/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.apache.qpid.server.security;


import static org.apache.qpid.server.transport.network.security.ssl.SSLUtil.getInitializedKeyStore;
import static org.apache.qpid.test.utils.JvmVendor.IBM;
import static org.hamcrest.CoreMatchers.equalTo;
import static org.hamcrest.CoreMatchers.is;
import static org.hamcrest.CoreMatchers.not;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
import static org.junit.Assume.assumeThat;

import java.io.FileInputStream;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardCopyOption;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateExpiredException;
import java.security.cert.X509Certificate;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;

import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import org.junit.ClassRule;
import org.junit.Test;

import org.apache.qpid.server.configuration.IllegalConfigurationException;
import org.apache.qpid.server.model.Broker;
import org.apache.qpid.server.model.BrokerModel;
import org.apache.qpid.server.model.BrokerTestHelper;
import org.apache.qpid.server.model.ConfiguredObjectFactory;
import org.apache.qpid.server.model.TrustStore;
import org.apache.qpid.test.utils.tls.CertificateEntry;
import org.apache.qpid.test.utils.tls.KeyCertificatePair;
import org.apache.qpid.test.utils.tls.PrivateKeyEntry;
import org.apache.qpid.test.utils.tls.SecretKeyEntry;
import org.apache.qpid.test.utils.tls.TlsResource;
import org.apache.qpid.server.transport.network.security.ssl.QpidPeersOnlyTrustManager;
import org.apache.qpid.test.utils.tls.TlsResourceBuilder;
import org.apache.qpid.server.util.DataUrlUtils;
import org.apache.qpid.test.utils.UnitTestBase;
import org.apache.qpid.test.utils.tls.TlsResourceHelper;

public class FileTrustStoreTest extends UnitTestBase
{
    @ClassRule
    public static final TlsResource TLS_RESOURCE = new TlsResource();

    private static final Broker BROKER = BrokerTestHelper.createBrokerMock();
    private static final ConfiguredObjectFactory FACTORY = BrokerModel.getInstance().getObjectFactory();
    private static final String DN_FOO = "CN=foo";
    private static final String DN_BAR = "CN=bar";
    private static final String DN_CA = "CN=CA";
    private static final String CERTIFICATE_ALIAS_A = "a";
    private static final String CERTIFICATE_ALIAS_B = "b";
    private static final String NOT_A_CRL = "/not/a/crl";
    private static final String NAME = "myFileTrustStore";
    private static final String NOT_A_TRUSTSTORE = "/not/a/truststore";
    private static final String SECRET_KEY_ALIAS = "secret-key-alias";

    @Test
    public void testCreateFileTrustStoreWithoutCRL() throws Exception
    {
        final Path keyStoreFile = TLS_RESOURCE.createSelfSignedTrustStore(DN_FOO);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, false);

        final FileTrustStore<?> fileTrustStore = createFileTrustStore(attributes);

        TrustManager[] trustManagers = fileTrustStore.getTrustManagers();
        assertNotNull(trustManagers);
        assertEquals("Unexpected number of trust managers", 1, trustManagers.length);
        assertNotNull("Trust manager unexpected null", trustManagers[0]);
    }

    @Test
    public void testCreateFileTrustStoreFromWithExplicitlySetCRL() throws Exception
    {
        final StoreAndCrl<Path> data = generateTrustStoreAndCrl();

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, data.getStore().toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_LIST_URL, data.getCrl().toFile().getPath());

        final FileTrustStore<?> fileTrustStore = createFileTrustStore(attributes);

        TrustManager[] trustManagers = fileTrustStore.getTrustManagers();
        assertNotNull(trustManagers);
        assertEquals("Unexpected number of trust managers", 1, trustManagers.length);
        assertNotNull("Trust manager unexpected null", trustManagers[0]);
    }

    @Test
    public void testCreateTrustStoreFromFile_WrongPassword() throws Exception
    {
        final Path keyStoreFile = TLS_RESOURCE.createSelfSignedTrustStore(DN_FOO);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret() + "_");
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY, BROKER, TrustStore.class, attributes,
                                                                      "Check trust store password");
    }

