/*

 * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.tools.keytool;

import java.io.*;

import java.nio.file.Files;

import java.nio.file.Path;

import java.security.CodeSigner;

import java.security.CryptoPrimitive;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.MessageDigest;

import java.security.Key;

import java.security.PublicKey;

import java.security.PrivateKey;

import java.security.Signature;

import java.security.Timestamp;

import java.security.UnrecoverableEntryException;

import java.security.UnrecoverableKeyException;

import java.security.Principal;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.cert.CertStoreException;

import java.security.cert.CRL;

import java.security.cert.X509Certificate;

import java.security.cert.CertificateException;

import java.security.cert.URICertStoreParameters;

import java.text.Collator;

import java.text.MessageFormat;

import java.util.*;

import java.util.jar.JarEntry;

import java.util.jar.JarFile;

import java.math.BigInteger;

import java.net.URI;

import java.net.URL;

import java.net.URLClassLoader;

import java.security.cert.CertStore;

import java.security.cert.X509CRL;

import java.security.cert.X509CRLEntry;

import java.security.cert.X509CRLSelector;

import javax.security.auth.x500.X500Principal;

import java.util.Base64;

import sun.security.util.KeyUtil;

import sun.security.util.ObjectIdentifier;

import sun.security.pkcs10.PKCS10;

import sun.security.pkcs10.PKCS10Attribute;

import sun.security.provider.X509Factory;

import sun.security.provider.certpath.ssl.SSLServerCertStore;

import sun.security.util.Password;

import sun.security.util.SecurityProviderConstants;

import javax.crypto.KeyGenerator;

import javax.crypto.SecretKey;

import javax.crypto.SecretKeyFactory;

import javax.crypto.spec.PBEKeySpec;

import sun.security.pkcs.PKCS9Attribute;

import sun.security.tools.KeyStoreUtil;

import sun.security.tools.PathList;

import sun.security.util.DerValue;

import sun.security.util.Pem;

import sun.security.x509.*;

import static java.security.KeyStore.*;

import java.security.Security;

import static sun.security.tools.keytool.Main.Command.*;

import static sun.security.tools.keytool.Main.Option.*;

import sun.security.util.DisabledAlgorithmConstraints;

/**

 * This tool manages keystores.

 *

 * @author Jan Luehe

 *

 *

 * @see java.security.KeyStore

 * @see sun.security.provider.KeyProtector

 * @see sun.security.provider.JavaKeyStore

 *

 * @since 1.2

 */

public final class Main {

    private static final byte[] CRLF = new byte[] {'\r', '\n'};

    private boolean debug = false;

    private Command command = null;

    private String sigAlgName = null;

    private String keyAlgName = null;

    private boolean verbose = false;

    private int keysize = -1;

    private boolean rfc = false;

    private long validity = (long)90;

    private String alias = null;

    private String dname = null;

    private String dest = null;

    private String filename = null;

    private String infilename = null;

    private String outfilename = null;

    private String srcksfname = null;

    // User-specified providers are added before any command is called.

    // However, they are not removed before the end of the main() method.

    // If you're calling KeyTool.main() directly in your own Java program,

    // please programtically add any providers you need and do not specify

    // them through the command line.

    private Set<Pair <String, String>> providers = null;

    private Set<Pair <String, String>> providerClasses = null;

    private String storetype = null;

    private String srcProviderName = null;

    private String providerName = null;

    private String pathlist = null;

    private char[] storePass = null;

    private char[] storePassNew = null;

    private char[] keyPass = null;

    private char[] keyPassNew = null;

    private char[] newPass = null;

    private char[] destKeyPass = null;

    private char[] srckeyPass = null;

    private String ksfname = null;

    private File ksfile = null;

    private InputStream ksStream = null; // keystore stream

    private String sslserver = null;

    private String jarfile = null;

    private KeyStore keyStore = null;

    private boolean token = false;

    private boolean nullStream = false;

    private boolean kssave = false;

    private boolean noprompt = false;

    private boolean trustcacerts = false;

    private boolean protectedPath = false;

    private boolean srcprotectedPath = false;

    private boolean cacerts = false;

    private boolean nowarn = false;

    private CertificateFactory cf = null;

    private KeyStore caks = null; // "cacerts" keystore

    private char[] srcstorePass = null;

    private String srcstoretype = null;

    private Set<char[]> passwords = new HashSet<>();

    private String startDate = null;

    private List<String> ids = new ArrayList<>();   // used in GENCRL

    private List<String> v3ext = new ArrayList<>();

    // In-place importkeystore is special.

    // A backup is needed, and no need to prompt for deststorepass.

    private boolean inplaceImport = false;

    private String inplaceBackupName = null;

    // Warnings on weak algorithms etc

    private List<String> weakWarnings = new ArrayList<>();

    private static final DisabledAlgorithmConstraints DISABLED_CHECK =

            new DisabledAlgorithmConstraints(

                    DisabledAlgorithmConstraints.PROPERTY_CERTPATH_DISABLED_ALGS);

    private static final Set<CryptoPrimitive> SIG_PRIMITIVE_SET = Collections

            .unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE));

    enum Command {

        CERTREQ("Generates.a.certificate.request",

            ALIAS, SIGALG, FILEOUT, KEYPASS, KEYSTORE, DNAME,

            EXT, STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        CHANGEALIAS("Changes.an.entry.s.alias",

