Convert CertificateViolation into an enum (#829 )

* Convert CertificateViolation into an enum This ends up being nicer to deal with from callsites than class instances, while still permitting full configurability of all parameters. There are various other changes/fixes as well.
Correctly restore composite VKeys in DomainContent (#825 )
2026-08-10 09:16:12 +00:00 · 2020-10-07 22:19:36 -04:00 · 2020-10-07 12:42:01 -04:00 · 2020-10-07 11:52:17 -04:00 · 2020-10-06 15:47:42 -04:00
88 changed files with 857 additions and 15 deletions
@@ -202,6 +202,7 @@ org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -200,6 +200,7 @@ org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -204,6 +204,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -202,6 +202,7 @@ org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -201,6 +201,7 @@ org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.6.2
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -35,6 +35,7 @@ import javax.persistence.Index;
 import javax.persistence.JoinColumn;
 import javax.persistence.JoinTable;
 import javax.persistence.OneToMany;
+import javax.persistence.PostLoad;
 import javax.persistence.Table;
 import org.joda.time.DateTime;

@@ -106,6 +107,12 @@ public class DomainBase extends DomainContent
    return gracePeriods;
  }

+  @PostLoad
+  @SuppressWarnings("UnusedMethod")
+  private final void postLoad() {
+    restoreOfyKeys(getRepoId());
+  }
+
  @Override
  public VKey<DomainBase> createVKey() {
    return VKey.create(DomainBase.class, getRepoId(), Key.create(this));
@@ -40,6 +40,7 @@ import com.google.common.collect.ImmutableSortedSet;
 import com.google.common.collect.Ordering;
 import com.google.common.collect.Sets;
 import com.google.common.collect.Streams;
+import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Ignore;
 import com.googlecode.objectify.annotation.IgnoreSave;
 import com.googlecode.objectify.annotation.Index;
@@ -49,6 +50,7 @@ import google.registry.flows.ResourceFlowUtils;
 import google.registry.model.EppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
 import google.registry.model.billing.BillingEvent;
+import google.registry.model.common.EntityGroupRoot;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.launch.LaunchNotice;
 import google.registry.model.domain.rgp.GracePeriodStatus;
@@ -57,6 +59,7 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.HostResource;
 import google.registry.model.poll.PollMessage;
 import google.registry.model.registry.Registry;
+import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.transfer.DomainTransferData;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
@@ -209,6 +212,15 @@ public class DomainContent extends EppResource
  @Column(name = "deletion_poll_message_id")
  VKey<PollMessage.OneTime> deletePollMessage;

+  /**
+   * History record for the delete poll message.
+   *
+   * <p>Here so we can restore the original ofy key from sql.
+   */
+  @Column(name = "deletion_poll_message_history_id")
+  @Ignore
+  Long deletePollMessageHistoryId;
+
  /**
   * The recurring billing event associated with this domain's autorenewals.
   *
@@ -220,6 +232,15 @@ public class DomainContent extends EppResource
  @Column(name = "billing_recurrence_id")
  VKey<BillingEvent.Recurring> autorenewBillingEvent;

+  /**
+   * History record for the autorenew billing event.
+   *
+   * <p>Here so we can restore the original ofy key from sql.
+   */
+  @Column(name = "billing_recurrence_history_id")
+  @Ignore
+  Long autorenewBillingEventHistoryId;
+
  /**
   * The recurring poll message associated with this domain's autorenewals.
   *
@@ -231,6 +252,13 @@ public class DomainContent extends EppResource
  @Column(name = "autorenew_poll_message_id")
  VKey<PollMessage.Autorenew> autorenewPollMessage;

+  /**
+   * History record for the autorenew poll message.
+   *
+   * <p>Here so we can restore the original ofy key from sql.
+   */
+  @Ignore Long autorenewPollMessageHistoryId;
+
  /** The unexpired grace periods for this domain (some of which may not be active yet). */
  @Transient Set<GracePeriod> gracePeriods;

@@ -284,10 +312,22 @@ public class DomainContent extends EppResource
        nullToEmptyImmutableCopy(gracePeriods).stream()
            .map(gracePeriod -> gracePeriod.cloneWithDomainRepoId(getRepoId()))
            .collect(toImmutableSet());
+
+    // Restore history record ids.
+    autorenewPollMessageHistoryId = getHistoryId(autorenewPollMessage);
+    autorenewBillingEventHistoryId = getHistoryId(autorenewBillingEvent);
+    deletePollMessageHistoryId = getHistoryId(deletePollMessage);
  }

+  /**
+   * The {@link javax.persistence.PostLoad} method for {@link DomainContent}.
+   *
+   * <p>We name this domainContentPostLoad to distinguish it from the {@link PostLoad} method in
+   * DomainBase (if they share the same name, this one is never called).
+   */
  @PostLoad
-  void postLoad() {
+  @SuppressWarnings("UnusedMethod")
+  private final void domainContentPostLoad() {
    // Reconstitute the contact list.
    ImmutableSet.Builder<DesignatedContact> contactsBuilder = new ImmutableSet.Builder<>();

@@ -308,6 +348,48 @@ public class DomainContent extends EppResource
    allContacts = contactsBuilder.build();
  }

