java - X509 扩展

Question

如何使用 bouncycaSTLe API 在 java 中设置 x509 证书的扩展？

我设法做到了这样的“基本约束”:

...
X509V3CertificateGenerator gen = new X509V3CertificateGenerator();
...
boolean crit;
boolean isCa;
gen.addExtension(X509Extensions.BasicConstraints, crit, new BasicConstraints(isCa));

但是，我不知道如何对 IssuerAlternativeName 或 KeyUsage 执行相同操作。

Answer 1

试试这个

 KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign
        | KeyUsage.digitalSignature | KeyUsage.keyEncipherment
        | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
 gen.addExtension(Extension.keyUsage, false, usage);


 GeneralNames issuerAltName = new GeneralNames(new GeneralName(new X509Name("CN=somedomain.tld")));
    gen.addExtension(X509Extensions.IssuerAlternativeName, false, issuerAltName);