMBkEFL9IGozYO+/gw0lMa/ZD7qticoAzAgFkoIAEggc4A2bR" +
+            "LXs1Gqb9nvqgnA3xlL0hek4U2lYUIFMywrKnIUiWQJLmfHf87u23Ij0KKH3VjXgA" +
+            "ZPaBEzGoksSJVZaJXeO6QrvtwBSoQ+2aEjIXKMz3x9RxojzQl/BUO8iA/INIPjY4" +
+            "N4EmdrEGaKZH8WrBVXjgGI+Wjrl7zikvj7rrmE82EomrcUneO9eLj1lCRbSr2jCN" +
+            "k7dGSj9q9fpqsONSJZFsf2OUwlINQWdwTB1O+7c00f38tPP3VXqhADjxZlTTlDzV" +
+            "RsC8Jp7JOcHgyCADreRSvt/8fZ7ix6qrr9exvjNc811onCJ0bF1nxHuPa7QIXSNL" +
+            "zy8QalL71YFNeiGic7zEXUpF+ZssOl7nTHNSel3jqMrOsh7KKw+/JSZNciZOxrxa" +
+            "WeeiJXd3F5zQHUTMZ60GNlLUb5MlHM5QBrO5txsmdw8qM7cnj4l1e0Uv0pUfWSNb" +
+            "E3BR3UE064jXbyH3n4DQD9CZ6n/jEDTbRTgtbgQJYq8kfZtJG0qmoxzs6c40GKUI" +
+            "ZmWCGTFC4oEInnJ1vV6cltNxlftCuDNwA12y5S4z+nOftLe5FRaiECY4CuvdGJrS" +
+            "5wJF/DrkJydzXSYw7zr3bvzc0uLNVoN9E3Ul1QH7tTFCgMg+mgTNXqGRP86HjTdk" +
+            "92so0e5Fd3UnVAdg9CHVmhKRa30fv7DENtNaAKC8uKaJjAy3iXRVD9pSrvGoRLko" +
+            "zigz6AGrEgYMZGS8Oyt9r6b7V5DsqNvbg9dZIxm+JpavhnnlRxx0vOjvoS9OO0+A" +
+            "039NUbB4/60f9DaUZem286vgBV2NaV072hmyzob0PxMeIAP//bG9GQloQvJdDaxy" +
+            "hQLXSaFk0e0zH5QvCv42VvHxB+gqKH3mjEdPtbDiRyVIsrSDR5uM83oHwBfa/Z3C" +
+            "LMenxrLojndEaDW0wwyqFucnTaamOhF0h7aqzmO/Y4QIF7gryNao0N7nYgNiLR/p" +
+            "UWY2kzJ617xj99rwssffOOYx88tSzXPJSjtktHTRD2uEDbpvlRXUsDJbbLcG5CFp" +
+            "Gv9inKiEiKarihLqQfXjhN2/Y4vi5eE1/PjBMIZ+2jeKg2DLrwjZfhs6AT9JN+48" +
+            "RUncJGlJHf0wR+ofDBVf/WIhjzWEjFkTJgyK9PqSoMB5DmY5kzUyUwN2ChXWaNf/" +
+            "cIPmsdVgcrCr058OoYIoevLgCwem3qpr67vgGJFBsm+qsEzGogiZ8Y4R1J/H5Xcx" +
+            "DiIdxnu4HyL/e/Nunt83ulmdf6MtVaQqGV5fm96LGIyrFXlWsHgwssSg6u52ysLf" +
+            "Gt883UTnBgsKzYrZVbUyBT+MTJrbvex5zwVX9myf3DwW5AgNDZ3UTrhqdRw+izMC" +
+            "VBdd2thRLSi35mzHrwD9O49K9LCQ0e4w7c5H0+33Q3jO7TS5r65LmqFeXJ2tzP3i" +
+            "RS5eyEFVr4GyrI0L9+Zvt6TLBLsYsi1V8du6SRngCvEVYx7+ysfVwWEpbQXVbGq/" +
+            "EVJph+GqvxsiN6ohtS6j0XRnbtFLr5Cmw/GjgbgBX2dGP7KB9BTy8/ccmCrJX3Xw" +
+            "jxuBUBHOpsQcUV9G/s5ZSCWAi5cgifwfgLcPAaF8qNXENFNz0Vz+LMNgEi7WZXs+" +
+            "siFkww6XFH4dRTSWxRq2H96ch8FmYeZubiyqzyQIW7yDtxpQkvO2QDQMto6kT/aB" +
+            "L00KX6DnJ+XXVjk9vvCVAG64JWBkJ4VX+TD3FkcbTZnTXZq+epehRm0FRDSarncC" +
+            "OfCU3vCjyya/1sLpkBR4H+KArvcCimKnJvHkBjQkcfK/Uq7gl1YuG3Yuh1Mt4XHp" +
+            "+N9RqF2l6UT+D7aLcfTzd1/+M6g+DJw6B/8dglYrF8VnaI8b3FXFSToRLgQFILBW" +
+            "4DaaUSj7MjRpQgxBQzHrV2FrF0MwhKyEJhv7H22DSspyPOcRddGq/kpf1ZuKyG8M" +
+            "wkfgPZMQ7M97ha13aQt6PAXJhZKVddP3U+i46UjzpaTOrB2XTMjoPBjKTdqc3/tt" +
+            "VrGF6a+YQqQf7/lMPAT3AhKuBveH1+IGbYKLZwSKIAWV3i3RX3kCCflYJNJOiR0v" +
+            "+AERvsR7zqCPX5k9OdFva3PUHTnhpCIezSeIcmJG/rY3Omfw8dAkzT0F0dq/wYdv" +
+            "7nfhSbQg8UbUAI6EZsk9tYwpNVeEAur5IOFyR9tlaNHXb5D4uXeGRZqH5F1uxZt3" +
+            "J383Y8qvC4vmTboTRfJ6VYuc/2BckW5REXpKGH6nLbsZf3rTwjj+4pd1wI40dVS7" +