+  /**
+   * Restores the composite ofy keys from SQL data.
+   *
+   * <p>MUST ONLY BE CALLED FROM A PostLoad method. This is a package-visible method that
+   * effectively mutates an immutable object.
+   *
+   * <p>We have to do this because:
+   *
+   * <ul>
+   *   <li>We've changed the {@link PostLoad} method behavior to make all {@link PostLoad} calls in
+   *       the class hierarchy (and not merely the most specific one) be called after an object is
+   *       loaded.
+   *   <li>When restoring a {@link DomainBase} object (which is a subclass) the repo id is not
+   *       populated until after our {@link PostLoad} method is called. Therefore, we need to
+   *       restore these ofy keys (which depend on the repo id) from {@link DomainBase}'s {@link
+   *       PostLoad} method.
+   *   <li>When restoring a {@link DomainHistory} object, hibernate restores a {@link DomainContent}
+   *       instance, therefore we need our own {@link PostLoad} method to restore the other fields.
+   *       In order to restore the ofy keys, we need to invoke this method separately from {@link
+   *       DomainHistory}'s {@link PostLoad} method and pass in the repo id, which is stored in a
+   *       different field in {@link DomainHistory}.
+   * </ul>
+   */
+  void restoreOfyKeys(String repoId) {
+    // Reconstitute the ofy keys.
+    Key<DomainBase> myKey = Key.create(DomainBase.class, repoId);
+    deletePollMessage = restoreOfyFrom(myKey, deletePollMessage, deletePollMessageHistoryId);
+    autorenewBillingEvent =
+        restoreOfyFrom(myKey, autorenewBillingEvent, autorenewBillingEventHistoryId);
+    autorenewPollMessage =
+        restoreOfyFrom(myKey, autorenewPollMessage, autorenewPollMessageHistoryId);
+  }
+
+  private <T> VKey<T> restoreOfyFrom(Key<DomainBase> domainKey, VKey<T> key, Long historyId) {
+    if (historyId == null) {
+      // This is a legacy key (or a null key, in which case this works too)
+      return VKey.restoreOfyFrom(key, EntityGroupRoot.class, "per-tld");
+    } else {
+      return VKey.restoreOfyFrom(key, domainKey, HistoryEntry.class, historyId);
+    }
+  }
+
  public ImmutableSet<String> getSubordinateHosts() {
    return nullToEmptyImmutableCopy(subordinateHosts);
  }
@@ -655,6 +737,17 @@ public class DomainContent extends EppResource
            + " use DomainBase instead");
  }

+  private static Long getHistoryId(VKey<?> key) {
+    if (key == null) {
+      return null;
+    }
+    Key<?> parent = key.getOfyKey().getParent();
+    if (parent == null || parent.getKind().equals("EntityGroupRoot")) {
+      return null;
+    }
+    return parent.getId();
+  }
+
  /** Predicate to determine if a given {@link DesignatedContact} is the registrant. */
  static final Predicate<DesignatedContact> IS_REGISTRANT =
      (DesignatedContact contact) -> DesignatedContact.Type.REGISTRANT.equals(contact.type);
@@ -824,16 +917,19 @@ public class DomainContent extends EppResource

    public B setDeletePollMessage(VKey<PollMessage.OneTime> deletePollMessage) {
      getInstance().deletePollMessage = deletePollMessage;
+      getInstance().deletePollMessageHistoryId = getHistoryId(deletePollMessage);
      return thisCastToDerived();
    }

    public B setAutorenewBillingEvent(VKey<BillingEvent.Recurring> autorenewBillingEvent) {
      getInstance().autorenewBillingEvent = autorenewBillingEvent;
+      getInstance().autorenewBillingEventHistoryId = getHistoryId(autorenewBillingEvent);
      return thisCastToDerived();
    }

    public B setAutorenewPollMessage(VKey<PollMessage.Autorenew> autorenewPollMessage) {
      getInstance().autorenewPollMessage = autorenewPollMessage;
+      getInstance().autorenewPollMessageHistoryId = getHistoryId(autorenewPollMessage);
      return thisCastToDerived();
    }

@@ -170,6 +170,8 @@ public class DomainHistory extends HistoryEntry implements SqlEntity {
      // domainContent with a null object. Unfortunately, the updateTimestamp is never null in SQL.
      if (domainContent.getDomainName() == null) {
        domainContent = null;
+      } else {
+        domainContent.restoreOfyKeys(domainRepoId);
      }
    }
    parent = Key.create(DomainBase.class, domainRepoId);
@@ -273,8 +273,11 @@ class InitSqlPipelineTest {
            "revisions",
            "updateTimestamp",
            "autorenewBillingEvent",
+            "autorenewBillingEventHistoryId",
            "autorenewPollMessage",
+            "autorenewPollMessageHistoryId",
            "deletePollMessage",
+            "deletePollMessageHistoryId",
            "nsHosts",
            "transferData");
    assertThat(actual.getAdminContact().getSqlKey())
@@ -25,6 +25,11 @@ import static org.joda.time.DateTimeZone.UTC;
 import static org.junit.jupiter.api.Assertions.fail;

 import com.google.common.collect.ImmutableSet;
+import com.googlecode.objectify.Key;
+import google.registry.model.billing.BillingEvent;
+import google.registry.model.billing.BillingEvent.Flag;
+import google.registry.model.billing.BillingEvent.Reason;
+import google.registry.model.common.EntityGroupRoot;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DesignatedContact.Type;
 import google.registry.model.domain.launch.LaunchNotice;
@@ -33,6 +38,8 @@ import google.registry.model.domain.secdns.DelegationSignerData;
 import google.registry.model.eppcommon.AuthInfo.PasswordAuth;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.HostResource;
+import google.registry.model.poll.PollMessage;
+import google.registry.model.reporting.HistoryEntry;
 import google.registry.model.transfer.ContactTransferData;
 import google.registry.persistence.VKey;
 import google.registry.persistence.transaction.JpaTestRules;
@@ -60,6 +67,7 @@ public class DomainBaseSqlTest {
      new JpaTestRules.Builder().withClock(fakeClock).buildIntegrationWithCoverageExtension();

  private DomainBase domain;
+  private DomainHistory historyEntry;
  private VKey<ContactResource> contactKey;
  private VKey<ContactResource> contact2Key;
  private VKey<HostResource> host1VKey;
@@ -395,6 +403,174 @@ public class DomainBaseSqlTest {
            });
  }