    @Test
    public void testCreateTrustStoreFromFile_MissingCrlFile() throws Exception
    {
        final Path keyStoreFile = TLS_RESOURCE.createSelfSignedTrustStore(DN_FOO);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_LIST_URL, NOT_A_CRL);

        KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY,
                                                                      BROKER,
                                                                      TrustStore.class,
                                                                      attributes,
                                                                      String.format(
                                                                              "Unable to load certificate revocation list '%s' for truststore 'myFileTrustStore'",
                                                                              NOT_A_CRL));
    }

    @Test
    public void testCreatePeersOnlyTrustStoreFromFile_Success() throws Exception
    {
        final KeyCertificatePair keyPairAndRootCA = TlsResourceBuilder.createKeyPairAndRootCA(DN_CA);
        final Path keyStoreFile = TLS_RESOURCE.createTrustStore(DN_FOO, keyPairAndRootCA);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.PEERS_ONLY, true);
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        final FileTrustStore<?> fileTrustStore = createFileTrustStore(attributes);

        TrustManager[] trustManagers = fileTrustStore.getTrustManagers();
        assertNotNull(trustManagers);
        assertEquals("Unexpected number of trust managers", 1, trustManagers.length);
        assertNotNull("Trust manager unexpected null", trustManagers[0]);
        final boolean condition = trustManagers[0] instanceof QpidPeersOnlyTrustManager;
        assertTrue("Trust manager unexpected null", condition);
    }

    @Test
    public void testUseOfExpiredTrustAnchorAllowed() throws Exception
    {
        // https://www.ibm.com/support/knowledgecenter/en/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-
        assumeThat("IBMJSSE2 trust factory (IbmX509) validates the entire chain, including trusted certificates.",
                   getJvmVendor(),
                   is(not(equalTo(IBM))));

        final Path keyStoreFile = createTrustStoreWithExpiredCertificate();

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        FileTrustStore<?> trustStore = createFileTrustStore(attributes);

        TrustManager[] trustManagers = trustStore.getTrustManagers();
        assertNotNull(trustManagers);
        assertEquals("Unexpected number of trust managers", 1, trustManagers.length);
        final boolean condition = trustManagers[0] instanceof X509TrustManager;
        assertTrue("Unexpected trust manager type", condition);
        X509TrustManager trustManager = (X509TrustManager) trustManagers[0];

        KeyStore clientStore = getInitializedKeyStore(keyStoreFile.toFile().getAbsolutePath(),
                                                      TLS_RESOURCE.getSecret(),
                                                      TLS_RESOURCE.getKeyStoreType());

        String alias = clientStore.aliases().nextElement();
        X509Certificate certificate = (X509Certificate) clientStore.getCertificate(alias);

        trustManager.checkClientTrusted(new X509Certificate[]{certificate}, "NULL");
    }

    @Test
    public void testUseOfExpiredTrustAnchorDenied() throws Exception
    {
        final Path keyStoreFile = createTrustStoreWithExpiredCertificate();

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.TRUST_ANCHOR_VALIDITY_ENFORCED, true);
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        final TrustStore<?> trustStore = createFileTrustStore(attributes);

        TrustManager[] trustManagers = trustStore.getTrustManagers();
        assertNotNull(trustManagers);
        assertEquals("Unexpected number of trust managers", 1, trustManagers.length);
        final boolean condition = trustManagers[0] instanceof X509TrustManager;
        assertTrue("Unexpected trust manager type", condition);
        X509TrustManager trustManager = (X509TrustManager) trustManagers[0];

        KeyStore clientStore = getInitializedKeyStore(keyStoreFile.toFile().getAbsolutePath(),
                                                      TLS_RESOURCE.getSecret(),
                                                      TLS_RESOURCE.getKeyStoreType());
        String alias = clientStore.aliases().nextElement();
        X509Certificate certificate = (X509Certificate) clientStore.getCertificate(alias);

        try
        {
            trustManager.checkClientTrusted(new X509Certificate[]{certificate}, "NULL");
            fail("Exception not thrown");
        }
        catch (CertificateException e)
        {
            if (e instanceof CertificateExpiredException || "Certificate expired".equals(e.getMessage()))
            {
                // IBMJSSE2 does not throw CertificateExpiredException, it throws a CertificateException
                // ignore
            }
            else
            {
                throw e;
            }
        }
    }