+            "K22WVfkGy2BDo/5kR93yFEuZvEWmG8s9JvACiKjkefvq9qQk3PG4ljdHjR8UYzHA" +
+            "S3Dniak/FFnVhvHPwMs9qs2OYaIF+BKG7k4Qr34SCRmR0tvfVdvV+5ZyRVDbruLi" +
+            "ATW8ahl9i725+n/EknOyupv1RfDI8mX3WJFU+Nink45aVe0lB6sZNcGOGNLrwNup" +
+            "UxxOH7kAlxTAOK+lW94r0saD5ZY6AAQBAAQBAAQBAAQBAAQBAAQBAAQBAAQBAAQB" +
+            "AAQBAAQBAAAAAAAAADA8MCEwCQYFKw4DAhoFAAQURCoC9aMwMaUQwabHmxqHNPDm" +
+    "Jb4EFAtXS2+0nByy9M2RLJ2xjB38iCBOAgFkAAA=").getBytes());
+    
 }
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/util/TestCertTools.java ./src/test/se/anatom/ejbca/util/TestCertTools.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/util/TestCertTools.java	Fri Jun 17 09:52:09 2005
+++ ./src/test/se/anatom/ejbca/util/TestCertTools.java	Thu Aug 18 09:48:47 2005
@@ -22,7 +22,7 @@
 /**
  * Tests the CertTools class .
  *
- * @version $Id: TestCertTools.java,v 1.6 2005/06/17 07:52:09 anatom Exp $
+ * @version $Id: TestCertTools.java,v 1.6.2.2 2005/08/18 07:48:47 anatom Exp $
  */
 public class TestCertTools extends TestCase {
     private static Logger log = Logger.getLogger(TestCertTools.class);
@@ -62,6 +62,25 @@
             +"gSkt3hvNwG4kLBmmwe9YLdS83dgNImMWL/DgID/47aENlBNai14CvtMceokik4IN"
             +"sacc7x/Vp3xezHLuBMcf3E3VSo4FwqcUYFmu7Obke3ebmB08nC6gnQHkzjNsmQw=").getBytes());
 
+    static byte[] altNameCert = Base64.decode(
+            ("MIIDDzCCAfegAwIBAgIIPiL0klmu1uIwDQYJKoZIhvcNAQEFBQAwNzERMA8GA1UE"
+             +"AxMIQWRtaW5DQTExFTATBgNVBAoTDEVKQkNBIFNhbXBsZTELMAkGA1UEBhMCU0Uw"
+             +"HhcNMDUwODAyMTAxOTQ5WhcNMDcwODAyMTAyOTQ5WjAsMQwwCgYDVQQDEwNmb28x"
+             +"DzANBgNVBAoTBkFuYVRvbTELMAkGA1UEBhMCU0UwXDANBgkqhkiG9w0BAQEFAANL"
+             +"ADBIAkEAmMVWkkEMLbDNoB/NG3kJ22eC18syXqaHWRWc4DldFeCMGeLzfB2NklNv"
+             +"hmr2kgIJcK+wyFpMkYm46dSMOrvovQIDAQABo4HxMIHuMAwGA1UdEwEB/wQCMAAw"
+             +"DgYDVR0PAQH/BAQDAgWgMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcDAgYI"
+             +"KwYBBQUHAwQGCCsGAQUFBwMFBggrBgEFBQcDBzAdBgNVHQ4EFgQUIV/Fck/+UVnw"
+             +"tJigtZIF5OuuhlIwHwYDVR0jBBgwFoAUB/2KRYNOZxRDkJ5oChjNeXgwtCcwUQYD"
+             +"VR0RBEowSIEKdG9tYXNAYS5zZYIId3d3LmEuc2WGEGh0dHA6Ly93d3cuYS5zZS+H"
+             +"BAoBAQGgGAYKKwYBBAGCNxQCA6AKDAhmb29AYS5zZTANBgkqhkiG9w0BAQUFAAOC"
+             +"AQEAfAGJM0/s+Yi1Ewmvt9Z/9w8X/T/02bF8P8MJG2H2eiIMCs/tkNhnlFGYYGhD"
+             +"Km8ynveQZbdYvKFioOr/D19gMis/HNy9UDfOMrJdeGWiwxUHvKKbtcSlOPH3Hm0t"
+             +"LSKomWdKfjTksfj69Tf01S0oNonprvwGxIdsa1uA9BC/MjkkPt1qEWkt/FWCfq9u"
+             +"8Xyj2tZEJKjLgAW6qJ3ye81pEVKHgMmapWTQU2uI1qyEPYxoT9WkQtSObGI1wCqO"
+             +"YmKglnd5BIUBPO9LOryyHlSRTID5z0UgDlrTAaNYuN8QOYF+DZEQxm4bSXTDooGX"
+             +"rHjSjn/7Urb31CXWAxq0Zhk3fg==").getBytes());
+
     /**
      * Creates a new TestCertTools object.
      *
@@ -232,12 +251,13 @@
         String dn21 = "C=SE,O=Foo\\, Inc, OU=Foo\\, Dep, CN=Foo\\'";