            ALIAS, DESTALIAS, KEYPASS, KEYSTORE, CACERTS, STOREPASS,

            STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        DELETE("Deletes.an.entry",

            ALIAS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,

            PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        EXPORTCERT("Exports.certificate",

            RFC, ALIAS, FILEOUT, KEYSTORE, CACERTS, STOREPASS,

            STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        GENKEYPAIR("Generates.a.key.pair",

            ALIAS, KEYALG, KEYSIZE, SIGALG, DESTALIAS, DNAME,

            STARTDATE, EXT, VALIDITY, KEYPASS, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        GENSECKEY("Generates.a.secret.key",

            ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        GENCERT("Generates.certificate.from.a.certificate.request",

            RFC, INFILE, OUTFILE, ALIAS, SIGALG, DNAME,

            STARTDATE, EXT, VALIDITY, KEYPASS, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        IMPORTCERT("Imports.a.certificate.or.a.certificate.chain",

            NOPROMPT, TRUSTCACERTS, PROTECTED, ALIAS, FILEIN,

            KEYPASS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,

            PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V),

        IMPORTPASS("Imports.a.password",

            ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        IMPORTKEYSTORE("Imports.one.or.all.entries.from.another.keystore",

            SRCKEYSTORE, DESTKEYSTORE, SRCSTORETYPE,

            DESTSTORETYPE, SRCSTOREPASS, DESTSTOREPASS,

            SRCPROTECTED, DESTPROTECTED, SRCPROVIDERNAME, DESTPROVIDERNAME,

            SRCALIAS, DESTALIAS, SRCKEYPASS, DESTKEYPASS,

            NOPROMPT, ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH,

            V),

        KEYPASSWD("Changes.the.key.password.of.an.entry",

            ALIAS, KEYPASS, NEW, KEYSTORE, STOREPASS,

            STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V),

        LIST("Lists.entries.in.a.keystore",

            RFC, ALIAS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,

            PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        PRINTCERT("Prints.the.content.of.a.certificate",

            RFC, FILEIN, SSLSERVER, JARFILE, V),

        PRINTCERTREQ("Prints.the.content.of.a.certificate.request",

            FILEIN, V),

        PRINTCRL("Prints.the.content.of.a.CRL.file",

            FILEIN, V),

        STOREPASSWD("Changes.the.store.password.of.a.keystore",

            NEW, KEYSTORE, CACERTS, STOREPASS, STORETYPE, PROVIDERNAME,

            ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),

        // Undocumented start here, KEYCLONE is used a marker in -help;

        KEYCLONE("Clones.a.key.entry",

            ALIAS, DESTALIAS, KEYPASS, NEW, STORETYPE,

            KEYSTORE, STOREPASS, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V),

        SELFCERT("Generates.a.self.signed.certificate",

            ALIAS, SIGALG, DNAME, STARTDATE, EXT, VALIDITY, KEYPASS,

            STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,

            ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),

        GENCRL("Generates.CRL",

            RFC, FILEOUT, ID,

            ALIAS, SIGALG, KEYPASS, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        IDENTITYDB("Imports.entries.from.a.JDK.1.1.x.style.identity.database",

            FILEIN, STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,

            ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V);

        final String description;

        final Option[] options;

        final String name;

        String altName;     // "genkey" is altName for "genkeypair"

        Command(String d, Option... o) {

            description = d;

            options = o;

            name = "-" + name().toLowerCase(Locale.ENGLISH);

        }

        @Override

        public String toString() {

            return name;

        }

        public String getAltName() {

            return altName;

        }

        public void setAltName(String altName) {

            this.altName = altName;

        }

        public static Command getCommand(String cmd) {

            for (Command c: Command.values()) {

                if (collator.compare(cmd, c.name) == 0

                        || (c.altName != null

                            && collator.compare(cmd, c.altName) == 0)) {

                    return c;

                }

            }

            return null;

        }

    };

    static {

        Command.GENKEYPAIR.setAltName("-genkey");

        Command.IMPORTCERT.setAltName("-import");

        Command.EXPORTCERT.setAltName("-export");

        Command.IMPORTPASS.setAltName("-importpassword");

    }

    // If an option is allowed multiple times, remember to record it

    // in the optionsSet.contains() block in parseArgs().

    enum Option {

        ALIAS("alias", "<alias>", "alias.name.of.the.entry.to.process"),

        DESTALIAS("destalias", "<alias>", "destination.alias"),

        DESTKEYPASS("destkeypass", "<arg>", "destination.key.password"),

        DESTKEYSTORE("destkeystore", "<keystore>", "destination.keystore.name"),

        DESTPROTECTED("destprotected", null, "destination.keystore.password.protected"),

        DESTPROVIDERNAME("destprovidername", "<name>", "destination.keystore.provider.name"),

        DESTSTOREPASS("deststorepass", "<arg>", "destination.keystore.password"),

        DESTSTORETYPE("deststoretype", "<type>", "destination.keystore.type"),

        DNAME("dname", "<name>", "distinguished.name"),

        EXT("ext", "<value>", "X.509.extension"),

        FILEOUT("file", "<file>", "output.file.name"),

        FILEIN("file", "<file>", "input.file.name"),

        ID("id", "<id:reason>", "Serial.ID.of.cert.to.revoke"),

        INFILE("infile", "<file>", "input.file.name"),

        KEYALG("keyalg", "<alg>", "key.algorithm.name"),

        KEYPASS("keypass", "<arg>", "key.password"),

        KEYSIZE("keysize", "<size>", "key.bit.size"),

        KEYSTORE("keystore", "<keystore>", "keystore.name"),

        CACERTS("cacerts", null, "access.the.cacerts.keystore"),

        NEW("new", "<arg>", "new.password"),

        NOPROMPT("noprompt", null, "do.not.prompt"),

        OUTFILE("outfile", "<file>", "output.file.name"),

        PROTECTED("protected", null, "password.through.protected.mechanism"),

        PROVIDERCLASS("providerclass", "<class>\n[-providerarg <arg>]", "provider.class.option"),