+  @Test
+  void persistDomainWithCompositeVKeys() {
+    jpaTm()
+        .transact(
+            () -> {
+              historyEntry =
+                  new DomainHistory.Builder()
+                      .setType(HistoryEntry.Type.DOMAIN_CREATE)
+                      .setPeriod(Period.create(1, Period.Unit.YEARS))
+                      .setModificationTime(DateTime.now(UTC))
+                      .setParent(Key.create(DomainBase.class, "4-COM"))
+                      .setDomainRepoId("4-COM")
+
+                      // These are non-null, but I don't think some tests set them.
+                      .setReason("felt like it")
+                      .setRequestedByRegistrar(false)
+                      .setXmlBytes(new byte[0])
+                      .build();
+              BillingEvent.Recurring billEvent =
+                  new BillingEvent.Recurring.Builder()
+                      .setReason(Reason.RENEW)
+                      .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
+                      .setTargetId("example.com")
+                      .setClientId("registrar1")
+                      .setDomainRepoId("4-COM")
+                      .setDomainHistoryRevisionId(1L)
+                      .setEventTime(DateTime.now(UTC).plusYears(1))
+                      .setRecurrenceEndTime(END_OF_TIME)
+                      .setParent(historyEntry)
+                      .build();
+              PollMessage.Autorenew autorenewPollMessage =
+                  new PollMessage.Autorenew.Builder()
+                      .setClientId("registrar1")
+                      .setEventTime(DateTime.now(UTC).plusYears(1))
+                      .setParent(historyEntry)
+                      .build();
+              PollMessage.OneTime deletePollMessage =
+                  new PollMessage.OneTime.Builder()
+                      .setClientId("registrar1")
+                      .setEventTime(DateTime.now(UTC).plusYears(1))
+                      .setParent(historyEntry)
+                      .build();
+
+              jpaTm().insert(contact);
+              jpaTm().insert(contact2);
+              jpaTm().insert(host);
+              domain =
+                  domain
+                      .asBuilder()
+                      .setAutorenewBillingEvent(billEvent.createVKey())
+                      .setAutorenewPollMessage(autorenewPollMessage.createVKey())
+                      .setDeletePollMessage(deletePollMessage.createVKey())
+                      .build();
+              historyEntry = historyEntry.asBuilder().setDomainContent(domain).build();
+              jpaTm().insert(historyEntry);
+              jpaTm().insert(autorenewPollMessage);
+              jpaTm().insert(billEvent);
+              jpaTm().insert(deletePollMessage);
+              jpaTm().insert(domain);
+            });
+
+    // Store the existing BillingRecurrence VKey.  This happens after the event has been persisted.
+    DomainBase persisted = jpaTm().transact(() -> jpaTm().load(domain.createVKey()));
+
+    // Verify that the domain data has been persisted.
+    // dsData still isn't persisted.  gracePeriods appears to have the same values but for some
+    // reason is showing up as different.
+    assertEqualDomainExcept(persisted, "creationTime", "dsData", "gracePeriods");
+
+    // Verify that the DomainContent object from the history record sets the fields correctly.
+    DomainHistory persistedHistoryEntry =
+        jpaTm().transact(() -> jpaTm().load(historyEntry.createVKey()));
+    assertThat(persistedHistoryEntry.getDomainContent().get().getAutorenewPollMessage())
+        .isEqualTo(domain.getAutorenewPollMessage());
+    assertThat(persistedHistoryEntry.getDomainContent().get().getAutorenewBillingEvent())
+        .isEqualTo(domain.getAutorenewBillingEvent());
+    assertThat(persistedHistoryEntry.getDomainContent().get().getDeletePollMessage())
+        .isEqualTo(domain.getDeletePollMessage());
+  }
+
+  @Test
+  void persistDomainWithLegacyVKeys() {
+    jpaTm()
+        .transact(
+            () -> {
+              historyEntry =
+                  new DomainHistory.Builder()
+                      .setType(HistoryEntry.Type.DOMAIN_CREATE)
+                      .setPeriod(Period.create(1, Period.Unit.YEARS))
+                      .setModificationTime(DateTime.now(UTC))
+                      .setParent(Key.create(DomainBase.class, "4-COM"))
+                      .setDomainRepoId("4-COM")
+
+                      // These are non-null, but I don't think some tests set them.
+                      .setReason("felt like it")
+                      .setRequestedByRegistrar(false)
+                      .setXmlBytes(new byte[0])
+                      .build();
+              BillingEvent.Recurring billEvent =
+                  new BillingEvent.Recurring.Builder()
+                      .setReason(Reason.RENEW)
+                      .setFlags(ImmutableSet.of(Flag.AUTO_RENEW))
+                      .setTargetId("example.com")
+                      .setClientId("registrar1")
+                      .setDomainRepoId("4-COM")
+                      .setDomainHistoryRevisionId(1L)
+                      .setEventTime(DateTime.now(UTC).plusYears(1))
+                      .setRecurrenceEndTime(END_OF_TIME)
+                      .setParent(historyEntry)
+                      .build();
+              PollMessage.Autorenew autorenewPollMessage =
+                  new PollMessage.Autorenew.Builder()
+                      .setClientId("registrar1")
+                      .setEventTime(DateTime.now(UTC).plusYears(1))
+                      .setParent(historyEntry)
+                      .build();
+              PollMessage.OneTime deletePollMessage =
+                  new PollMessage.OneTime.Builder()
+                      .setClientId("registrar1")
+                      .setEventTime(DateTime.now(UTC).plusYears(1))
+                      .setParent(historyEntry)
+                      .build();
+
+              jpaTm().insert(contact);
+              jpaTm().insert(contact2);
+              jpaTm().insert(host);
+              domain =
+                  domain
+                      .asBuilder()
+                      .setAutorenewBillingEvent(
+                          createLegacyVKey(BillingEvent.Recurring.class, billEvent.getId()))
+                      .setAutorenewPollMessage(
+                          createLegacyVKey(PollMessage.Autorenew.class, deletePollMessage.getId()))
+                      .setDeletePollMessage(
+                          createLegacyVKey(PollMessage.OneTime.class, autorenewPollMessage.getId()))
+                      .build();
+              historyEntry = historyEntry.asBuilder().setDomainContent(domain).build();
+              jpaTm().insert(historyEntry);
+              jpaTm().insert(autorenewPollMessage);
+              jpaTm().insert(billEvent);
+              jpaTm().insert(deletePollMessage);
+              jpaTm().insert(domain);
+            });
+
+    // Store the existing BillingRecurrence VKey.  This happens after the event has been persisted.
+    DomainBase persisted = jpaTm().transact(() -> jpaTm().load(domain.createVKey()));
+
+    // Verify that the domain data has been persisted.
+    // dsData still isn't persisted.  gracePeriods appears to have the same values but for some
+    // reason is showing up as different.
+    assertEqualDomainExcept(persisted, "creationTime", "dsData", "gracePeriods");
+
+    // Verify that the DomainContent object from the history record sets the fields correctly.
+    DomainHistory persistedHistoryEntry =
+        jpaTm().transact(() -> jpaTm().load(historyEntry.createVKey()));
+    assertThat(persistedHistoryEntry.getDomainContent().get().getAutorenewPollMessage())
+        .isEqualTo(domain.getAutorenewPollMessage());
+    assertThat(persistedHistoryEntry.getDomainContent().get().getAutorenewBillingEvent())
+        .isEqualTo(domain.getAutorenewBillingEvent());
+    assertThat(persistedHistoryEntry.getDomainContent().get().getDeletePollMessage())
+        .isEqualTo(domain.getDeletePollMessage());
+  }
+
+  private <T> VKey<T> createLegacyVKey(Class<T> clazz, long id) {
+    return VKey.create(
+        clazz, id, Key.create(Key.create(EntityGroupRoot.class, "per-tld"), clazz, id));
+  }
+
  private void assertEqualDomainExcept(DomainBase thatDomain, String... excepts) {
    // Fix DS data, since we can't persist it yet.
    thatDomain =
@@ -67,6 +67,7 @@ public class PollMessageTest extends EntityTestCase {
                .build());
    oneTime =
        new PollMessage.OneTime.Builder()
+            .setId(100L)
            .setClientId("TheRegistrar")
            .setEventTime(fakeClock.nowUtc())
            .setMsg("Test poll message")
@@ -74,6 +75,7 @@ public class PollMessageTest extends EntityTestCase {
            .build();
    autoRenew =
        new PollMessage.Autorenew.Builder()
+            .setId(200L)
            .setClientId("TheRegistrar")
            .setEventTime(fakeClock.nowUtc())
            .setMsg("Test poll message")
@@ -14,7 +14,7 @@