         String bcdn21 = CertTools.stringToBCDNString(dn21);
         assertEquals(bcdn21, "CN=Foo\',OU=Foo\\, Dep,O=Foo\\, Inc,C=SE");
-        assertEquals(StringTools.strip(bcdn21), "CN=Foo',OU=Foo/, Dep,O=Foo/, Inc,C=SE");
+        // it is allowed to escape ,
+        assertEquals(StringTools.strip(bcdn21), "CN=Foo',OU=Foo\\, Dep,O=Foo\\, Inc,C=SE");
 
         String dn22 = "C=SE,O=Foo\\, Inc, OU=Foo, Dep, CN=Foo'";
         String bcdn22 = CertTools.stringToBCDNString(dn22);
         assertEquals(bcdn22, "CN=Foo',OU=Foo,O=Foo\\, Inc,C=SE");
-        assertEquals(StringTools.strip(bcdn22), "CN=Foo',OU=Foo,O=Foo/, Inc,C=SE");
+        assertEquals(StringTools.strip(bcdn22), "CN=Foo',OU=Foo,O=Foo\\, Inc,C=SE");
         log.debug("<test02StringToBCDNString()");
     }
 
@@ -406,7 +426,7 @@
        String dn21 = "C=SE,O=Foo\\, Inc, OU=Foo\\, Dep, CN=Foo\\'";
        String bcdn21 = CertTools.stringToBCDNString(dn21);
        assertEquals("CN=Foo\',OU=Foo\\, Dep,O=Foo\\, Inc,C=SE", bcdn21);        
-       assertEquals("CN=Foo',OU=Foo/, Dep,O=Foo/, Inc,C=SE", StringTools.strip(bcdn21));        
+       assertEquals("CN=Foo',OU=Foo\\, Dep,O=Foo\\, Inc,C=SE", StringTools.strip(bcdn21));        
        log.debug("<test10TestMultipleReversed()");
    }
    
@@ -441,4 +461,60 @@
       log.debug("<test11TestInsertCNPostfix()");
   }
     
+  /**
+   */
+  public void test12GetPartsFromDN() throws Exception {
+      log.debug(">test01GetPartFromDN()");
+
+      // We try to examine the general case and som special cases, which we want to be able to handle
+      String dn0 = "C=SE, O=AnaTom, CN=foo";
+      assertEquals(CertTools.getPartsFromDN(dn0, "CN").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn0, "CN").contains("foo"));
+      assertEquals(CertTools.getPartsFromDN(dn0, "O").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn0, "O").contains("AnaTom"));
+      assertEquals(CertTools.getPartsFromDN(dn0, "C").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn0, "C").contains("SE"));
+      assertEquals(CertTools.getPartsFromDN(dn0, "cn").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn0, "cn").contains("foo"));
+      assertEquals(CertTools.getPartsFromDN(dn0, "o").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn0, "o").contains("AnaTom"));
+      assertEquals(CertTools.getPartsFromDN(dn0, "c").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn0, "c").contains("SE"));
+
+      String dn1 = "uri=http://www.a.se, C=SE, O=AnaTom, CN=foo";
+      assertEquals(CertTools.getPartsFromDN(dn1, "CN").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn1, "CN").contains("foo"));
+      assertEquals(CertTools.getPartsFromDN(dn1, CertTools.URI).size(), 0);
+      assertEquals(CertTools.getPartsFromDN(dn1, CertTools.URI1).size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn1, CertTools.URI1).contains("http://www.a.se"));