        ADDPROVIDER("addprovider", "<name>\n[-providerarg <arg>]", "addprovider.option"),

        PROVIDERNAME("providername", "<name>", "provider.name"),

        PROVIDERPATH("providerpath", "<list>", "provider.classpath"),

        RFC("rfc", null, "output.in.RFC.style"),

        SIGALG("sigalg", "<alg>", "signature.algorithm.name"),

        SRCALIAS("srcalias", "<alias>", "source.alias"),

        SRCKEYPASS("srckeypass", "<arg>", "source.key.password"),

        SRCKEYSTORE("srckeystore", "<keystore>", "source.keystore.name"),

        SRCPROTECTED("srcprotected", null, "source.keystore.password.protected"),

        SRCPROVIDERNAME("srcprovidername", "<name>", "source.keystore.provider.name"),

        SRCSTOREPASS("srcstorepass", "<arg>", "source.keystore.password"),

        SRCSTORETYPE("srcstoretype", "<type>", "source.keystore.type"),

        SSLSERVER("sslserver", "<server[:port]>", "SSL.server.host.and.port"),

        JARFILE("jarfile", "<file>", "signed.jar.file"),

        STARTDATE("startdate", "<date>", "certificate.validity.start.date.time"),

        STOREPASS("storepass", "<arg>", "keystore.password"),

        STORETYPE("storetype", "<type>", "keystore.type"),

        TRUSTCACERTS("trustcacerts", null, "trust.certificates.from.cacerts"),

        V("v", null, "verbose.output"),

        VALIDITY("validity", "<days>", "validity.number.of.days");

        final String name, arg, description;

        Option(String name, String arg, String description) {

            this.name = name;

            this.arg = arg;

            this.description = description;

        }

        @Override

        public String toString() {

            return "-" + name;

        }

    };

    private static final String NONE = "NONE";

    private static final String P11KEYSTORE = "PKCS11";

    private static final String P12KEYSTORE = "PKCS12";

    private static final String keyAlias = "mykey";

    // for i18n

    private static final java.util.ResourceBundle rb =

        java.util.ResourceBundle.getBundle(

            "sun.security.tools.keytool.Resources");

    private static final Collator collator = Collator.getInstance();

    static {

        // this is for case insensitive string comparisons

        collator.setStrength(Collator.PRIMARY);

    };

    private Main() { }

    public static void main(String[] args) throws Exception {

        Main kt = new Main();

        kt.run(args, System.out);

    }

    private void run(String[] args, PrintStream out) throws Exception {

        try {

            args = parseArgs(args);

            if (command != null) {

                doCommands(out);

            }

        } catch (Exception e) {

            System.out.println(rb.getString("keytool.error.") + e);

            if (verbose) {

                e.printStackTrace(System.out);

            }

            if (!debug) {

                System.exit(1);

            } else {

                throw e;

            }

        } finally {

            printWeakWarnings(false);

            for (char[] pass : passwords) {

                if (pass != null) {

                    Arrays.fill(pass, ' ');

                    pass = null;

                }

            }

            if (ksStream != null) {

                ksStream.close();

            }

        }

    }

    /**

     * Parse command line arguments.

     */

    String[] parseArgs(String[] args) throws Exception {

        int i=0;

        boolean help = args.length == 0;

        String confFile = null;

        // Records all commands and options set. Used to check dups.

        Set<String> optionsSet = new HashSet<>();

        for (i=0; i < args.length; i++) {

            String flags = args[i];

            if (flags.startsWith("-")) {

                String lowerFlags = flags.toLowerCase(Locale.ROOT);

                if (optionsSet.contains(lowerFlags)) {

                    switch (lowerFlags) {

                        case "-ext":

                        case "-id":

                        case "-provider":

                        case "-addprovider":

                        case "-providerclass":

                        case "-providerarg":

                            // These options are allowed multiple times

                            break;

                        default:

                            weakWarnings.add(String.format(

                                    rb.getString("option.1.set.twice"),

                                    lowerFlags));

                    }

                } else {

                    optionsSet.add(lowerFlags);

                }

                if (collator.compare(flags, "-conf") == 0) {

                    if (i == args.length - 1) {

                        errorNeedArgument(flags);

                    }

                    confFile = args[++i];

                } else {

                    Command c = Command.getCommand(flags);

                    if (c != null) {

                        if (command == null) {

                            command = c;

                        } else {

                            throw new Exception(String.format(

                                    rb.getString("multiple.commands.1.2"),

                                    command.name, c.name));

                        }

                    }

                }

            }

        }

        if (confFile != null && command != null) {

            args = KeyStoreUtil.expandArgs("keytool", confFile,

                    command.toString(),

                    command.getAltName(), args);

        }

        debug = Arrays.stream(args).anyMatch(

                x -> collator.compare(x, "-debug") == 0);

        if (debug) {

            // No need to localize debug output

            System.out.println("Command line args: " +

                    Arrays.toString(args));