    @Test
    public void testCreateTrustStoreFromDataUrl_Success() throws Exception
    {
        final StoreAndCrl<String> data = generateTrustStoreAndCrlAsDataUrl();

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, data.getStore());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_LIST_URL, data.getCrl());

        FileTrustStore<?> fileTrustStore = createFileTrustStore(attributes);

        TrustManager[] trustManagers = fileTrustStore.getTrustManagers();
        assertNotNull(trustManagers);
        assertEquals("Unexpected number of trust managers", 1, trustManagers.length);
        assertNotNull("Trust manager unexpected null", trustManagers[0]);
    }

    @Test
    public void testCreateTrustStoreFromDataUrl_WrongPassword() throws Exception
    {
        String trustStoreAsDataUrl = TLS_RESOURCE.createSelfSignedTrustStoreAsDataUrl(DN_FOO);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret() + "_");
        attributes.put(FileTrustStore.STORE_URL, trustStoreAsDataUrl);
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY, BROKER, TrustStore.class, attributes,
                                                                      "Check trust store password");
    }

    @Test
    public void testCreateTrustStoreFromDataUrl_BadTruststoreBytes()
    {
        String trustStoreAsDataUrl = DataUrlUtils.getDataUrlForBytes("notatruststore".getBytes());

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.STORE_URL, trustStoreAsDataUrl);
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY, BROKER, TrustStore.class, attributes,
                                                                      "Cannot instantiate trust store");
    }

    @Test
    public void testUpdateTrustStore_Success() throws Exception
    {
        final StoreAndCrl<Path> data = generateTrustStoreAndCrl();

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, NAME);
        attributes.put(FileTrustStore.STORE_URL, data.getStore().toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
        attributes.put(FileTrustStore.CERTIFICATE_REVOCATION_LIST_URL, data.getCrl().toFile().getAbsolutePath());

        final FileTrustStore<?> fileTrustStore = createFileTrustStore(attributes);

        assertEquals("Unexpected path value before change",
                     data.getStore().toFile().getAbsolutePath(),
                     fileTrustStore.getStoreUrl());

        try
        {
            fileTrustStore.setAttributes(Collections.singletonMap(FileTrustStore.STORE_URL, NOT_A_TRUSTSTORE));
            fail("Exception not thrown");
        }
        catch (IllegalConfigurationException e)
        {
            String message = e.getMessage();
            assertTrue("Exception text not as unexpected:" + message,
                       message.contains("Cannot instantiate trust store"));
        }

        assertEquals("Unexpected keystore path value after failed change",
                     data.getStore().toFile().getAbsolutePath(),
                     fileTrustStore.getStoreUrl());

        try
        {

            fileTrustStore.setAttributes(Collections.singletonMap(FileTrustStore.CERTIFICATE_REVOCATION_LIST_URL, NOT_A_CRL));
            fail("Exception not thrown");
        }
        catch (IllegalConfigurationException e)
        {
            String message = e.getMessage();
            assertTrue("Exception text not as unexpected:" + message,
                       message.contains(String.format(
                               "Unable to load certificate revocation list '%s' for truststore '%s'", NOT_A_CRL, NAME)));
        }

        assertEquals("Unexpected CRL path value after failed change",
                     data.getCrl().toFile().getAbsolutePath(),
                     fileTrustStore.getCertificateRevocationListUrl());

        assertEquals("Unexpected path value after failed change",
                     data.getStore().toFile().getAbsolutePath(),
                     fileTrustStore.getStoreUrl());

        final Path keyStoreFile2 = TLS_RESOURCE.createTrustStore(DN_FOO, data.getCa());
        final Path emptyCrl = TLS_RESOURCE.createCrl(data.getCa());

        Map<String, Object> changedAttributes = new HashMap<>();
        changedAttributes.put(FileTrustStore.STORE_URL, keyStoreFile2.toFile().getAbsolutePath());
        changedAttributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        changedAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_LIST_URL, emptyCrl.toFile().getAbsolutePath());

        fileTrustStore.setAttributes(changedAttributes);

        assertEquals("Unexpected keystore path value after change that is expected to be successful",
                     keyStoreFile2.toFile().getAbsolutePath(),
                     fileTrustStore.getStoreUrl());
        assertEquals("Unexpected CRL path value after change that is expected to be successful",
                     emptyCrl.toFile().getAbsolutePath(),
                     fileTrustStore.getCertificateRevocationListUrl());
    }

