package certpath;

import java.security.KeyStore;
import java.security.Security;
import java.security.cert.CertPath;
import java.security.cert.CertPathBuilder;
import java.security.cert.CertPathBuilderResult;
import java.security.cert.CertStore;
import java.security.cert.CertificateFactory;
import java.security.cert.CollectionCertStoreParameters;
import java.security.cert.PKIXBuilderParameters;
import java.security.cert.TrustAnchor;
import java.security.cert.X509CRL;
import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.time.LocalDate;
import java.time.ZoneOffset;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.Date;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;

import ru.CryptoPro.Crypto.CryptoProvider;
import ru.CryptoPro.JCP.JCP;
import ru.CryptoPro.JCSP.JCSP;

public class CertPathTest {

  public static void main(String[] args) {
    try {
      System.setProperty("com.sun.security.enableCRLDP", "false");
      System.setProperty("com.sun.security.enableAIAcaIssuers", "false");
      System.setProperty("com.ibm.security.enableCRLDP", "false");
      System.setProperty("ru.CryptoPro.reprov.enableAIAcaIssuers", "false");

      Security.removeProvider(JCSP.PROVIDER_NAME);
      Security.addProvider(new JCSP());
      Security.removeProvider(JCP.PROVIDER_NAME);
      Security.addProvider(new JCP());
      Security.removeProvider(ru.CryptoPro.reprov.RevCheck.PROVIDER_NAME);
      Security.addProvider(new ru.CryptoPro.reprov.RevCheck());
      Security.removeProvider(CryptoProvider.PROVIDER_NAME);
      Security.addProvider(new CryptoProvider());
      
      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
      trustManagerFactory.init((KeyStore) null);
      List<TrustManager> trustManagers = Arrays.asList(trustManagerFactory.getTrustManagers());
      Set<X509Certificate> cacerts = new HashSet<>(trustManagers.stream().filter(X509TrustManager.class::isInstance)
          .map(X509TrustManager.class::cast).map(trustManager -> Arrays.asList(trustManager.getAcceptedIssuers()))
          .flatMap(Collection::stream).toList());

      CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");

      X509Certificate cert = (X509Certificate) certificateFactory
          .generateCertificate(CertPathTest.class.getResourceAsStream("expired.cer"));
      X509Certificate caCert = (X509Certificate) certificateFactory
          .generateCertificate(CertPathTest.class.getResourceAsStream("ca.cer"));
      X509CRL caCRL = (X509CRL) certificateFactory.generateCRL(CertPathTest.class.getResourceAsStream("ca.crl"));
      
      if( !cacerts.contains(caCert) ) {
        throw new IllegalStateException("ca.cer it not trust ca certificate");
      }
      Set<TrustAnchor> trustAnchors = Collections.singleton(new TrustAnchor(caCert, null)); 
      
      X509CertSelector targetConstraints = new X509CertSelector();
      targetConstraints.setCertificate(cert);

      PKIXBuilderParameters pkixBuilderParams = new PKIXBuilderParameters(trustAnchors, targetConstraints);
      pkixBuilderParams.addCertStore(
          CertStore.getInstance("Collection", new CollectionCertStoreParameters(Collections.singleton(caCRL))));
      pkixBuilderParams.setRevocationEnabled(true);
      pkixBuilderParams.setDate(Date.from(LocalDate.parse("2025-05-28").atStartOfDay(ZoneOffset.UTC).toInstant()));

      CertPathBuilder certPathBuilder = CertPathBuilder.getInstance("CPPKIX");
      
      CertPathBuilderResult certPathBuilderResult = certPathBuilder.build(pkixBuilderParams);
      CertPath certPath = certPathBuilderResult.getCertPath();
      certPath.getCertificates().forEach(c->{
        X509Certificate x509= (X509Certificate) c;
        System.out.println(x509.getSubjectX500Principal());
      });

    } catch (Exception e) {
      System.out.println("Cannot get certificate path");
      e.printStackTrace();
    }
  }
}

/* match on dateAndTime */
        if (dateAndTime != null) {
            Date crlThisUpdate = xcrl.getThisUpdate();
            Date nextUpdate = xcrl.getNextUpdate();
            if (nextUpdate == null) {
                if (debug != null) {
                    debug.println("X509CRLSelector.match: nextUpdate null");
                }
                return false;
            }
            Date nowPlusSkew = dateAndTime;
            Date nowMinusSkew = dateAndTime;
            if (skew > 0) {
                nowPlusSkew = new Date(dateAndTime.getTime() + skew);
                nowMinusSkew = new Date(dateAndTime.getTime() - skew);
            }
            // Check that the test date is within the validity interval:
            //   [ thisUpdate - MAX_CLOCK_SKEW,
            //     nextUpdate + MAX_CLOCK_SKEW ]
            if (nowMinusSkew.after(nextUpdate)
                || nowPlusSkew.before(crlThisUpdate)) {
                if (debug != null) {
                    debug.println("X509CRLSelector.match: update out-of-range");
                }
                return false;
            }
        }