        }

        for (i=0; (i < args.length) && args[i].startsWith("-"); i++) {

            String flags = args[i];

            // Check if the last option needs an arg

            if (i == args.length - 1) {

                for (Option option: Option.values()) {

                    // Only options with an arg need to be checked

                    if (collator.compare(flags, option.toString()) == 0) {

                        if (option.arg != null) errorNeedArgument(flags);

                        break;

                    }

                }

            }

            /*

             * Check modifiers

             */

            String modifier = null;

            int pos = flags.indexOf(':');

            if (pos > 0) {

                modifier = flags.substring(pos+1);

                flags = flags.substring(0, pos);

            }

            /*

             * command modes

             */

            Command c = Command.getCommand(flags);

            if (c != null) {

                command = c;

            } else if (collator.compare(flags, "--help") == 0 ||

                       collator.compare(flags, "-h") == 0 ||

                       collator.compare(flags, "-?") == 0 ||

                       // -help: legacy.

                       collator.compare(flags, "-help") == 0) {

                help = true;

            } else if (collator.compare(flags, "-conf") == 0) {

                i++;

            } else if (collator.compare(flags, "-nowarn") == 0) {

                nowarn = true;

            } else if (collator.compare(flags, "-keystore") == 0) {

                ksfname = args[++i];

                if (new File(ksfname).getCanonicalPath().equals(

                        new File(KeyStoreUtil.getCacerts()).getCanonicalPath())) {

                    System.err.println(rb.getString("warning.cacerts.option"));

                }

            } else if (collator.compare(flags, "-destkeystore") == 0) {

                ksfname = args[++i];

            } else if (collator.compare(flags, "-cacerts") == 0) {

                cacerts = true;

            } else if (collator.compare(flags, "-storepass") == 0 ||

                    collator.compare(flags, "-deststorepass") == 0) {

                storePass = getPass(modifier, args[++i]);

                passwords.add(storePass);

            } else if (collator.compare(flags, "-storetype") == 0 ||

                    collator.compare(flags, "-deststoretype") == 0) {

                storetype = KeyStoreUtil.niceStoreTypeName(args[++i]);

            } else if (collator.compare(flags, "-srcstorepass") == 0) {

                srcstorePass = getPass(modifier, args[++i]);

                passwords.add(srcstorePass);

            } else if (collator.compare(flags, "-srcstoretype") == 0) {

                srcstoretype = KeyStoreUtil.niceStoreTypeName(args[++i]);

            } else if (collator.compare(flags, "-srckeypass") == 0) {

                srckeyPass = getPass(modifier, args[++i]);

                passwords.add(srckeyPass);

            } else if (collator.compare(flags, "-srcprovidername") == 0) {

                srcProviderName = args[++i];

            } else if (collator.compare(flags, "-providername") == 0 ||

                    collator.compare(flags, "-destprovidername") == 0) {

                providerName = args[++i];

            } else if (collator.compare(flags, "-providerpath") == 0) {

                pathlist = args[++i];

            } else if (collator.compare(flags, "-keypass") == 0) {

                keyPass = getPass(modifier, args[++i]);

                passwords.add(keyPass);

            } else if (collator.compare(flags, "-new") == 0) {

                newPass = getPass(modifier, args[++i]);

                passwords.add(newPass);

            } else if (collator.compare(flags, "-destkeypass") == 0) {

                destKeyPass = getPass(modifier, args[++i]);

                passwords.add(destKeyPass);

            } else if (collator.compare(flags, "-alias") == 0 ||

                    collator.compare(flags, "-srcalias") == 0) {

                alias = args[++i];

            } else if (collator.compare(flags, "-dest") == 0 ||

                    collator.compare(flags, "-destalias") == 0) {

                dest = args[++i];

            } else if (collator.compare(flags, "-dname") == 0) {

                dname = args[++i];

            } else if (collator.compare(flags, "-keysize") == 0) {

                keysize = Integer.parseInt(args[++i]);

            } else if (collator.compare(flags, "-keyalg") == 0) {

                keyAlgName = args[++i];

            } else if (collator.compare(flags, "-sigalg") == 0) {

                sigAlgName = args[++i];

            } else if (collator.compare(flags, "-startdate") == 0) {

                startDate = args[++i];

            } else if (collator.compare(flags, "-validity") == 0) {

                validity = Long.parseLong(args[++i]);

            } else if (collator.compare(flags, "-ext") == 0) {

                v3ext.add(args[++i]);

            } else if (collator.compare(flags, "-id") == 0) {

                ids.add(args[++i]);

            } else if (collator.compare(flags, "-file") == 0) {

                filename = args[++i];

            } else if (collator.compare(flags, "-infile") == 0) {

                infilename = args[++i];

            } else if (collator.compare(flags, "-outfile") == 0) {

                outfilename = args[++i];

            } else if (collator.compare(flags, "-sslserver") == 0) {

                sslserver = args[++i];

            } else if (collator.compare(flags, "-jarfile") == 0) {

                jarfile = args[++i];

            } else if (collator.compare(flags, "-srckeystore") == 0) {

                srcksfname = args[++i];

            } else if (collator.compare(flags, "-provider") == 0 ||

                        collator.compare(flags, "-providerclass") == 0) {

                if (providerClasses == null) {

                    providerClasses = new HashSet<Pair <String, String>> (3);

