JAVA API 创建 keystore 并向其附加 csr 和 key 对

Question

我需要将现有的 csr 和 key 对附加到 keystore 。下面给出的是一个使用 GUI(java swing) 获取用户输入的实现，例如 keystore 名称、别名、通用名称、组织等。

我尝试使用 keystore.setkeyentry(...) 将 csr 链接到 keystore ，但是 keystore 仍然是空的。

我在下面附上了我的代码，任何帮助都会非常有用:

下面的代码用于创建 csr

            public String getCSR(String cn, String ou, String o, String l,String s) throws Exception {
            byte[] csr = generatePKCS10(cn, ou, o, l,s,"US");

            return new String(csr);
        }


private static byte[] generatePKCS10(String CN, String OU, String O,
                String L, String S, String C) throws Exception {
            // generate PKCS10 certificate request
            String sigAlg = "MD5WithRSA";
            PKCS10 pkcs10 = new PKCS10(publicKey);
            Signature signature = Signature.getInstance(sigAlg);
            signature.initSign(privateKey);
            // common, orgUnit, org, locality, state, country
            X500Principal principal = new X500Principal( "CN=Ole Nordmann, OU=ACME, O=Sales, C=NO");

       //     pkcs10CertificationRequest kpGen = new PKCS10CertificationRequest(sigAlg, principal, publicKey, null, privateKey);  
         //   byte[] c = kpGen.getEncoded();  
            X500Name x500name=null;
            x500name= new X500Name(principal.getEncoded());
          pkcs10.encodeAndSign(x500name, signature);
            ByteArrayOutputStream bs = new ByteArrayOutputStream();
            PrintStream ps = new PrintStream(bs);
            pkcs10.print(ps);
            byte[] c = bs.toByteArray();
            try {
                if (ps != null)
                    ps.close();
                if (bs != null)
                    bs.close();
            } catch (Throwable th) {
            }
            return c;
        }


        public static X509Certificate generateX509Certificate(String certEntry) throws IOException {

            InputStream in = null;
            X509Certificate cert = null;
            try {
                byte[] certEntryBytes = certEntry.getBytes();
                in = new ByteArrayInputStream(certEntryBytes);
                CertificateFactory certFactory = CertificateFactory.getInstance("X.509");

                cert = (X509Certificate) certFactory.generateCertificate(in);
            } catch (CertificateException ex) {

            } finally {
                if (in != null) {
                        in.close();
                }
            }
            return cert;
        }

在主要方法中，我执行以下操作来创建 keystore 并将其附加到 csr

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());


                        char[] pass = password.toCharArray();
                        ks.load(null, pass);

                        ks.store(fos, pass);
                        fos.close();
                         GenerateCSR gcsr = GenerateCSR.getInstance();

                    System.out.println("Public Key:\n"+gcsr.getPublicKey().toString());

                    System.out.println("Private Key:\n"+gcsr.getPrivateKey().toString());

                    String csr = gcsr.getCSR(CN,OU,O,L,S);

                    System.out.println("CSR Request Generated!!");
                    System.out.println(csr);


                    X509Certificate[] certChain = new X509Certificate[1];
                 //   certChain[0]= gcsr.generateX509Certificate(csr);
                    X509Certificate myCert = (X509Certificate) CertificateFactory
                                                 .getInstance("X509")
                                                 .generateCertificate(
                                                    // string encoded with default charset
                                                    new ByteArrayInputStream(csr.getBytes())
                                                 ); 
                    certChain[0]= myCert;
                    ks.setKeyEntry("alias", (Key)gcsr.getPrivateKey(), pass, certChain);

当我检查 keystore 的内容时，它是空的。任何建议将不胜感激

谢谢!!!

Answer 1

你有两个主要错误:

• 证书签名请求又名CSR 又名 PKCS10 不是证书。 CertificateFactory.generateCertificate只会读取证书而不是 CSR，当您为其提供 CSR 时，它会抛出一个异常，您的代码会巧妙地抑制该异常，并且不会向任何人表明存在严重问题。您在早期版本中注释掉的代码更接近生成证书所需的代码。

• (如果您确实创建/拥有有效证书)KeyStore.set*仅设置内存中 KeyStore 对象中的条目。如果您希望在程序退出后将 keystore 内容保存在某个位置(例如文件中)，则必须 store完成“一组”之后。

这是您的代码，经过足够的修改，它可以按照您想要的方式工作。除了琐碎的格式和脚手架之外，我更改的位置都标记为 //--用于删除和 //**用于补充。即便如此，我也不推荐它，因为:

• 我继续使用不受支持的 sun.security类，即使您使用 BC 并且它支持 PKCS10 和相关位的类，而且仅当您想从 CA 请求证书时才需要 CSR；自己生成证书直接生成证书更容易