    @Test
    public void testEmptyTrustStoreRejected() throws Exception
    {

        final Path path = TLS_RESOURCE.createKeyStore();

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileKeyStore.NAME, NAME);
        attributes.put(FileKeyStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileKeyStore.STORE_URL, path.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY, BROKER, TrustStore.class, attributes,
                                                                      "must contain at least one certificate");
    }

    @Test
    public void testTrustStoreWithNoCertificateRejected() throws Exception
    {
        final Path path = TLS_RESOURCE.createSelfSignedKeyStore(DN_FOO);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, getTestName());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.STORE_URL, path.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY, BROKER, TrustStore.class, attributes,
                                                                      "must contain at least one certificate");
    }

    @Test
    public void testSymmetricKeyEntryIgnored() throws Exception
    {
        final String keyStoreType = "jceks";
        final Path keyStoreFile = createSelfSignedKeyStoreWithSecretKeyAndCertificate(keyStoreType, DN_FOO);
        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, getTestName());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, keyStoreType);

        FileTrustStore<?> trustStore = createFileTrustStore(attributes);

        Certificate[] certificates = trustStore.getCertificates();
        assertEquals("Unexpected number of certificates",
                     (long) getNumberOfCertificates(keyStoreFile, keyStoreType),
                     (long) certificates.length);
    }

    @Test
    public void testPrivateKeyEntryIgnored() throws Exception
    {
        final Path keyStoreFile = TLS_RESOURCE.createSelfSignedKeyStoreWithCertificate(DN_FOO);

        Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, getTestName());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());
        attributes.put(FileTrustStore.STORE_URL, keyStoreFile.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.TRUST_STORE_TYPE, TLS_RESOURCE.getKeyStoreType());

        FileTrustStore<?> trustStore = createFileTrustStore(attributes);

        Certificate[] certificates = trustStore.getCertificates();
        assertEquals("Unexpected number of certificates",
                     (long) getNumberOfCertificates(keyStoreFile, TLS_RESOURCE.getKeyStoreType()),
                     (long) certificates.length);
    }

    @Test
    public void testReloadKeystore() throws Exception
    {
        final Path keyStorePath = TLS_RESOURCE.createSelfSignedKeyStoreWithCertificate(DN_FOO);
        final Path keyStorePath2 = TLS_RESOURCE.createSelfSignedKeyStoreWithCertificate(DN_BAR);

        final Map<String, Object> attributes = new HashMap<>();
        attributes.put(FileTrustStore.NAME, getTestName());
        attributes.put(FileTrustStore.STORE_URL, keyStorePath.toFile().getAbsolutePath());
        attributes.put(FileTrustStore.PASSWORD, TLS_RESOURCE.getSecret());

        final FileTrustStore<?> trustStoreObject = createFileTrustStore(attributes);

        final X509Certificate certificate = getCertificate(trustStoreObject);
        assertEquals(DN_FOO, certificate.getIssuerX500Principal().getName());

        Files.copy(keyStorePath2, keyStorePath, StandardCopyOption.REPLACE_EXISTING);

        trustStoreObject.reload();

        final X509Certificate certificate2 = getCertificate(trustStoreObject);
        assertEquals(DN_BAR, certificate2.getIssuerX500Principal().getName());
    }

    @SuppressWarnings("unchecked")
    private FileTrustStore<?> createFileTrustStore(final Map<String, Object> attributes)
    {
        return (FileTrustStore<?>) FACTORY.create(TrustStore.class, attributes, BROKER);
    }

    private X509Certificate getCertificate(final FileTrustStore trustStore)
            throws java.security.GeneralSecurityException
    {
        Certificate[] certificates = trustStore.getCertificates();

        assertNotNull(certificates);
        assertEquals(1, certificates.length);