                }

                String providerClass = args[++i];

                String providerArg = null;

                if (args.length > (i+1)) {

                    flags = args[i+1];

                    if (collator.compare(flags, "-providerarg") == 0) {

                        if (args.length == (i+2)) errorNeedArgument(flags);

                        providerArg = args[i+2];

                        i += 2;

                    }

                }

                providerClasses.add(

                        Pair.of(providerClass, providerArg));

            } else if (collator.compare(flags, "-addprovider") == 0) {

                if (providers == null) {

                    providers = new HashSet<Pair <String, String>> (3);

                }

                String provider = args[++i];

                String providerArg = null;

                if (args.length > (i+1)) {

                    flags = args[i+1];

                    if (collator.compare(flags, "-providerarg") == 0) {

                        if (args.length == (i+2)) errorNeedArgument(flags);

                        providerArg = args[i+2];

                        i += 2;

                    }

                }

                providers.add(

                        Pair.of(provider, providerArg));

            }

            /*

             * options

             */

            else if (collator.compare(flags, "-v") == 0) {

                verbose = true;

            } else if (collator.compare(flags, "-debug") == 0) {

                // Already processed

            } else if (collator.compare(flags, "-rfc") == 0) {

                rfc = true;

            } else if (collator.compare(flags, "-noprompt") == 0) {

                noprompt = true;

            } else if (collator.compare(flags, "-trustcacerts") == 0) {

                trustcacerts = true;

            } else if (collator.compare(flags, "-protected") == 0 ||

                    collator.compare(flags, "-destprotected") == 0) {

                protectedPath = true;

            } else if (collator.compare(flags, "-srcprotected") == 0) {

                srcprotectedPath = true;

            } else  {

                System.err.println(rb.getString("Illegal.option.") + flags);

                tinyHelp();

            }

        }

        if (i<args.length) {

            System.err.println(rb.getString("Illegal.option.") + args[i]);

            tinyHelp();

        }

        if (command == null) {

            if (help) {

                usage();

            } else {

                System.err.println(rb.getString("Usage.error.no.command.provided"));

                tinyHelp();

            }

        } else if (help) {

            usage();

            command = null;

        }

        return args;

    }

    boolean isKeyStoreRelated(Command cmd) {

        return cmd != PRINTCERT && cmd != PRINTCERTREQ;

    }

    /**

     * Execute the commands.

     */

    void doCommands(PrintStream out) throws Exception {

        if (cacerts) {

            if (ksfname != null || storetype != null) {

                throw new IllegalArgumentException(rb.getString

                        ("the.keystore.or.storetype.option.cannot.be.used.with.the.cacerts.option"));

            }

            ksfname = KeyStoreUtil.getCacerts();

        }

        if (P11KEYSTORE.equalsIgnoreCase(storetype) ||

                KeyStoreUtil.isWindowsKeyStore(storetype)) {

            token = true;

            if (ksfname == null) {

                ksfname = NONE;

            }

        }

        if (NONE.equals(ksfname)) {

            nullStream = true;

        }

        if (token && !nullStream) {

            System.err.println(MessageFormat.format(rb.getString

                (".keystore.must.be.NONE.if.storetype.is.{0}"), storetype));

            System.err.println();

            tinyHelp();

        }

        if (token &&

            (command == KEYPASSWD || command == STOREPASSWD)) {

            throw new UnsupportedOperationException(MessageFormat.format(rb.getString

                        (".storepasswd.and.keypasswd.commands.not.supported.if.storetype.is.{0}"), storetype));

        }

        if (token && (keyPass != null || newPass != null || destKeyPass != null)) {

            throw new IllegalArgumentException(MessageFormat.format(rb.getString

                (".keypass.and.new.can.not.be.specified.if.storetype.is.{0}"), storetype));

        }

        if (protectedPath) {

            if (storePass != null || keyPass != null ||

                    newPass != null || destKeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if.protected.is.specified.then.storepass.keypass.and.new.must.not.be.specified"));

            }

        }

        if (srcprotectedPath) {

            if (srcstorePass != null || srckeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if.srcprotected.is.specified.then.srcstorepass.and.srckeypass.must.not.be.specified"));

            }

        }

        if (KeyStoreUtil.isWindowsKeyStore(storetype)) {

            if (storePass != null || keyPass != null ||

                    newPass != null || destKeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if.keystore.is.not.password.protected.then.storepass.keypass.and.new.must.not.be.specified"));

            }

        }

        if (KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {

            if (srcstorePass != null || srckeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if.source.keystore.is.not.password.protected.then.srcstorepass.and.srckeypass.must.not.be.specified"));

            }

        }

        if (validity <= (long)0) {

            throw new Exception

                (rb.getString("Validity.must.be.greater.than.zero"));

        }

        // Try to load and install specified provider

        if (providers != null) {

            for (Pair<String, String> provider : providers) {

                try {

                    KeyStoreUtil.loadProviderByName(

                            provider.fst, provider.snd);

                    if (debug) {

                        System.out.println("loadProviderByName: " + provider.fst);

                    }

                } catch (IllegalArgumentException e) {

                    throw new Exception(String.format(rb.getString(

                            "provider.name.not.found"), provider.fst));

                }

            }

        }

        if (providerClasses != null) {

            ClassLoader cl = null;

            if (pathlist != null) {

                String path = null;

                path = PathList.appendPath(

                        path, System.getProperty("java.class.path"));

                path = PathList.appendPath(

                        path, System.getProperty("env.class.path"));

                path = PathList.appendPath(path, pathlist);

