java - 具有有效根证书 :unknown object in getInstance 的 BouncycaSTLe X509 证书链生成

Question

尝试使用 BouncyCaSTLe api 生成 X509。这是我的一段代码。

    try {
        Security.addProvider(new BouncyCastleProvider()); // adding provider to
        String pathtoSave = "D://sureshtest.cer";

        KeyPair keyPair = generateKeypair();
        PublicKey publicKey = keyPair.getPublic();
        PrivateKey privateKey = keyPair.getPrivate();
        X509Certificate trustCert = createCertificate(null,"CN=DigiCorp",
                "CN=Nextenders", publicKey, privateKey);
         // Create an input stream from the file containing the certificate.
        InputStream is =new FileInputStream(new File("D://validcertFormCa.pfx"));
        /*
         * CertificateFactory object is used for reading Certificates, CRL and
         * CertPaths. Create a factory object using the standard SPI pattern
         * used in JCA.
         */
        CertificateFactory factory =
                CertificateFactory.getInstance("X.509", "BC");

        /*
         * Generate a X509 Certificate initialized with the data read from the
         * input stream.
         */
        X509Certificate mastercert =
                (X509Certificate) factory.generateCertificate(is);
        java.security.cert.Certificate[] outChain = { trustCert,mastercert };
        trustCert.checkValidity();
        mastercert.checkValidity();
        KeyStore outStore = KeyStore.getInstance("PKCS12");
        outStore.load(null, null);
        outStore.setKeyEntry("my own certificate", privateKey,
                "admin123".toCharArray(), outChain);

        OutputStream outputStream = new FileOutputStream(pathtoSave);
        outStore.store(outputStream, "admin123".toCharArray());
        outputStream.flush();
        outputStream.close();
    } catch (Exception e) {
        e.printStackTrace();
    }

并遇到异常

    org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory$ExCertificateException
    at org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory.engineGenerateCertificate(Unknown Source)
    at java.security.cert.CertificateFactory.generateCertificate(Unknown Source)
    at com.nextenders.certificategeenrator.CertificateGenerator.testGenerateSignCertWithKeyStore(CertificateGenerator.java:119)
    at com.nextenders.facadeimplementation.facade.JUnitFacade.main(JUnitFacade.java:11)
Caused by: java.lang.IllegalArgumentException: unknown object in getInstance: org.bouncycastle.asn1.ASN1Integer
    at org.bouncycastle.asn1.ASN1Sequence.getInstance(Unknown Source)
    at org.bouncycastle.asn1.x509.TBSCertificate.getInstance(Unknown Source)
    at org.bouncycastle.asn1.x509.Certificate.<init>(Unknown Source)
    at org.bouncycastle.asn1.x509.Certificate.getInstance(Unknown Source)
    at org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory.readDERCertificate(Unknown Source)
    ... 4 more

Answer 1

mastercert 应该是什么？

根据 generateCertificate() 的文档，它期望“inStream 中提供的证书必须是 DER 编码的，并且可以二进制或可打印的 (Base64) 编码提供”。换言之，DER 或 PEM 编码的 X509 证书。

您通过 InputStream 提供的是 PFX 文件(PKCS#12 文件)，而不是 DER 或 PEM 编码证书。

我的建议是使用 openssl pkcs12 从 PKCS#12 文件中提取必要的证书，并将其放入单独的文件中，然后更改代码以加载该文件而不是 PFX 文件。