Java:从 PrivateKey 对象生成证书(X509Certificate 对象)

Question

我有一个从私有(private) RSA key 字符串加载 PrivateKey 对象的类:

    X509EncodedKeySpec spec = new X509EncodedKeySpec(privKeyString.getBytes());
    KeyFactory kf = KeyFactory.getInstance("RSA");
    PrivateKey privateKey = kf.generatePrivate(spec);

我认为上面的方法可以获取 PrivateKey 对象。但是，一旦我有了私钥，我还想从中生成一个 X509Certificate 对象。这是我的尝试之一，但是方法 generateCertificate 需要一个输入流(我相信包含来自文件的证书)，所以这是行不通的:

    CertificateFactory f = CertificateFactory.getInstance("X.509");
    X509Certificate cert = f.generateCertificate(privateKey);  // this doesn't work.

有没有一种方法可以仅从 PrivateKey 对象或从我最初拥有的私钥字符串(privKeyString 变量)创建证书(理想情况下不会过期)？

谢谢，

Answer 1

典型的事件流程如下所示:您生成一个 key 对，这意味着一个私钥和一个匹配的公钥。私钥是你的，你永远不会分享它；这就是为什么它被称为私有(private)的。公钥是你给别人的。用于发布公钥的一种常见格式是 X.509 证书。该证书包含公钥和一些识别信息。该证书可以是自签名的，也可以由其他机构签名。

遗憾的是，标准 Oracle Java 库不包含任何类来帮助您从公钥生成 X.509 证书。您可以使用 Oracle JDK 附带的命令行工具 keytool来完成这个。如果您必须以编程方式执行此操作，那么 Bouncycastle Java libraries包含一些类来完成这个。例如，JcaX509v3CertificateBuilder可能是完成此任务的最简单方法，连同 JcaContentSignerBuilder类。

这是一个使用 Java 7 和 BouncycaSTLe 版本 1.50 提供程序和 PKIX 库的示例。

import java.io.FileOutputStream;
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.Calendar;
import java.util.Date;

import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;

public class CertBuilder {
    public static void main(String[] args) throws Exception {

        // Generate a keypair

        KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
        kpg.initialize(1024);
        KeyPair kp = kpg.generateKeyPair();

        // Start creating a self-signed X.509 certificate with the public key

        X500Name subjName = new X500Name("C=US, ST=NY, O=Certs_R_Us, CN=notreal@example.com");
        BigInteger serialNumber = new BigInteger("900");
        Calendar cal = Calendar.getInstance();
        cal.set(2014, 6, 7, 11, 59, 59);
        Date notBefore = cal.getTime();
        cal.add(Calendar.YEAR, 10); // Expires in 10 years
        Date notAfter = cal.getTime();
        JcaX509v3CertificateBuilder x509Builder = new JcaX509v3CertificateBuilder(subjName, serialNumber, 
                notBefore, notAfter, subjName, kp.getPublic());

        // Create a signer to sign (self-sign) the certificate.

        JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder("SHA256WITHRSA");
        ContentSigner signer = signerBuilder.build(kp.getPrivate());

        // Now finish the creation of the self-signed certificate.

        JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
        X509Certificate mySelfSignedCert = converter.getCertificate(x509Builder.build(signer));

        // Now create a KeyStore and store the private key and associated cert.

        final char[] password = "password99".toCharArray();
        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(null, password);

        KeyStore.PrivateKeyEntry privKeyEntry = new KeyStore.PrivateKeyEntry(kp.getPrivate(), 
                new Certificate[] {mySelfSignedCert});
        ks.setEntry("myRSAkey", privKeyEntry, new KeyStore.PasswordProtection(password));

        // Now save off the KeyStore to a file.

        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream("MyKeys.jks");
            ks.store(fos, password);
        } finally {
            if (fos != null) {
                fos.close();
            }
        }
    }
}