                URL[] urls = PathList.pathToURLs(path);

                cl = new URLClassLoader(urls);

            } else {

                cl = ClassLoader.getSystemClassLoader();

            }

            for (Pair<String, String> provider : providerClasses) {

                try {

                    KeyStoreUtil.loadProviderByClass(

                            provider.fst, provider.snd, cl);

                    if (debug) {

                        System.out.println("loadProviderByClass: " + provider.fst);

                    }

                } catch (ClassCastException cce) {

                    throw new Exception(String.format(rb.getString(

                            "provclass.not.a.provider"), provider.fst));

                } catch (IllegalArgumentException e) {

                    throw new Exception(String.format(rb.getString(

                            "provider.class.not.found"), provider.fst), e.getCause());

                }

            }

        }

        if (command == LIST && verbose && rfc) {

            System.err.println(rb.getString

                ("Must.not.specify.both.v.and.rfc.with.list.command"));

            tinyHelp();

        }

        // Make sure provided passwords are at least 6 characters long

        if (command == GENKEYPAIR && keyPass!=null && keyPass.length < 6) {

            throw new Exception(rb.getString

                ("Key.password.must.be.at.least.6.characters"));

        }

        if (newPass != null && newPass.length < 6) {

            throw new Exception(rb.getString

                ("New.password.must.be.at.least.6.characters"));

        }

        if (destKeyPass != null && destKeyPass.length < 6) {

            throw new Exception(rb.getString

                ("New.password.must.be.at.least.6.characters"));

        }

        // Set this before inplaceImport check so we can compare name.

        if (ksfname == null) {

            ksfname = System.getProperty("user.home") + File.separator

                    + ".keystore";

        }

        KeyStore srcKeyStore = null;

        if (command == IMPORTKEYSTORE) {

            inplaceImport = inplaceImportCheck();

            if (inplaceImport) {

                // We load srckeystore first so we have srcstorePass that

                // can be assigned to storePass

                srcKeyStore = loadSourceKeyStore();

                if (storePass == null) {

                    storePass = srcstorePass;

                }

            }

        }

        // Check if keystore exists.

        // If no keystore has been specified at the command line, try to use

        // the default, which is located in $HOME/.keystore.

        // If the command is "genkey", "identitydb", "import", or "printcert",

        // it is OK not to have a keystore.

        // DO NOT open the existing keystore if this is an in-place import.

        // The keystore should be created as brand new.

        if (isKeyStoreRelated(command) && !nullStream && !inplaceImport) {

            try {

                ksfile = new File(ksfname);

                // Check if keystore file is empty

                if (ksfile.exists() && ksfile.length() == 0) {

                    throw new Exception(rb.getString

                            ("Keystore.file.exists.but.is.empty.") + ksfname);

                }

                ksStream = new FileInputStream(ksfile);

            } catch (FileNotFoundException e) {

                if (command != GENKEYPAIR &&

                        command != GENSECKEY &&

                        command != IDENTITYDB &&

                        command != IMPORTCERT &&

                        command != IMPORTPASS &&

                        command != IMPORTKEYSTORE &&

                        command != PRINTCRL) {

                    throw new Exception(rb.getString

                            ("Keystore.file.does.not.exist.") + ksfname);

                }

            }

        }

        if ((command == KEYCLONE || command == CHANGEALIAS)

                && dest == null) {

            dest = getAlias("destination");

            if ("".equals(dest)) {

                throw new Exception(rb.getString

                        ("Must.specify.destination.alias"));

            }

        }

        if (command == DELETE && alias == null) {

            alias = getAlias(null);

            if ("".equals(alias)) {

                throw new Exception(rb.getString("Must.specify.alias"));

            }

        }

        // Create new keystore

        // Probe for keystore type when filename is available

        if (ksfile != null && ksStream != null && providerName == null &&

                storetype == null && !inplaceImport) {

            keyStore = KeyStore.getInstance(ksfile, storePass);

            storetype = keyStore.getType();

        } else {

            if (storetype == null) {

                storetype = KeyStore.getDefaultType();

            }

            if (providerName == null) {

                keyStore = KeyStore.getInstance(storetype);

            } else {

                keyStore = KeyStore.getInstance(storetype, providerName);

            }

            /*

             * Load the keystore data.

             *

             * At this point, it's OK if no keystore password has been provided.

             * We want to make sure that we can load the keystore data, i.e.,

             * the keystore data has the right format. If we cannot load the

             * keystore, why bother asking the user for his or her password?

             * Only if we were able to load the keystore, and no keystore

             * password has been provided, will we prompt the user for the

             * keystore password to verify the keystore integrity.

             * This means that the keystore is loaded twice: first load operation

             * checks the keystore format, second load operation verifies the

             * keystore integrity.

             *

             * If the keystore password has already been provided (at the

             * command line), however, the keystore is loaded only once, and the

             * keystore format and integrity are checked "at the same time".

             *

             * Null stream keystores are loaded later.