+
+      String dn2 = "uri=http://www.a.se, uri=http://www.b.se, C=SE, O=AnaTom, CN=foo";
+      assertEquals(CertTools.getPartsFromDN(dn2, "CN").size(), 1);
+      assertTrue(CertTools.getPartsFromDN(dn2, "CN").contains("foo"));
+      assertEquals(CertTools.getPartsFromDN(dn2, CertTools.URI1).size(), 2);
+      assertTrue(CertTools.getPartsFromDN(dn2, CertTools.URI1).contains("http://www.a.se"));
+      assertTrue(CertTools.getPartsFromDN(dn2, CertTools.URI1).contains("http://www.b.se"));
+
+      log.debug("<test12GetPartsFromDN()");
+  }
+  
+  public void test13GetSubjectAltNameString() throws Exception {
+      log.debug(">test13GetSubjectAltNameString()");
+      
+      String altNames = CertTools.getSubjectAlternativeName(CertTools.getCertfromByteArray(altNameCert));
+      log.debug(altNames);
+      String name = CertTools.getPartFromDN(altNames,CertTools.UPN);
+      assertEquals("foo@a.se", name);
+      assertEquals("foo@a.se", CertTools.getUPNAltName(CertTools.getCertfromByteArray(altNameCert)));
+      name = CertTools.getPartFromDN(altNames,CertTools.URI);
+      assertEquals("http://www.a.se/", name);
+      name = CertTools.getPartFromDN(altNames,CertTools.EMAIL);
+      assertEquals("tomas@a.se", name);
+      name = CertTools.getPartFromDN(altNames,CertTools.DNS);
+      assertEquals("www.a.se", name);
+      name = CertTools.getPartFromDN(altNames,CertTools.IPADDR);
+      assertEquals("10.1.1.1", name);
+      log.debug("<test13GetSubjectAltNameString()");
+  }
+
 }
diff -urN ../../31/ejbca/src/test/se/anatom/ejbca/util/TestStringTools.java ./src/test/se/anatom/ejbca/util/TestStringTools.java
--- ../../31/ejbca/src/test/se/anatom/ejbca/util/TestStringTools.java	Mon Jun 20 14:07:47 2005
+++ ./src/test/se/anatom/ejbca/util/TestStringTools.java	Thu Aug 18 09:32:40 2005
@@ -20,7 +20,7 @@
 /**
  * Tests the StringTools class .
  *
- * @version $Id: TestStringTools.java,v 1.4 2005/06/20 12:07:47 anatom Exp $
+ * @version $Id: TestStringTools.java,v 1.4.2.1 2005/08/18 07:32:40 anatom Exp $
  */
 public class TestStringTools extends TestCase {
     private static Logger log = Logger.getLogger(TestStringTools.class);
@@ -72,5 +72,13 @@
     	assertTrue("String has chars that should be stripped!", StringTools.hasSqlStripChars(strip1));
     	assertEquals("String not stripped correctly!", stripped, "foo/bar/far/");
 		log.debug("<test03Strip()");
+    }
+    public void test04Strip() throws Exception {
+        log.debug(">test04Strip()");
+        String strip1 = "CN=foo, O=Acme\\, Inc, OU=;\\/<>bar";
+        String stripped = StringTools.strip(strip1);
+        assertTrue("String has chars that should be stripped!", StringTools.hasSqlStripChars(strip1));
+        assertEquals("String not stripped correctly!", stripped, "CN=foo, O=Acme\\, Inc, OU=/////bar");
+        log.debug("<test04Strip()");
     }
 }