如何繞過證書驗證數字簽名時驗證已過期

Question

我使用過期的公用證書在Java中驗證數字簽名（PKCS＃7）時遇到問題。 有關更多詳細信息，請在.NET中對數據進行簽名，然後使用Java進行驗證，但在Java中籤名數據時將出現「證書過期」錯誤，並在Java中驗證。在這兩種情況下，我使用了相同的驗證方法，相同的私鑰和公共證書。

請告訴我爲什麼？如果我想在驗證數字簽名時繞過證書過期驗證，該怎麼辦？

謝謝，在C＃.NET

註冊方法

private static string SignData(byte[] data, string pkcs12FileUrl, string pkcs12Password) 
    { 
     X509Certificate2 signerCert = new X509Certificate2(pkcs12FileUrl, pkcs12Password); 
     ContentInfo content = new ContentInfo(data); 
     SignedCms signed = new SignedCms(content, true); 
     CmsSigner signer = new CmsSigner(signerCert); 
     signer.IncludeOption = X509IncludeOption.None; 
     signed.ComputeSignature(signer); 

     return Convert.ToBase64String(signed.Encode()); 
    } 

在Java的註冊方法

public static String SignData(byte[] data, String pkcs12File, String pkcs12Password) 
    throws Exception 
{ 
     if(Security.getProvider("BC")==null) 
     { 
      Security.addProvider(new BouncyCastleProvider()); 
     } 
     KeyStore keyStore = getPkcs12Info(pkcs12File, pkcs12Password); 

     Enumeration<String> aliasesList = keyStore.aliases(); 
     String aliasName = ""; 
     while (aliasesList.hasMoreElements()) 
     { 
      aliasName = aliasesList.nextElement().toString(); 
     } 

     X509Certificate signerCert = (X509Certificate) keyStore.getCertificate(aliasName); 
     PrivateKey privateKey = (PrivateKey) keyStore.getKey(aliasName,pkcs12Password.toCharArray()); 

     CMSSignedDataGenerator Signer = new CMSSignedDataGenerator(); 
     Signer.addSigner(privateKey, signerCert, CMSSignedDataGenerator.DIGEST_SHA1); 

     CMSProcessableByteArray digestContent = new CMSProcessableByteArray(data); 

     CMSSignedData Signed = Signer.generate(digestContent, false, "BC"); 
     return Base64.encode(Signed.getEncoded()); 

} 

private static KeyStore getPkcs12Info(String pkcs12File, String pkcs12Password) throws Exception 
{ 
    //KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC"); 
     KeyStore keyStore = KeyStore.getInstance("PKCS12"); 
     keyStore.load(new FileInputStream(pkcs12File), pkcs12Password.toCharArray()); 
     return keyStore; 
} 

在Java中

public static boolean VerifySignature(byte[] data, String digitalSignature, InputStream publicCertFile) throws Exception 
{ 
    if(Security.getProvider("BC")==null) 
    { 
     Security.addProvider(new BouncyCastleProvider()); 
    } 
    CertificateFactory factory = CertificateFactory.getInstance("X509","BC"); 
    X509Certificate publicCert = (X509Certificate)factory.generateCertificate(publicCertFile); 
    CMSProcessableByteArray digestContent = new CMSProcessableByteArray(data); 
    CMSSignedData Signed = new CMSSignedData(digestContent,Base64.decode(digitalSignature)); 
    SignerInformation Signer=(SignerInformation)Signed.getSignerInfos().getSigners().iterator().next(); 
    return Signer.verify(publicCert, "BC"); 
} 

Answer 1

驗證方法，如果你簽署一份文件與已經過期的證書，已經沒有意義了。證書已經過期，不應該被用於新的用途。驗證簽名證書已過期的文檔是有意義的，因爲至少您知道簽名文檔時證書是有效的。除非它明顯是由.NET簽署的。聽起來像.NET中的一個bug給我。

Answer 2

我發現了這個話題Java implementation of C# SignedCms，並試圖改變我的Sign方法在Java中的代碼。最後，它工作得很好。在這裏，在Java的

public static String SignData(byte[] data, String pkcs12File, String pkcs12Password) 
    throws Exception 
{ 
     ByteArrayOutputStream byteArrOut = new ByteArrayOutputStream(); 
     DEROutputStream derOut = new DEROutputStream(byteArrOut); 
     try 
     { 
      if(Security.getProvider("BC")==null) 
      { 
       Security.addProvider(new BouncyCastleProvider()); 
      } 
      KeyStore keyStore = getPkcs12Info(pkcs12File, pkcs12Password); 

      Enumeration<String> aliasesList = keyStore.aliases(); 
      String aliasName = ""; 
      while (aliasesList.hasMoreElements()) 
      { 
       aliasName = aliasesList.nextElement().toString(); 
      } 

      X509Certificate signerCert = (X509Certificate) keyStore.getCertificate(aliasName); 
      PrivateKey privateKey = (PrivateKey) keyStore.getKey(aliasName, pkcs12Password.toCharArray()); 

      List certList = new ArrayList(); 
      Store certs = new JcaCertStore(certList); 

      JcaSimpleSignerInfoGeneratorBuilder builder = new JcaSimpleSignerInfoGeneratorBuilder().setProvider("BC").setDirectSignature(true); 


      CMSSignedDataGenerator signer = new CMSSignedDataGenerator(); 
      signer.addSignerInfoGenerator(builder.build("SHA1withRSA", privateKey, signerCert)); 
      signer.addCertificates(certs); 

      CMSTypedData msg = new CMSProcessableByteArray(data); 
      CMSSignedData signed = signer.generate(msg, false); 

      derOut.writeObject(signed.toASN1Structure().toASN1Primitive()); 
      return Base64.encode(byteArrOut.toByteArray()); 
     } 
     catch(Exception ex) 
     { 
      throw ex; 
     } 
     finally 
     { 
      derOut.close(); 
      byteArrOut.close(); 
     } 

}