gpt4 book ai didi

Java - 在没有 BC 的情况下以编程方式签署证书

转载 作者:塔克拉玛干 更新时间:2023-11-02 19:32:21 24 4
gpt4 key购买 nike

我正在努力使用允许我在不使用 keytool 的情况下从 Java 代码生成和签署证书的代码。此外,由于依赖性问题和不兼容性,我无法使用 bouncycaSTLe 库。

到目前为止,我找到了使用给定参数生成 CSR 的工作代码,它似乎可以工作(至少 openssl 工具验证它确实是一个有效的 CSR)我找到的代码在这里:

http://www.journaldev.com/223/generating-a-certificate-signing-request-using-java-api

由于 jdk7 中缺少 X500Signer 类,它可以通过简单的修改工作。

我如何使用我自己的 CA 签署此 CSR(我在 openssl 生成的文本文件中有 CA key 和证书)

最佳答案

我也在寻找一种方法来执行此操作,但没有找到任何示例,所以我最终转而查看了 keytool 源代码。 (可以在这里找到:http://www.docjar.com/html/api/sun/security/tools/KeyTool.java.html)

这是一个如何完成签名的例子:

private static final String SIGNATURE_ALGORITHM = "SHA1WITHRSA";
private static final long VALIDITY_DAYS = 14L;


public static byte[] sign(PKCS10 csr, X509CertImpl signerCert, PrivateKey signerPrivKey) throws CertificateException, IOException, InvalidKeyException, SignatureException {

/*
* The code below is partly taken from the KeyTool class in OpenJDK7.
*/

X509CertInfo signerCertInfo = (X509CertInfo) signerCert.get(X509CertImpl.NAME + "." + X509CertImpl.INFO);
X500Name issuer = (X500Name) signerCertInfo.get(X509CertInfo.SUBJECT + "." + CertificateSubjectName.DN_NAME);

/*
* Set the certificate's validity:
* From now and for VALIDITY_DAYS days
*/
Date firstDate = new Date();
Date lastDate = new Date();
lastDate.setTime(firstDate.getTime() + VALIDITY_DAYS * 1000L * 24L * 60L * 60L);
CertificateValidity interval = new CertificateValidity(firstDate, lastDate);

/*
* Initialize the signature object
*/
Signature signature;
try {
signature = Signature.getInstance(SIGNATURE_ALGORITHM);
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e);
}
signature.initSign(signerPrivKey);

/*
* Add the certificate information to a container object
*/
X509CertInfo certInfo = new X509CertInfo();
certInfo.set(X509CertInfo.VALIDITY, interval);
certInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(new Random().nextInt() & 0x7fffffff));
certInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
try {
certInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(AlgorithmId.get(SIGNATURE_ALGORITHM)));
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e);
}
certInfo.set(X509CertInfo.ISSUER, new CertificateIssuerName(issuer));
certInfo.set(X509CertInfo.KEY, new CertificateX509Key(csr.getSubjectPublicKeyInfo()));
certInfo.set(X509CertInfo.SUBJECT, new CertificateSubjectName(csr.getSubjectName()));

/*
* Add x509v3 extensions to the container
*/
CertificateExtensions extensions = new CertificateExtensions();

// Example extension.
// See KeyTool source for more.
boolean[] keyUsagePolicies = new boolean[9];
keyUsagePolicies[0] = true; // Digital Signature
keyUsagePolicies[2] = true; // Key encipherment
KeyUsageExtension kue = new KeyUsageExtension(keyUsagePolicies);
byte[] keyUsageValue = new DerValue(DerValue.tag_OctetString, kue.getExtensionValue()).toByteArray();
extensions.set(KeyUsageExtension.NAME, new Extension(
kue.getExtensionId(),
true, // Critical
keyUsageValue));


/*
* Create the certificate and sign it
*/
X509CertImpl cert = new X509CertImpl(certInfo);
try {
cert.sign(signerPrivKey, SIGNATURE_ALGORITHM);
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e);
} catch (NoSuchProviderException e) {
throw new RuntimeException(e);
}

/*
* Return the signed certificate as PEM-encoded bytes
*/
ByteOutputStream bos = new ByteOutputStream();
PrintStream out = new PrintStream(bos);
BASE64Encoder encoder = new BASE64Encoder();
out.println(X509Factory.BEGIN_CERT);
encoder.encodeBuffer(cert.getEncoded(), out);
out.println(X509Factory.END_CERT);
out.flush();
return bos.getBytes();
}

关于Java - 在没有 BC 的情况下以编程方式签署证书,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/12334468/

24 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com