 package google.registry.ui.server.registrar;

-import static com.google.appengine.repackaged.com.google.common.collect.Iterables.getOnlyElement;
+import static com.google.common.collect.Iterables.getOnlyElement;
 import static com.google.monitoring.metrics.contrib.LongMetricSubject.assertThat;
 import static google.registry.config.RegistryConfig.getGSuiteOutgoingEmailAddress;
 import static google.registry.config.RegistryConfig.getGSuiteOutgoingEmailDisplayName;
@@ -58,3 +58,4 @@ V57__history_null_content.sql
 V58__drop_default_value_and_sequences_for_billing_event.sql
 V59__use_composite_primary_key_for_contact_and_host_history_table.sql
 V60__remove_pollmessage_sequence.sql
+V61__domain_hist_columns.sql
@@ -0,0 +1,39 @@
+-- Copyright 2020 The Nomulus Authors. All Rights Reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http:--www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+-- These history ids are technically foreign keys, we don't want to constrain
+-- them because they're temporary and we don't need to because they are
+-- already indirectly constrained by the relationships with the
+-- PollMessages/BillingEvents involved.
+ALTER TABLE "Domain" ADD COLUMN billing_recurrence_history_id int8;
+ALTER TABLE "Domain" ADD COLUMN autorenew_poll_message_history_id int8;
+ALTER TABLE "Domain" ADD COLUMN deletion_poll_message_history_id int8;
+ALTER TABLE "DomainHistory" ADD COLUMN billing_recurrence_history_id int8;
+ALTER TABLE "DomainHistory" ADD COLUMN autorenew_poll_message_history_id int8;
+ALTER TABLE "DomainHistory" ADD COLUMN deletion_poll_message_history_id int8;
+
+-- Drop and re-add DomainHistory's Domain FK constraint to make it deferrable,
+-- this breaks a cycle with Domain -> PollMessage|BillingEvent -> History.
+ALTER TABLE "DomainHistory" DROP CONSTRAINT fk_domain_history_domain_repo_id;
+ALTER TABLE "DomainHistory"
+  ADD CONSTRAINT fk_domain_history_domain_repo_id
+  FOREIGN KEY (domain_repo_id) REFERENCES "Domain"(repo_id)
+  DEFERRABLE INITIALLY DEFERRED;
+
+-- Same for PollMessage -> Domain, breaking Domain -> PollMessage -> Domain.
+ALTER TABLE "PollMessage" DROP CONSTRAINT fk_poll_message_domain_repo_id;
+ALTER TABLE "PollMessage"
+  ADD CONSTRAINT fk_poll_message_domain_repo_id
+  FOREIGN KEY (domain_repo_id) REFERENCES "Domain"(repo_id)
+  DEFERRABLE INITIALLY DEFERRED;
@@ -249,10 +249,13 @@ create sequence temp_history_id_sequence start 1 increment 50;
        auth_info_repo_id text,
        auth_info_value text,
        billing_recurrence_id int8,
+        billing_recurrence_history_id int8,
        autorenew_end_time timestamptz,
        autorenew_poll_message_id int8,
+        autorenew_poll_message_history_id int8,
        billing_contact text,
        deletion_poll_message_id int8,
+        deletion_poll_message_history_id int8,
        domain_name text,
        idn_table_name text,
        last_transfer_time timestamptz,
@@ -301,10 +304,13 @@ create sequence temp_history_id_sequence start 1 increment 50;
        auth_info_repo_id text,
        auth_info_value text,
        billing_recurrence_id int8,
+        billing_recurrence_history_id int8,
        autorenew_end_time timestamptz,
        autorenew_poll_message_id int8,
+        autorenew_poll_message_history_id int8,
        billing_contact text,
        deletion_poll_message_id int8,
+        deletion_poll_message_history_id int8,
        domain_name text,
        idn_table_name text,
        last_transfer_time timestamptz,
@@ -353,7 +353,10 @@ CREATE TABLE public."Domain" (
    billing_recurrence_id bigint,
    autorenew_poll_message_id bigint,
    deletion_poll_message_id bigint,
-    autorenew_end_time timestamp with time zone
+    autorenew_end_time timestamp with time zone,
+    billing_recurrence_history_id bigint,
+    autorenew_poll_message_history_id bigint,
+    deletion_poll_message_history_id bigint
 );


