生成Java

Question

證書鏈的問題是如何產生的程序在Java中的證書鏈。換句話說，我想在java中執行此處介紹的操作：http://fusesource.com/docs/broker/5.3/security/i382664.html

Besically，我可以爲新客戶創建RSA密鑰：

private KeyPair genRSAKeyPair(){ 
    // Get RSA key factory: 
    KeyPairGenerator kpg = null; 
    try { 
     kpg = KeyPairGenerator.getInstance("RSA"); 
    } catch (NoSuchAlgorithmException e) { 
     log.error(e.getMessage()); 
     e.printStackTrace(); 
     return null; 
    } 
    // Generate RSA public/private key pair: 
    kpg.initialize(RSA_KEY_LEN); 
    KeyPair kp = kpg.genKeyPair(); 
    return kp; 

}

和我產生相應的證書：

private X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm) 
    throws GeneralSecurityException, IOException { 
    PrivateKey privkey = pair.getPrivate(); 
    X509CertInfo info = new X509CertInfo(); 
    Date from = new Date(); 
    Date to = new Date(from.getTime() + days * 86400000l); 
    CertificateValidity interval = new CertificateValidity(from, to); 
    BigInteger sn = new BigInteger(64, new SecureRandom()); 
    X500Name owner = new X500Name(dn); 

    info.set(X509CertInfo.VALIDITY, interval); 
    info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn)); 
    info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner)); 
    info.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner)); 
    info.set(X509CertInfo.KEY, new CertificateX509Key(pair.getPublic())); 
    info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3)); 
    AlgorithmId algo = new AlgorithmId(AlgorithmId.md5WithRSAEncryption_oid); 
    info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo)); 

    // Sign the cert to identify the algorithm that's used. 
    X509CertImpl cert = new X509CertImpl(info); 
    cert.sign(privkey, algorithm); 

    // Update the algorith, and resign. 
    algo = (AlgorithmId)cert.get(X509CertImpl.SIG_ALG); 
    info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo); 
    cert = new X509CertImpl(info); 
    cert.sign(privkey, algorithm); 
    return cert; 

}

於是我產生了證書籤名請求，我將它保存到csrFile文件：

public static void writeCertReq(File csrFile, String alias, String keyPass, KeyStore ks) 
     throws KeyStoreException, 
       NoSuchAlgorithmException, 
       InvalidKeyException, 
       IOException, 
       CertificateException, 
       SignatureException, 
       UnrecoverableKeyException { 

    Object objs[] = getPrivateKey(ks, alias, keyPass.toCharArray()); 
    PrivateKey privKey = (PrivateKey) objs[0]; 

    PKCS10 request = null; 

    Certificate cert = ks.getCertificate(alias); 
    request = new PKCS10(cert.getPublicKey()); 
    String sigAlgName = "MD5WithRSA"; 
    Signature signature = Signature.getInstance(sigAlgName); 
    signature.initSign(privKey); 
    X500Name subject = new X500Name(((X509Certificate) cert).getSubjectDN().toString()); 
    X500Signer signer = new X500Signer(signature, subject); 
    request.encodeAndSign(signer); 
    request.print(System.out); 
    FileOutputStream fos = new FileOutputStream(csrFile); 
    PrintStream ps = new PrintStream(fos); 
    request.print(ps); 
    fos.close(); 
} 

其中

private static Object[] getPrivateKey(KeyStore ks, String alias, char keyPass[]) 
     throws UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException { 
    key = null;   
    key = ks.getKey(alias, keyPass); 
    return (new Object[]{ (PrivateKey) key, keyPass }); 
} 

現在我要簽名CSR與CA私有密鑰，但我看不出如何才達到在java中。我在我的jks中擁有「我自己的」CA私鑰。

此外，一旦我設法簽署CSR，我應該將CA證書與簽名的CSR鏈接起來：如何在java中完成這項工作？

我寧願不使用BC或其他外部庫，只是「sun.security」類。

謝謝。

Answer 1

對不起，儘管你的願望，除了寫你所有的加密代碼，幷包括它與您的項目（不推薦），我建議在這裏使用Bouncy城​​堡。

具體請參考https://stackoverflow.com/a/7366757/751158 - 包括代碼正是你希望做什麼。

Answer 2

我看你已經走了過來房子的BouncyCastle的一面，但爲了以防萬一別人不知道;將密鑰放入KeyStore時，可以將證書鏈添加到條目中。例如

// build your certs 

KeyStore keyStore = KeyStore.getInstance("PKCS12"); 
keyStore.load([keystore stream], password.toCharArray());// or null, null if it's a brand new store 
X509Certificate[] chain = new X509Certificate[2]; 
chain[0] = _clientCert; 
chain[1] = _caCert; 
keyStore.setKeyEntry("Alias", _clientCertKey, password.toCharArray(), chain); 
keyStore.store([output stream], password.toCharArray()); 

// do other stuff 

Answer 3

我相信在後http://www.pixelstech.net/article/1406726666-Generate-certificate-in-Java----2的代碼示例將告訴你如何生成純Java證書鏈。它不需要你使用Bouncy Castle。