• (不太严重)在最近版本的 BC pkix 中已被分割到一个单独的 jar 和 X509V3CertificateGenerator现已弃用，取而代之的是 X509v3CertificateBuilder

<小时/>

//nopackage
import java.io.*;
import java.math.BigInteger;
import java.security.*;
import java.security.cert.*;
import java.util.*;
import javax.security.auth.x500.*;

import org.bouncycastle.jce.X509Principal;
import org.bouncycastle.x509.X509V3CertificateGenerator;

//--import sun.security.pkcs.PKCS10; -- Java7
import sun.security.pkcs10.PKCS10; //** Java8
import sun.security.x509.X500Name;

public class SO40350607GenerateCertIntoKeystoreFile8 {
    public static void main (String[] args) throws Exception {
        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
        //**dummy value for test
        KeyPairGenerator kpgen = KeyPairGenerator.getInstance("RSA"); 
        kpgen.initialize(1024); keyPair = kpgen.generateKeyPair();

        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        char[] pass = "password".toCharArray();
        ks.load(null, pass);
        //--ks.store(fos, pass);    useless here
        //--fos.close();

        String csr = new String(generatePKCS10("CommonName","OrgUnit","Org","Locality","State", "US"));
        System.out.println("CSR Request Generated!!");
        System.out.println(csr);

        //--X509Certificate myCert = (X509Certificate) CertificateFactory.getInstance("X509")
        //--    .generateCertificate(new ByteArrayInputStream(csr.getBytes()) ); // string encoded with default charset*/
        X509Certificate myCert = generateCertificate2 (csr); //**
        X509Certificate[] certChain = new X509Certificate[]{myCert};
        ks.setKeyEntry("alias", keyPair.getPrivate(), pass, certChain);
        FileOutputStream fos = new FileOutputStream ("newksfile");
        ks.store(fos,pass); fos.close(); //** NOW store to file
    }
    private static KeyPair keyPair;

    private static byte[] generatePKCS10(String CN, String OU, String O,
            String L, String S, String C) throws Exception {
        // generate PKCS10 certificate request
        String sigAlg = "SHA1WithRSA"; //** don't use "MD5WithRSA" even for CSR 
        PKCS10 pkcs10 = new PKCS10(keyPair.getPublic());
        Signature signature = Signature.getInstance(sigAlg);
        signature.initSign(keyPair.getPrivate());
        // common, orgUnit, org, locality, state, country
        //--X500Principal principal = new X500Principal( "CN=Ole Nordmann, OU=ACME, O=Sales, C=NO");
        //--X500Name x500name= new X500Name(principal.getEncoded());
        //** can do this directly (and better)
        X500Name x500name = new X500Name ("CN="+CN+",OU="+OU+",O="+O+",L="+L+",S="+S+",C="+C);
        pkcs10.encodeAndSign(x500name, signature);
        ByteArrayOutputStream bs = new ByteArrayOutputStream();
        PrintStream ps = new PrintStream(bs);
        pkcs10.print(ps);
        byte[] c = bs.toByteArray();
        ps.close(); //** bs,ps are never null, ps.close automatically closes underlying bs,
        //** and anyway BAOS doesn't need to be closed (although most streams do)
        return c;
    }

    //** (whole) routine to generate an actual (though selfsigned) certificate 
    public static X509Certificate generateCertificate2 (String csrpem) throws Exception {  
        String csrtrim = csrpem.replaceAll("-----[^\\n]*\\n","").replaceAll("\\r?\\n","");
        //--PKCS10 pkcs10 = new PKCS10 (Base64.decode (csrtrim.toCharArray())); --Java7
        PKCS10 pkcs10 = new PKCS10 (Base64.getDecoder().decode (csrtrim.getBytes())); //Java8
        // or use the one we had before encoding it -- or the input data directly?? 

        // X509V3CertificateGenerator is deprecated but stay with it for now
        X509V3CertificateGenerator cert = new X509V3CertificateGenerator();   
        cert.setSerialNumber(BigInteger.valueOf(1));   //or generate a random number  
        cert.setSubjectDN(pkcs10.getSubjectName().asX500Principal());  
        cert.setIssuerDN(pkcs10.getSubjectName().asX500Principal()); //same since it is self-signed  
        cert.setPublicKey(pkcs10.getSubjectPublicKeyInfo());  
        Date now = new Date(); cert.setNotBefore(now);  
        now.setYear(now.getYear()+1); cert.setNotAfter(now);  
        cert.setSignatureAlgorithm("SHA1WithRSA");   
        PrivateKey signingKey = keyPair.getPrivate();    
        return cert.generate(signingKey, "BC");  
    }

}