@@ -420,7 +423,10 @@ CREATE TABLE public."DomainHistory" (
    autorenew_end_time timestamp with time zone,
    history_other_registrar_id text,
    history_period_unit text,
-    history_period_value integer
+    history_period_value integer,
+    billing_recurrence_history_id bigint,
+    autorenew_poll_message_history_id bigint,
+    deletion_poll_message_history_id bigint
 );


@@ -1768,7 +1774,7 @@ ALTER TABLE ONLY public."Domain"
 --

 ALTER TABLE ONLY public."DomainHistory"
-    ADD CONSTRAINT fk_domain_history_domain_repo_id FOREIGN KEY (domain_repo_id) REFERENCES public."Domain"(repo_id);
+    ADD CONSTRAINT fk_domain_history_domain_repo_id FOREIGN KEY (domain_repo_id) REFERENCES public."Domain"(repo_id) DEFERRABLE INITIALLY DEFERRED;


 --
@@ -1904,7 +1910,7 @@ ALTER TABLE ONLY public."PollMessage"
 --

 ALTER TABLE ONLY public."PollMessage"
-    ADD CONSTRAINT fk_poll_message_domain_repo_id FOREIGN KEY (domain_repo_id) REFERENCES public."Domain"(repo_id);
+    ADD CONSTRAINT fk_poll_message_domain_repo_id FOREIGN KEY (domain_repo_id) REFERENCES public."Domain"(repo_id) DEFERRABLE INITIALLY DEFERRED;


 --
@@ -204,6 +204,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -202,6 +202,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -204,6 +204,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -204,6 +204,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -208,6 +208,7 @@ org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -207,6 +207,7 @@ org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -208,6 +208,7 @@ org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -208,6 +208,7 @@ org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.apiguardian:apiguardian-api:1.1.0
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -25,7 +25,7 @@ import com.google.common.collect.ImmutableList;
 import dagger.Lazy;
 import dagger.Module;
 import dagger.Provides;
-import google.registry.networking.util.SelfSignedCaCertificate;
+import google.registry.util.SelfSignedCaCertificate;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -21,7 +21,7 @@ import static google.registry.networking.handler.SslInitializerTestUtils.signKey
 import static google.registry.networking.handler.SslInitializerTestUtils.verifySslException;

 import com.google.common.collect.ImmutableList;
-import google.registry.networking.util.SelfSignedCaCertificate;
+import google.registry.util.SelfSignedCaCertificate;
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelHandler;
 import io.netty.channel.ChannelPipeline;
@@ -18,7 +18,7 @@ import static com.google.common.truth.Truth.assertThat;
 import static org.junit.jupiter.api.Assertions.assertThrows;

 import com.google.common.base.Throwables;
-import google.registry.networking.util.SelfSignedCaCertificate;
+import google.registry.util.SelfSignedCaCertificate;
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelFuture;
 import io.netty.handler.ssl.SslHandler;
@@ -23,7 +23,7 @@ import static google.registry.networking.handler.SslServerInitializer.CLIENT_CER

 import com.google.common.base.Suppliers;
 import com.google.common.collect.ImmutableList;
-import google.registry.networking.util.SelfSignedCaCertificate;
+import google.registry.util.SelfSignedCaCertificate;
 import io.netty.channel.ChannelHandler;
 import io.netty.channel.ChannelInitializer;
 import io.netty.channel.ChannelPipeline;
@@ -26,7 +26,7 @@ import dagger.Component;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.networking.module.CertificateSupplierModule.Mode;
-import google.registry.networking.util.SelfSignedCaCertificate;
+import google.registry.util.SelfSignedCaCertificate;
 import java.io.ByteArrayOutputStream;
 import java.io.OutputStreamWriter;
 import java.security.KeyPair;
@@ -23,9 +23,9 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.jupiter.api.Assertions.assertThrows;

 import com.google.common.base.Throwables;
-import google.registry.networking.util.SelfSignedCaCertificate;
 import google.registry.proxy.handler.HttpsRelayServiceHandler.NonOkHttpResponseException;
 import google.registry.testing.FakeClock;
+import google.registry.util.SelfSignedCaCertificate;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 import io.netty.channel.embedded.EmbeddedChannel;
@@ -27,10 +27,10 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;