             */

            if (!nullStream) {

                if (inplaceImport) {

                    keyStore.load(null, storePass);

                } else {

                    keyStore.load(ksStream, storePass);

                }

                if (ksStream != null) {

                    ksStream.close();

                }

            }

        }

        if (P12KEYSTORE.equalsIgnoreCase(storetype) && command == KEYPASSWD) {

            throw new UnsupportedOperationException(rb.getString

                    (".keypasswd.commands.not.supported.if.storetype.is.PKCS12"));

        }

        // All commands that create or modify the keystore require a keystore

        // password.

        if (nullStream && storePass != null) {

            keyStore.load(null, storePass);

        } else if (!nullStream && storePass != null) {

            // If we are creating a new non nullStream-based keystore,

            // insist that the password be at least 6 characters

            if (ksStream == null && storePass.length < 6) {

                throw new Exception(rb.getString

                        ("Keystore.password.must.be.at.least.6.characters"));

            }

        } else if (storePass == null) {

            // only prompt if (protectedPath == false)

            if (!protectedPath && !KeyStoreUtil.isWindowsKeyStore(storetype) &&

                (command == CERTREQ ||

                        command == DELETE ||

                        command == GENKEYPAIR ||

                        command == GENSECKEY ||

                        command == IMPORTCERT ||

                        command == IMPORTPASS ||

                        command == IMPORTKEYSTORE ||

                        command == KEYCLONE ||

                        command == CHANGEALIAS ||

                        command == SELFCERT ||

                        command == STOREPASSWD ||

                        command == KEYPASSWD ||

                        command == IDENTITYDB)) {

                int count = 0;

                do {

                    if (command == IMPORTKEYSTORE) {

                        System.err.print

                                (rb.getString("Enter.destination.keystore.password."));

                    } else {

                        System.err.print

                                (rb.getString("Enter.keystore.password."));

                    }

                    System.err.flush();

                    storePass = Password.readPassword(System.in);

                    passwords.add(storePass);

                    // If we are creating a new non nullStream-based keystore,

                    // insist that the password be at least 6 characters

                    if (!nullStream && (storePass == null || storePass.length < 6)) {

                        System.err.println(rb.getString

                                ("Keystore.password.is.too.short.must.be.at.least.6.characters"));

                        storePass = null;

                    }

                    // If the keystore file does not exist and needs to be

                    // created, the storepass should be prompted twice.

                    if (storePass != null && !nullStream && ksStream == null) {

                        System.err.print(rb.getString("Re.enter.new.password."));

                        char[] storePassAgain = Password.readPassword(System.in);

                        passwords.add(storePassAgain);

                        if (!Arrays.equals(storePass, storePassAgain)) {

                            System.err.println

                                (rb.getString("They.don.t.match.Try.again"));

                            storePass = null;

                        }

                    }

                    count++;

                } while ((storePass == null) && count < 3);

                if (storePass == null) {

                    System.err.println

                        (rb.getString("Too.many.failures.try.later"));

                    return;

                }

            } else if (!protectedPath

                    && !KeyStoreUtil.isWindowsKeyStore(storetype)

                    && isKeyStoreRelated(command)) {

                // here we have EXPORTCERT and LIST (info valid until STOREPASSWD)

                if (command != PRINTCRL) {

                    System.err.print(rb.getString("Enter.keystore.password."));

                    System.err.flush();

                    storePass = Password.readPassword(System.in);

                    passwords.add(storePass);

                }

            }

            // Now load a nullStream-based keystore,

            // or verify the integrity of an input stream-based keystore

            if (nullStream) {

                keyStore.load(null, storePass);

            } else if (ksStream != null) {

                ksStream = new FileInputStream(ksfile);

                keyStore.load(ksStream, storePass);

                ksStream.close();

            }

        }

        if (storePass != null && P12KEYSTORE.equalsIgnoreCase(storetype)) {

            MessageFormat form = new MessageFormat(rb.getString(

                "Warning.Different.store.and.key.passwords.not.supported.for.PKCS12.KeyStores.Ignoring.user.specified.command.value."));

            if (keyPass != null && !Arrays.equals(storePass, keyPass)) {

                Object[] source = {"-keypass"};

                System.err.println(form.format(source));

                keyPass = storePass;

            }

            if (destKeyPass != null && !Arrays.equals(storePass, destKeyPass)) {

                Object[] source = {"-destkeypass"};

                System.err.println(form.format(source));

                destKeyPass = storePass;

            }

        }

        // Create a certificate factory

        if (command == PRINTCERT || command == IMPORTCERT

                || command == IDENTITYDB || command == PRINTCRL) {

            cf = CertificateFactory.getInstance("X509");

        }

        // -trustcacerts can only be specified on -importcert.

        // Reset it so that warnings on CA cert will remain for

        // -printcert, etc.

        if (command != IMPORTCERT) {

            trustcacerts = false;

        }

        if (trustcacerts) {

            caks = KeyStoreUtil.getCacertsKeyStore();

        }

        // Perform the specified command

        if (command == CERTREQ) {

            if (filename != null) {

                try (PrintStream ps = new PrintStream(new FileOutputStream

                                                      (filename))) {

                    doCertReq(alias, sigAlgName, ps);

                }

            } else {

                doCertReq(alias, sigAlgName, out);

            }

            if (verbose && filename != null) {

                MessageFormat form = new MessageFormat(rb.getString

                        ("Certification.request.stored.in.file.filename."));

                Object[] source = {filename};

                System.err.println(form.format(source));

                System.err.println(rb.getString("Submit.this.to.your.CA"));

            }

        } else if (command == DELETE) {

            doDeleteEntry(alias);

            kssave = true;

        } else if (command == EXPORTCERT) {

            if (filename != null) {

                try (PrintStream ps = new PrintStream(new FileOutputStream

                                                   (filename))) {

                    doExportCert(alias, ps);

