java.lang.IllegalArgumentException: Bad sequence size

Question

I'm new with certificate thing, I've one scenario, need to read SSL certificate, extract that and validate the email which is specified in the certificate. for that i wrote below code, but I'm getting the java.lang.IllegalArgumentException.

public GenericFormResponse execute(WebRequest wreq, String epName, String ipAddr, boolean useDefault, MultipartFile certFile)throws Exception {
.......//some code
byte[] certBytes = certFile.getBytes();
CertificateFactory cf = CertificateFactory.getInstance("X509");
X509Certificate cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(certBytes));
NameAdapter subject = CertificateVerifier.getSubject(cert);
if(StringUtils.equalsIgnoreCase(subject.getEmailAddress(), email)){
    ep.setCertData(cert.getSignature());
}else{
    LOGGER.debug("invalid certificates found.");
    response.setSuccess(false);
    response.setGlobalErrorCode("sa_endpoint_invalid_cert");
    return response;
}
......//some code.
}

CertificateVerifier.getSubject(cert); is custom code that is working fine in another scenario. Exception stack trace:

Caused by: java.lang.IllegalArgumentException: Bad sequence size: 6
        at org.bouncycastle.asn1.x509.AlgorithmIdentifier.<init>(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        at org.bouncycastle.asn1.x509.AlgorithmIdentifier.getInstance(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        at org.bouncycastle.asn1.x509.TBSCertificate.<init>(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        at org.bouncycastle.asn1.x509.TBSCertificate.getInstance(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        at org.bouncycastle.asn1.x509.Certificate.<init>(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        at org.bouncycastle.asn1.x509.Certificate.getInstance(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        at org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory.readPEMCertificate(Unknown Source) ~[bcprov-jdk15on-1.51.jar:1.51.0]
        ... 43 common frames omitted

Please help any one, how to read .csr file. The certificate file is below format.

-----BEGIN CERTIFICATE-----
MIIC+zCCAeMCAQAwgYUxCzAJBgNVBAYTAklOMRIwEAYDVQQIEwlLYXJuYXRha2ExEjAQBgNVBAcT
CUJlbmdhbHVydTESMBAGA1UEChMJQ29ubkluZGlhMRYwFAYDVQQLEw1Db25uZWN0IEluZGlhMSIw
IAYDVQQDExl3d3cudGVzdC5jb25uZWN0aW5kaWEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA7it/pHtJCLuc4BohScXvruMPY+QI8Y60gsp6Hm9tcWm1c4RHs0suGZ0jptHZEHsF
AJZm9fmjQsF2Oni0Ty1yGymIWcLh3NcXn7tthwpDH1k48fYWsluB1kWbxyTqv9vVDjXBcVoCUIUc
1jXIoaYxzb4VVgQvHkRwtPCIVygMfB6vBChPltdX0w0pQa8oFaL44w1afGukEjrrDuq1L9aejAI1
roPAZ3cYeMjzURrXP2sybdB9pcPvRqMkGhth17fzJOkOTHKiLObXp+euU8FwC/MIj1p0HiSd+XsZ
GKcqzLJ/6u2keOJIn83B4gUCo8Q23zqblPmcNRIdL5qMhtu9DQIDAQABoDAwLgYJKoZIhvcNAQkO
MSEwHzAdBgNVHQ4EFgQUrW69RwCRyWpbF9p4wP/sA//M6IIwDQYJKoZIhvcNAQELBQADggEBAJmC
RJpUZyzW1reLYtd6Iw7rzya3Fg3EKVksHIXxmtRxOMG+kbLdc2+p/SjTIGSWjs7EoCItJ+UsrPQM
uk8dEi4G3R9qIfGXycMX1tST9N4yy4nGALEYQ7MQlikCdsvzGh0u7G75nAMaObgf9hra513SsrqD
ta1jjZBlF6sp0VfRoqpvT09lqEkKmWQhYAtkIPIfgnRxCpC+IqxS2fk/x14pLnaRWtjHQOqOeKEo
KMG7dWtp15MKeKtNt8O5lahHH5yjtutwkGDHIQD6oksqxzBPvdLpQPJ90pxCdegwczRyDq/puzAb
DVwakU/8b0JLco4Mm/Bo3OxGjPmFdkO7P7g=
-----END CERTIFICATE-----

Thanks in advance.

Answer 1

X509 is missing the dot use X.509

CertificateFactory cf = CertificateFactory.getInstance("X.509")

Answer 2

First of all, I am confused. You said you need to read SSL certificate. But you are reading a .csr file which contains the "Certificate Signing Request". This is not a certificate. from this request, one can read the public key, validity period, key usage and use all these to create certificate. To do that, please follow the steps.

1. Convert the file data (byte array) to string.
2. Remove the following lines using replaceAll method of String (ex. csrString.replaceAll("...."))
   Line 1: -----BEGIN CERTIFICATE-----
   Line 2: -----END CERTIFICATE-----
3. Convert the data to Hex. Java 7 has build in library

javax.xml.bind.DatatypeConverter.parseBase64Binary("...")

4. Use the following method to get PKCS10 format data

PKCS10CertificationRequest pkcs10CertificationRequest = new PKCS10CertificationRequest(csrData);

5. Now read the data from pkcs10CertificationRequest and create X509Certificate
6. For more information, read the RFC. https://www.rfc-editor.org/rfc/rfc2986