 import com.google.common.base.Throwables;
-import google.registry.networking.util.SelfSignedCaCertificate;
 import google.registry.proxy.TestUtils;
 import google.registry.proxy.handler.HttpsRelayServiceHandler.NonOkHttpResponseException;
 import google.registry.proxy.metric.FrontendMetrics;
+import google.registry.util.SelfSignedCaCertificate;
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 import io.netty.channel.ChannelInitializer;
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -203,6 +203,7 @@ org.apache.httpcomponents:httpcore:4.4.13
 org.apache.logging.log4j:log4j-api:2.13.3
 org.apache.logging.log4j:log4j-core:2.13.3
 org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcpkix-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
@@ -32,6 +32,8 @@ dependencies {
  compile deps['javax.xml.bind:jaxb-api']
  compile deps['joda-time:joda-time']
  compile deps['org.yaml:snakeyaml']
+  compile deps['org.bouncycastle:bcpkix-jdk15on']
+  compile deps['org.bouncycastle:bcprov-jdk15on']
  compile project(':common')
  runtime deps['com.google.auto.value:auto-value']
  testCompile deps['com.google.appengine:appengine-api-stubs']
@@ -34,5 +34,7 @@ javax.xml.bind:jaxb-api:2.3.0
 joda-time:joda-time:2.9.2
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.11.1
 org.yaml:snakeyaml:1.17
@@ -34,5 +34,7 @@ javax.xml.bind:jaxb-api:2.3.0
 joda-time:joda-time:2.9.2
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.11.1
 org.yaml:snakeyaml:1.17
@@ -35,5 +35,7 @@ javax.xml.bind:jaxb-api:2.3.0
 joda-time:joda-time:2.9.2
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.11.1
 org.yaml:snakeyaml:1.17
@@ -35,5 +35,7 @@ javax.xml.bind:jaxb-api:2.3.0
 joda-time:joda-time:2.9.2
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.11.1
 org.yaml:snakeyaml:1.17
@@ -35,5 +35,7 @@ javax.xml.bind:jaxb-api:2.3.0
 joda-time:joda-time:2.9.2
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.11.1
 org.yaml:snakeyaml:1.17
@@ -35,5 +35,7 @@ javax.xml.bind:jaxb-api:2.3.0
 joda-time:joda-time:2.9.2
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.11.1
 org.yaml:snakeyaml:1.17
@@ -42,6 +42,8 @@ net.bytebuddy:byte-buddy:1.10.5
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apiguardian:apiguardian-api:1.1.0
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-all:1.3
@@ -42,6 +42,8 @@ net.bytebuddy:byte-buddy:1.10.5
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apiguardian:apiguardian-api:1.1.0
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-all:1.3
@@ -44,6 +44,8 @@ net.bytebuddy:byte-buddy:1.10.5
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apiguardian:apiguardian-api:1.1.0
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-all:1.3
@@ -44,6 +44,8 @@ net.bytebuddy:byte-buddy:1.10.5
 org.apache.httpcomponents:httpclient:4.5.11
 org.apache.httpcomponents:httpcore:4.4.13
 org.apiguardian:apiguardian-api:1.1.0
+org.bouncycastle:bcpkix-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.11.1
 org.hamcrest:hamcrest-all:1.3
@@ -0,0 +1,177 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.util;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSortedMap;
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPublicKey;
+import java.util.Date;
+import org.joda.time.DateTime;
+import org.joda.time.Days;
+
+/** An utility to check that a given certificate meets our requirements */
+public class CertificateChecker {
+
+  private final ImmutableSortedMap<DateTime, Integer> maxValidityLengthSchedule;
+  private final int daysToExpiration;
+  private final int minimumRsaKeyLength;
+  private final Clock clock;
+
+  /**
+   * Constructs a CertificateChecker instance with the specified configuration parameters.
+   *
+   * <p>The max validity length schedule is a sorted map of {@link DateTime} to {@link Integer}
+   * entries representing a maximum validity period for certificates issued on or after that date.
+   * The first entry must have a key of {@link DateTimeUtils#START_OF_TIME}, such that every
+   * possible date has an applicable max validity period. Since security requirements tighten over
+   * time, the max validity periods will be decreasing as the date increases.
+   *
+   * <p>The validity length schedule used by all major Web browsers as of 2020Q4 would be
+   * represented as:
+   *
+   * <pre>
+   *   ImmutableSortedMap.of(
+   *     START_OF_TIME, 825,
+   *     DateTime.parse("2020-09-01T00:00:00Z"), 398
+   *   );
+   * </pre>
+   */
+  // TODO(sarahbot): Inject this.
+  public CertificateChecker(
+      ImmutableSortedMap<DateTime, Integer> maxValidityLengthSchedule,
+      int daysToExpiration,
+      int minimumRsaKeyLength,
+      Clock clock) {
+    checkArgument(
+        maxValidityLengthSchedule.containsKey(START_OF_TIME),
+        "Max validity length schedule must contain an entry for START_OF_TIME");
+    this.maxValidityLengthSchedule = maxValidityLengthSchedule;
+    this.daysToExpiration = daysToExpiration;
+    this.minimumRsaKeyLength = minimumRsaKeyLength;
+    this.clock = clock;
+  }
+
+  /**
+   * Checks a certificate for violations and returns a list of all the violations the certificate
+   * has.
+   */
+  public ImmutableSet<CertificateViolation> checkCertificate(X509Certificate certificate) {
+    ImmutableSet.Builder<CertificateViolation> violations = new ImmutableSet.Builder<>();
+
+    // Check if currently in validity period
+    Date now = clock.nowUtc().toDate();
+    if (certificate.getNotAfter().before(now)) {
+      violations.add(CertificateViolation.EXPIRED);
+    } else if (certificate.getNotBefore().after(now)) {
+      violations.add(CertificateViolation.NOT_YET_VALID);
+    }
+
+    // Check validity period length
+    int maxValidityDays =
+        maxValidityLengthSchedule.floorEntry(new DateTime(certificate.getNotBefore())).getValue();
+    if (getValidityLengthInDays(certificate) > maxValidityDays) {
+      violations.add(CertificateViolation.VALIDITY_LENGTH_TOO_LONG);
+    }
+
+    // Check key strengths
+    PublicKey key = certificate.getPublicKey();
+    if (key.getAlgorithm().equals("RSA")) {
+      RSAPublicKey rsaPublicKey = (RSAPublicKey) key;
+      if (rsaPublicKey.getModulus().bitLength() < minimumRsaKeyLength) {
+        violations.add(CertificateViolation.RSA_KEY_LENGTH_TOO_SHORT);
+      }
+    } else if (key.getAlgorithm().equals("EC")) {
+      // TODO(sarahbot): Add verification of ECDSA curves
+    } else {
+      violations.add(CertificateViolation.ALGORITHM_CONSTRAINED);
+    }
+    return violations.build();
+  }
+
+  /**
+   * Returns whether the certificate is nearing expiration.
+   *
+   * <p>Note that this is <i>all</i> that it checks. The certificate itself may well be expired or
+   * not yet valid and this message will still return false. So you definitely want to pair a call
+   * to this method with a call to {@link #checkCertificate} to determine other issues with the
+   * certificate that may be occurring.
+   */
+  public boolean isNearingExpiration(X509Certificate certificate) {
+    Date nearingExpirationDate =
+        DateTime.parse(certificate.getNotAfter().toInstant().toString())
+            .minusDays(daysToExpiration)
+            .toDate();
+    return clock.nowUtc().toDate().after(nearingExpirationDate);
+  }
+
+  private static int getValidityLengthInDays(X509Certificate certificate) {
+    DateTime start = DateTime.parse(certificate.getNotBefore().toInstant().toString());
+    DateTime end = DateTime.parse(certificate.getNotAfter().toInstant().toString());
+    return Days.daysBetween(start.withTimeAtStartOfDay(), end.withTimeAtStartOfDay()).getDays();
+  }
+
+  private String getViolationDisplayMessage(CertificateViolation certificateViolation) {
+    // Yes, we'd rather do this as an instance method on the CertificateViolation enum itself, but
+    // we can't because we need access to configuration (injected as instance variables) which you
+    // can't get in a static enum context.
+    switch (certificateViolation) {
+      case EXPIRED:
+        return "Certificate is expired.";
+      case NOT_YET_VALID:
+        return "Certificate start date is in the future.";
+      case ALGORITHM_CONSTRAINED:
+        return "Certificate key algorithm must be RSA or ECDSA.";
+      case RSA_KEY_LENGTH_TOO_SHORT:
+        return String.format(
+            "RSA key length is too short; the minimum allowed length is %d bits.",
+            this.minimumRsaKeyLength);
+      case VALIDITY_LENGTH_TOO_LONG:
+        return String.format(
+            "Certificate validity period is too long; it must be less than or equal to %d days.",
+            this.maxValidityLengthSchedule.lastEntry().getValue());
+      default:
+        throw new IllegalArgumentException(
+            String.format(
+                "Unknown CertificateViolation enum value: %s", certificateViolation.name()));
+    }
+  }
+
+  /**
+   * The type of violation a certificate has based on the certificate requirements
+   * (go/registry-proxy-security).
+   */
+  public enum CertificateViolation {
+    EXPIRED,
+    NOT_YET_VALID,
+    VALIDITY_LENGTH_TOO_LONG,
+    RSA_KEY_LENGTH_TOO_SHORT,
+    ALGORITHM_CONSTRAINED;
+
+    /**
+     * Gets a suitable end-user-facing display message for this particular certificate violation.
+     *
+     * <p>Note that the {@link CertificateChecker} instance must be passed in because it contains
+     * configuration values (e.g. minimum RSA key length) that go into the error message text.
+     */
+    public String getDisplayMessage(CertificateChecker certificateChecker) {
+      return certificateChecker.getViolationDisplayMessage(this);
+    }
+  }
+}
@@ -12,8 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package google.registry.networking.util;
+package google.registry.util;