                }

            } else {

                doExportCert(alias, out);

            }

            if (filename != null) {

                MessageFormat form = new MessageFormat(rb.getString

                        ("Certificate.stored.in.file.filename."));

                Object[] source = {filename};

                System.err.println(form.format(source));

            }

        } else if (command == GENKEYPAIR) {

            if (keyAlgName == null) {

                keyAlgName = "DSA";

            }

            doGenKeyPair(alias, dname, keyAlgName, keysize, sigAlgName);

            kssave = true;

        } else if (command == GENSECKEY) {

            if (keyAlgName == null) {

                keyAlgName = "DES";

            }

            doGenSecretKey(alias, keyAlgName, keysize);

            kssave = true;

        } else if (command == IMPORTPASS) {

            if (keyAlgName == null) {

                keyAlgName = "PBE";

            }

            // password is stored as a secret key

            doGenSecretKey(alias, keyAlgName, keysize);

            kssave = true;

        } else if (command == IDENTITYDB) {

            if (filename != null) {

                try (InputStream inStream = new FileInputStream(filename)) {

                    doImportIdentityDatabase(inStream);

                }

            } else {

                doImportIdentityDatabase(System.in);

            }

        } else if (command == IMPORTCERT) {

            InputStream inStream = System.in;

            if (filename != null) {

                inStream = new FileInputStream(filename);

            }

            String importAlias = (alias!=null)?alias:keyAlias;

            try {

                if (keyStore.entryInstanceOf(

                        importAlias, KeyStore.PrivateKeyEntry.class)) {

                    kssave = installReply(importAlias, inStream);

                    if (kssave) {

                        System.err.println(rb.getString

                            ("Certificate.reply.was.installed.in.keystore"));

                    } else {

                        System.err.println(rb.getString

                            ("Certificate.reply.was.not.installed.in.keystore"));

                    }

                } else if (!keyStore.containsAlias(importAlias) ||

                        keyStore.entryInstanceOf(importAlias,

                            KeyStore.TrustedCertificateEntry.class)) {

                    kssave = addTrustedCert(importAlias, inStream);

                    if (kssave) {

                        System.err.println(rb.getString

                            ("Certificate.was.added.to.keystore"));

                    } else {

                        System.err.println(rb.getString

                            ("Certificate.was.not.added.to.keystore"));

                    }

                }

            } finally {

                if (inStream != System.in) {

                    inStream.close();

                }

            }

        } else if (command == IMPORTKEYSTORE) {

            // When not in-place import, srcKeyStore is not loaded yet.

            if (srcKeyStore == null) {

                srcKeyStore = loadSourceKeyStore();

            }

            doImportKeyStore(srcKeyStore);

            kssave = true;

        } else if (command == KEYCLONE) {

            keyPassNew = newPass;

            // added to make sure only key can go thru

            if (alias == null) {

                alias = keyAlias;

            }

            if (keyStore.containsAlias(alias) == false) {

                MessageFormat form = new MessageFormat

                    (rb.getString("Alias.alias.does.not.exist"));

                Object[] source = {alias};

                throw new Exception(form.format(source));

            }

            if (!keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {

                MessageFormat form = new MessageFormat(rb.getString(

                        "Alias.alias.references.an.entry.type.that.is.not.a.private.key.entry.The.keyclone.command.only.supports.cloning.of.private.key"));

                Object[] source = {alias};

                throw new Exception(form.format(source));

            }

            doCloneEntry(alias, dest, true);  // Now everything can be cloned

            kssave = true;

        } else if (command == CHANGEALIAS) {

            if (alias == null) {

                alias = keyAlias;

            }

            doCloneEntry(alias, dest, false);

            // in PKCS11, clone a PrivateKeyEntry will delete the old one

            if (keyStore.containsAlias(alias)) {

                doDeleteEntry(alias);

            }

            kssave = true;

        } else if (command == KEYPASSWD) {

            keyPassNew = newPass;

            doChangeKeyPasswd(alias);

            kssave = true;

        } else if (command == LIST) {

            if (storePass == null

                    && !KeyStoreUtil.isWindowsKeyStore(storetype)) {

                printNoIntegrityWarning();

            }

            if (alias != null) {

                doPrintEntry(rb.getString("the.certificate"), alias, out);

            } else {

                doPrintEntries(out);

            }

        } else if (command == PRINTCERT) {

            doPrintCert(out);

        } else if (command == SELFCERT) {

            doSelfCert(alias, dname, sigAlgName);

            kssave = true;

        } else if (command == STOREPASSWD) {

            doChangeStorePasswd();

            kssave = true;

        } else if (command == GENCERT) {

            if (alias == null) {

                alias = keyAlias;

            }

            InputStream inStream = System.in;

            if (infilename != null) {

                inStream = new FileInputStream(infilename);

            }

            PrintStream ps = null;

            if (outfilename != null) {

                ps = new PrintStream(new FileOutputStream(outfilename));

                out = ps;

            }

            try {

                doGenCert(alias, sigAlgName, inStream, out);

            } finally {

                if (inStream != System.in) {

                    inStream.close();

                }

                if (ps != null) {

                    ps.close();

                }

            }

        } else if (command == GENCRL) {

            if (alias == null) {

                alias = keyAlias;

            }

            if (filename != null) {

                try (PrintStream ps =

                         new PrintStream(new FileOutputStream(filename))) {