Java - 沒有BC的簽名證書programaticaly

我在使用允許我在不使用keytool的情況下從java代碼生成和簽名證書的代碼中掙扎。另外由於依賴問題和不兼容性，我無法使用bouncycastle庫。Java - 沒有BC的簽名證書programaticaly

到目前爲止，我找到工作的代碼與給定的參數生成CSR，它似乎工作（至少openssl工具驗證它確實是一個有效的CSR），我發現的代碼是在這裏：

http://www.journaldev.com/223/generating-a-certificate-signing-request-using-java-api

由於jdk7中缺少X500Signer類，因此它可以進行簡單的修改。

我如何註冊這個CSR與我自己的CA（我在用的OpenSSL生成的文本文件，CA密鑰和證書）

2012-09-08 Pma

...我已經尋找一種方式來做到這一點還可以，但我沒有找到任何示例，所以我最終看到的是keytool源代碼。（可以在這裏找到：http://www.docjar.com/html/api/sun/security/tools/KeyTool.java.html）

這裏來的簽署是如何工作的一個示例：

private static final String SIGNATURE_ALGORITHM = "SHA1WITHRSA"; 
private static final long VALIDITY_DAYS = 14L; 


public static byte[] sign(PKCS10 csr, X509CertImpl signerCert, PrivateKey signerPrivKey) throws CertificateException, IOException, InvalidKeyException, SignatureException { 

    /* 
    * The code below is partly taken from the KeyTool class in OpenJDK7. 
    */ 

    X509CertInfo signerCertInfo = (X509CertInfo) signerCert.get(X509CertImpl.NAME + "." + X509CertImpl.INFO); 
    X500Name issuer = (X500Name) signerCertInfo.get(X509CertInfo.SUBJECT + "." + CertificateSubjectName.DN_NAME); 

    /* 
    * Set the certificate's validity: 
    * From now and for VALIDITY_DAYS days 
    */ 
    Date firstDate = new Date(); 
    Date lastDate = new Date(); 
    lastDate.setTime(firstDate.getTime() + VALIDITY_DAYS * 1000L * 24L * 60L * 60L); 
    CertificateValidity interval = new CertificateValidity(firstDate, lastDate); 

    /* 
    * Initialize the signature object 
    */ 
    Signature signature; 
    try { 
     signature = Signature.getInstance(SIGNATURE_ALGORITHM); 
    } catch (NoSuchAlgorithmException e) { 
     throw new RuntimeException(e); 
    } 
    signature.initSign(signerPrivKey); 

    /* 
    * Add the certificate information to a container object 
    */ 
    X509CertInfo certInfo = new X509CertInfo(); 
    certInfo.set(X509CertInfo.VALIDITY, interval); 
    certInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(new Random().nextInt() & 0x7fffffff)); 
    certInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3)); 
    try { 
     certInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(AlgorithmId.get(SIGNATURE_ALGORITHM))); 
    } catch (NoSuchAlgorithmException e) { 
     throw new RuntimeException(e); 
    } 
    certInfo.set(X509CertInfo.ISSUER, new CertificateIssuerName(issuer)); 
    certInfo.set(X509CertInfo.KEY, new CertificateX509Key(csr.getSubjectPublicKeyInfo())); 
    certInfo.set(X509CertInfo.SUBJECT, new CertificateSubjectName(csr.getSubjectName())); 

    /* 
    * Add x509v3 extensions to the container 
    */ 
    CertificateExtensions extensions = new CertificateExtensions(); 

    // Example extension. 
    // See KeyTool source for more. 
    boolean[] keyUsagePolicies = new boolean[9]; 
    keyUsagePolicies[0] = true; // Digital Signature 
    keyUsagePolicies[2] = true; // Key encipherment 
    KeyUsageExtension kue = new KeyUsageExtension(keyUsagePolicies); 
    byte[] keyUsageValue = new DerValue(DerValue.tag_OctetString, kue.getExtensionValue()).toByteArray(); 
    extensions.set(KeyUsageExtension.NAME, new Extension(
      kue.getExtensionId(), 
      true, // Critical 
      keyUsageValue)); 


    /* 
    * Create the certificate and sign it 
    */ 
    X509CertImpl cert = new X509CertImpl(certInfo); 
    try { 
     cert.sign(signerPrivKey, SIGNATURE_ALGORITHM); 
    } catch (NoSuchAlgorithmException e) { 
     throw new RuntimeException(e); 
    } catch (NoSuchProviderException e) { 
     throw new RuntimeException(e); 
    } 

    /* 
    * Return the signed certificate as PEM-encoded bytes 
    */ 
    ByteOutputStream bos = new ByteOutputStream(); 
    PrintStream out = new PrintStream(bos); 
    BASE64Encoder encoder = new BASE64Encoder(); 
    out.println(X509Factory.BEGIN_CERT); 
    encoder.encodeBuffer(cert.getEncoded(), out); 
    out.println(X509Factory.END_CERT); 
    out.flush(); 
    return bos.getBytes(); 
}

來源

2013-08-10 19:52:00 lockner

嗨，在本例中沒有CertificateExtensions擴展的使用 – SkateScout

在java中8，PKCS10類丟失。所以，強似PKCS10企業社會責任，通過公鑰密鑰& X500Name名
在行47/48更換csr.getSubjectPublicKeyInfo & csr.getSubjectName密鑰和名稱

來源

2015-05-05 15:56:33 tash

Java - 沒有BC的簽名證書programaticaly

回答

相關問題