+import static com.google.common.base.Preconditions.checkArgument;
+
+import com.google.common.collect.ImmutableMap;
 import java.math.BigInteger;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
@@ -34,6 +37,7 @@ import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.joda.time.DateTime;

 /** A self-signed certificate authority (CA) cert for use in tests. */
 // TODO(weiminyu): make this class test-only. Requires refactor in proxy and prober.
@@ -47,6 +51,9 @@ public class SelfSignedCaCertificate {
  private static final Random RANDOM = new Random();
  private static final BouncyCastleProvider PROVIDER = new BouncyCastleProvider();
  private static final KeyPairGenerator keyGen = createKeyPairGenerator();
+  private static final ImmutableMap<String, String> KEY_SIGNATURE_ALGS =
+      ImmutableMap.of(
+          "EC", "SHA256WithECDSA", "DSA", "SHA256WithDSA", "RSA", "SHA256WithRSAEncryption");

  private final PrivateKey privateKey;
  private final X509Certificate cert;
@@ -77,11 +84,22 @@ public class SelfSignedCaCertificate {
    return create(keyGen.generateKeyPair(), fqdn, from, to);
  }

+  public static SelfSignedCaCertificate create(String fqdn, DateTime from, DateTime to)
+      throws Exception {
+    return create(keyGen.generateKeyPair(), fqdn, from.toDate(), to.toDate());
+  }
+
  public static SelfSignedCaCertificate create(KeyPair keyPair, String fqdn, Date from, Date to)
      throws Exception {
    return new SelfSignedCaCertificate(keyPair.getPrivate(), createCaCert(keyPair, fqdn, from, to));
  }

