java - 存储 X509AttributeCertificateHolder 对象，尤其是 attrCert 本地并打开它

Question

可以选择将 X509Certificate 与 Bouncy CaSTLe API 中的 JcaPEMWriter 类一起存储在本地。存储 X509Certificate 后，我可以使用以下命令使用 openssl 打开它:

openssl x509 -in certificate.pem -text

我有以下代码:

X509AttributeCertificateHolder att = acBuilder.build(new JcaContentSignerBuilder("SHA1WithRSA").setProvider("BC").build(caprivkey));

现在我想将 attrCert(属性证书)存储在本地，它包含在 att 变量中。我怎样才能做到这一点？我怎样才能打开attrCert，可以使用openssl或任何其他工具打开它？

Answer 1

要将属性证书保存在 PEM 文件中，您也可以使用 JcaPEMWriter:

// save the Attribute Certificate to attcert.pem file
JcaPEMWriter writer = new JcaPEMWriter(new FileWriter("attcert.pem"));
writer.writeObject(att);
writer.close();

该文件将包含 base64 内容，如下所示:

-----BEGIN ATTRIBUTE CERTIFICATE-----
MIIBvzCCASgCAQEwZ6BlMGCkXjBcMQswCQYDVQQGEwJBVTEoMCYGA1UECgwfVGhl
IExlZ2lvbiBvZiB0aGUgQm91bmN5IENhc3RsZTEjMCEGA1UECwwaQm91bmN5IFBy
aW1hcnkgQ2VydGlmaWNhdGUCAQKgYjBgpF4wXDELMAkGA1UEBhMCQVUxKDAmBgNV
BAoMH1RoZSBMZWdpb24gb2YgdGhlIEJvdW5jeSBDYXN0bGUxIzAhBgNVBAsMGkJv
dW5jeSBQcmltYXJ5IENlcnRpZmljYXRlMA0GCSqGSIb3DQEBBQUAAgF7MCIYDzIw
MTcwNzA2MTE1MDExWhgPMjAxNzA3MDYxMTUxNTFaMCAwHgYDVQRIMRcwFaEThhFp
ZDovL0RBVTEyMzQ1Njc4OTANBgkqhkiG9w0BAQUFAAOBgQBy3epbynwILi/H0DkQ
UXDgIWXXN5oRQem9DJ2AhYl6JHeKOk3ML87axq+ukWYjZoo3eP2rIxuDU6jWRak1
+n92KLsc/zSFaAdxxYjXQbjTpqEafvEea4QPd4PfPHA9nd4QNKox4H1lNhDeyqtP
B4iU+bkA1bKDo4dnhXVtJaAlkg==
-----END ATTRIBUTE CERTIFICATE-----

不幸的是，openssl 中似乎没有特定命令来检查属性证书(检查 this discussion 和 this message with no replies - 有一个 extended version of openssl 似乎支持它，尽管我没有没有测试过)。

但是您可以使用 asn1parse 选项检查 ASN.1 结构:

openssl asn1parse -dump -i -in attcert.pem

输出将是 ASN.1 结构，如下所示:

    0:d=0  hl=4 l= 447 cons: SEQUENCE          
    4:d=1  hl=4 l= 296 cons:  SEQUENCE          
    8:d=2  hl=2 l=   1 prim:   INTEGER           :01
   11:d=2  hl=2 l= 103 cons:   SEQUENCE          
   13:d=3  hl=2 l= 101 cons:    cont [ 0 ]        
   15:d=4  hl=2 l=  96 cons:     SEQUENCE          
   17:d=5  hl=2 l=  94 cons:      cont [ 4 ]        
   19:d=6  hl=2 l=  92 cons:       SEQUENCE          
   21:d=7  hl=2 l=  11 cons:        SET               
   23:d=8  hl=2 l=   9 cons:         SEQUENCE          
   25:d=9  hl=2 l=   3 prim:          OBJECT            :countryName
   30:d=9  hl=2 l=   2 prim:          PRINTABLESTRING   :AU
   34:d=7  hl=2 l=  40 cons:        SET               
   36:d=8  hl=2 l=  38 cons:         SEQUENCE          
   38:d=9  hl=2 l=   3 prim:          OBJECT            :organizationName
   43:d=9  hl=2 l=  31 prim:          UTF8STRING        :The Legion of the Bouncy Castle
... and so on

或者您可以使用 Bouncy CaSTLe 读取文件:

import org.bouncycastle.cert.X509AttributeCertificateHolder;
import org.bouncycastle.util.encoders.Base64;

String pem = // read contents from PEM file
// Convert to AC object
byte[] data = Base64.decode(pem.getBytes());
X509AttributeCertificateHolder holder = new X509AttributeCertificateHolder(data);