        Certificate certificate = certificates[0];
        assertTrue(certificate instanceof X509Certificate);
        return (X509Certificate) certificate;
    }

    private int getNumberOfCertificates(Path keystore, String type) throws Exception
    {
        KeyStore ks = KeyStore.getInstance(type);
        try (InputStream is = new FileInputStream(keystore.toFile()))
        {
            ks.load(is, TLS_RESOURCE.getSecret().toCharArray());
        }

        int result = 0;
        Enumeration<String> aliases = ks.aliases();
        while (aliases.hasMoreElements())
        {
            String alias = aliases.nextElement();
            if (ks.isCertificateEntry(alias))
            {
                result++;
            }
        }
        return result;
    }

    private Path createTrustStoreWithExpiredCertificate() throws Exception
    {
        final Instant from = Instant.now().minus(10, ChronoUnit.DAYS);
        final Instant to = Instant.now().minus(5, ChronoUnit.DAYS);
        return TLS_RESOURCE.createSelfSignedTrustStore(DN_FOO, from, to);
    }

    public Path createSelfSignedKeyStoreWithSecretKeyAndCertificate(final String keyStoreType, final String dn)
            throws Exception
    {
        final KeyCertificatePair keyCertPair = TlsResourceBuilder.createSelfSigned(dn);

        return TLS_RESOURCE.createKeyStore(keyStoreType, new PrivateKeyEntry(TLS_RESOURCE.getPrivateKeyAlias(),
                                                                keyCertPair.getPrivateKey(),
                                                                keyCertPair.getCertificate()),
                              new CertificateEntry(TLS_RESOURCE.getCertificateAlias(), keyCertPair.getCertificate()),
                              new SecretKeyEntry(SECRET_KEY_ALIAS, TlsResourceHelper.createAESSecretKey()));
    }


    private StoreAndCrl<Path> generateTrustStoreAndCrl() throws Exception
    {
        final KeyCertificatePair caPair = TlsResourceBuilder.createKeyPairAndRootCA(DN_CA);
        final KeyCertificatePair keyCertPair1 = TlsResourceBuilder.createKeyPairAndCertificate(DN_FOO, caPair);
        final KeyCertificatePair keyCertPair2 = TlsResourceBuilder.createKeyPairAndCertificate(DN_BAR, caPair);
        final Path keyStoreFile = TLS_RESOURCE.createKeyStore(new CertificateEntry(
                                                                           CERTIFICATE_ALIAS_A,
                                                                           keyCertPair1.getCertificate()),
                                                                   new CertificateEntry(
                                                                           CERTIFICATE_ALIAS_B,
                                                                           keyCertPair2.getCertificate()));

        final Path clrFile = TLS_RESOURCE.createCrl(caPair, keyCertPair2.getCertificate());
        return new StoreAndCrl<>(keyStoreFile, clrFile, caPair);
    }

    private StoreAndCrl<String> generateTrustStoreAndCrlAsDataUrl() throws Exception
    {
        final KeyCertificatePair caPair = TlsResourceBuilder.createKeyPairAndRootCA(DN_CA);
        final KeyCertificatePair keyCertPair1 = TlsResourceBuilder.createKeyPairAndCertificate(DN_FOO, caPair);
        final KeyCertificatePair keyCertPair2 = TlsResourceBuilder.createKeyPairAndCertificate(DN_BAR, caPair);
        final String trustStoreAsDataUrl =
                TLS_RESOURCE.createKeyStoreAsDataUrl(new CertificateEntry(
                                                                  CERTIFICATE_ALIAS_A,
                                                                  keyCertPair1.getCertificate()),
                                                          new CertificateEntry(
                                                                  CERTIFICATE_ALIAS_B,
                                                                  keyCertPair2.getCertificate()));

        final String crlAsDataUrl = TLS_RESOURCE.createCrlAsDataUrl(caPair, keyCertPair2.getCertificate());
        return new StoreAndCrl<>(trustStoreAsDataUrl, crlAsDataUrl, caPair);
    }

    private static class StoreAndCrl<T>
    {
        private T _store;
        private T _crl;
        private KeyCertificatePair _ca;

        private StoreAndCrl(final T store, final T crl, KeyCertificatePair ca)
        {
            _store = store;
            _crl = crl;
            _ca = ca;
        }

        T getStore()
        {
            return _store;
        }

        T getCrl()
        {
            return _crl;
        }

        KeyCertificatePair getCa()
        {
            return _ca;
        }
    }
}