+  public static SelfSignedCaCertificate create(
+      KeyPair keyPair, String fqdn, DateTime from, DateTime to) throws Exception {
+    return new SelfSignedCaCertificate(
+        keyPair.getPrivate(), createCaCert(keyPair, fqdn, from.toDate(), to.toDate()));
+  }
+
  static KeyPairGenerator createKeyPairGenerator() {
    try {
      KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", PROVIDER);
@@ -96,8 +114,11 @@ public class SelfSignedCaCertificate {
  static X509Certificate createCaCert(KeyPair keyPair, String fqdn, Date from, Date to)
      throws Exception {
    X500Name owner = new X500Name("CN=" + fqdn);
+    String publicKeyAlg = keyPair.getPublic().getAlgorithm();
+    checkArgument(KEY_SIGNATURE_ALGS.containsKey(publicKeyAlg), "Unexpected public key algorithm");
+    String signatureAlgorithm = KEY_SIGNATURE_ALGS.get(publicKeyAlg);
    ContentSigner signer =
-        new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(keyPair.getPrivate());
+        new JcaContentSignerBuilder(signatureAlgorithm).build(keyPair.getPrivate());
    X509v3CertificateBuilder builder =
        new JcaX509v3CertificateBuilder(
            owner, new BigInteger(64, RANDOM), from, to, owner, keyPair.getPublic());
@@ -0,0 +1,228 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.util;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.util.CertificateChecker.CertificateViolation.ALGORITHM_CONSTRAINED;
+import static google.registry.util.CertificateChecker.CertificateViolation.EXPIRED;
+import static google.registry.util.CertificateChecker.CertificateViolation.NOT_YET_VALID;
+import static google.registry.util.CertificateChecker.CertificateViolation.RSA_KEY_LENGTH_TOO_SHORT;
+import static google.registry.util.CertificateChecker.CertificateViolation.VALIDITY_LENGTH_TOO_LONG;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
+
+import com.google.common.collect.ImmutableSortedMap;
+import google.registry.testing.FakeClock;
+import java.security.KeyPairGenerator;
+import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.joda.time.DateTime;
+import org.junit.jupiter.api.Test;
+
+/** Unit tests for {@link CertificateChecker} */
+class CertificateCheckerTest {
+
+  private static final String SSL_HOST = "www.example.tld";
+
+  private FakeClock fakeClock = new FakeClock();
+  private CertificateChecker certificateChecker =
+      new CertificateChecker(
+          ImmutableSortedMap.of(START_OF_TIME, 825, DateTime.parse("2020-09-01T00:00:00Z"), 398),
+          30,
+          2048,
+          fakeClock);
+
+  @Test
+  void test_checkCertificate_compliantCertPasses() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.checkCertificate(certificate)).isEmpty();
+  }
+
+  @Test
+  void test_checkCertificate_severalViolations() throws Exception {
+    fakeClock.setTo(DateTime.parse("2010-01-01T00:00:00Z"));
+    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", new BouncyCastleProvider());
+    keyGen.initialize(1024, new SecureRandom());
+
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                keyGen.generateKeyPair(),
+                SSL_HOST,
+                DateTime.parse("2010-04-01T00:00:00Z"),
+                DateTime.parse("2014-07-01T00:00:00Z"))
+            .cert();
+
+    assertThat(certificateChecker.checkCertificate(certificate))
+        .containsExactly(NOT_YET_VALID, VALIDITY_LENGTH_TOO_LONG, RSA_KEY_LENGTH_TOO_SHORT);
+  }
+
+  @Test
+  void test_checkCertificate_expiredCertificate() throws Exception {
+    fakeClock.setTo(DateTime.parse("2014-01-01T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2010-04-01T00:00:00Z"),
+                DateTime.parse("2012-07-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.checkCertificate(certificate)).containsExactly(EXPIRED);
+  }
+
+  @Test
+  void test_checkCertificate_notYetValid() throws Exception {
+    fakeClock.setTo(DateTime.parse("2010-01-01T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2010-04-01T00:00:00Z"),
+                DateTime.parse("2012-07-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.checkCertificate(certificate)).containsExactly(NOT_YET_VALID);
+  }
+
+  @Test
+  void test_checkCertificate_validityLengthWayTooLong() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2016-04-01T00:00:00Z"),
+                DateTime.parse("2021-07-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.checkCertificate(certificate))
+        .containsExactly(VALIDITY_LENGTH_TOO_LONG);
+  }
+
+  @Test
+  void test_checkCertificate_olderValidityLengthIssuedAfterCutoff() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2022-10-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.checkCertificate(certificate))
+        .containsExactly(VALIDITY_LENGTH_TOO_LONG);
+  }
+
+  @Test
+  void test_checkCertificate_olderValidityLengthIssuedBeforeCutoff() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2019-09-01T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.checkCertificate(certificate)).isEmpty();
+  }
+
+  @Test
+  void test_checkCertificate_rsaKeyLengthTooShort() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", new BouncyCastleProvider());
+    keyGen.initialize(1024, new SecureRandom());
+
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                keyGen.generateKeyPair(),
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+
+    assertThat(certificateChecker.checkCertificate(certificate))
+        .containsExactly(RSA_KEY_LENGTH_TOO_SHORT);
+  }
+
+  @Test
+  void test_checkCertificate_rsaKeyLengthLongerThanRequired() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", new BouncyCastleProvider());
+    keyGen.initialize(4096, new SecureRandom());
+
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                keyGen.generateKeyPair(),
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+
+    assertThat(certificateChecker.checkCertificate(certificate)).isEmpty();
+  }
+
+  @Test
+  void test_checkCertificate_invalidAlgorithm() throws Exception {
+    fakeClock.setTo(DateTime.parse("2020-10-01T00:00:00Z"));
+    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("DSA", new BouncyCastleProvider());
+    keyGen.initialize(2048, new SecureRandom());
+
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                keyGen.generateKeyPair(),
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+
+    assertThat(certificateChecker.checkCertificate(certificate))
+        .containsExactly(ALGORITHM_CONSTRAINED);
+  }
+
+  @Test
+  void test_isNearingExpiration_yesItIs() throws Exception {
+    fakeClock.setTo(DateTime.parse("2021-09-20T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.isNearingExpiration(certificate)).isTrue();
+  }
+
+  @Test
+  void test_isNearingExpiration_noItsNot() throws Exception {
+    fakeClock.setTo(DateTime.parse("2021-07-20T00:00:00Z"));
+    X509Certificate certificate =
+        SelfSignedCaCertificate.create(
+                SSL_HOST,
+                DateTime.parse("2020-09-02T00:00:00Z"),
+                DateTime.parse("2021-10-01T00:00:00Z"))
+            .cert();
+    assertThat(certificateChecker.isNearingExpiration(certificate)).isFalse();
+  }
+
+  @Test
+  void test_CertificateViolation_RsaKeyLengthDisplayMessageFormatsCorrectly() {
+    assertThat(RSA_KEY_LENGTH_TOO_SHORT.getDisplayMessage(certificateChecker))
+        .isEqualTo("RSA key length is too short; the minimum allowed length is 2048 bits.");
+  }
+
+  @Test
+  void test_CertificateViolation_validityLengthDisplayMessageFormatsCorrectly() {
+    assertThat(VALIDITY_LENGTH_TOO_LONG.getDisplayMessage(certificateChecker))
+        .isEqualTo(
+            "Certificate validity period is too long; it must be less than or equal to 398 days.");
+  }
+}
Author	SHA1	Message	Date
Ben McIlwainandGitHub	2e230664fd	Convert CertificateViolation into an enum (#829 ) * Convert CertificateViolation into an enum This ends up being nicer to deal with from callsites than class instances, while still permitting full configurability of all parameters. There are various other changes/fixes as well.	2020-10-07 22:19:36 -04:00
Michael MullerandGitHub	299b093f78	Correctly restore composite VKeys in DomainContent (#825 ) * Restore composite vkeys in DomainContent PollMessage/BillingEvent vkeys in DomainContent must have their ofy keys restored from other fields in DomainContent (namely the repo id and their specific history event ids). Add PostLoad methods to DomainContent and DomainHistory to do the restoration. * Fixes for review. * Deal with foreign-key cycles	2020-10-07 12:42:01 -04:00
Ben McIlwainandGitHub	61e7fa89f7	Fix incorrect repackaged App Engine import (#828 ) * Fix incorrect repackaged App Engine import	2020-10-07 11:52:17 -04:00
sarahcaseybotandGitHub	6ab69d4226	Add a CertificateChecker class (#793 ) * CertificateChecker with checks for expiration and key length * Add validity length check * Get rid of hard-coded constants and DSA checks * add files that for some reason weren't included in last commit * Rename violations and other fixes * Add displayMessage to CertificateViolation enum * Switch violations from an enum to a class * small changes * Get rid of ECDSA checks * add checks for old validity length * Change error message for validity length	2020-10-06 15:47:42 -04:00