Question

问题是如何在Java中以编程方式生成证书链。换句话说，我想在java中执行此处详述的操作：http://fusesource.com/docs/broker/5.3/security/i382664.html

通常，我可以为新客户创建RSA密钥：

private KeyPair genRSAKeyPair(){
    // Get RSA key factory:
    KeyPairGenerator kpg = null;
    try {
        kpg = KeyPairGenerator.getInstance("RSA");
    } catch (NoSuchAlgorithmException e) {
        log.error(e.getMessage());
        e.printStackTrace();
        return null;
    }
    // Generate RSA public/private key pair:
    kpg.initialize(RSA_KEY_LEN);
    KeyPair kp = kpg.genKeyPair();
    return kp;

}

我生成相应的证书：

private X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm)
  throws GeneralSecurityException, IOException  {
    PrivateKey privkey = pair.getPrivate();
    X509CertInfo info = new X509CertInfo();
    Date from = new Date();
    Date to = new Date(from.getTime() + days * 86400000l);
    CertificateValidity interval = new CertificateValidity(from, to);
    BigInteger sn = new BigInteger(64, new SecureRandom());
    X500Name owner = new X500Name(dn);

    info.set(X509CertInfo.VALIDITY, interval);
    info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn));
    info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner));
    info.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner));
    info.set(X509CertInfo.KEY, new CertificateX509Key(pair.getPublic()));
    info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
    AlgorithmId algo = new AlgorithmId(AlgorithmId.md5WithRSAEncryption_oid);
    info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo));

    // Sign the cert to identify the algorithm that's used.
    X509CertImpl cert = new X509CertImpl(info);
    cert.sign(privkey, algorithm);

    // Update the algorith, and resign.
    algo = (AlgorithmId)cert.get(X509CertImpl.SIG_ALG);
    info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo);
    cert = new X509CertImpl(info);
    cert.sign(privkey, algorithm);
    return cert;

}

然后我生成证书签名请求，并将其保存到csrFile文件：

public static void writeCertReq(File csrFile, String alias, String keyPass, KeyStore ks) 
        throws KeyStoreException, 
               NoSuchAlgorithmException, 
               InvalidKeyException, 
               IOException, 
               CertificateException, 
               SignatureException, 
               UnrecoverableKeyException {

    Object objs[] = getPrivateKey(ks, alias, keyPass.toCharArray());
    PrivateKey privKey = (PrivateKey) objs[0];

    PKCS10 request = null;

    Certificate cert = ks.getCertificate(alias);
    request = new PKCS10(cert.getPublicKey());
    String sigAlgName = "MD5WithRSA";
    Signature signature = Signature.getInstance(sigAlgName);
    signature.initSign(privKey);
    X500Name subject = new X500Name(((X509Certificate) cert).getSubjectDN().toString());
    X500Signer signer = new X500Signer(signature, subject);
    request.encodeAndSign(signer);
    request.print(System.out);
    FileOutputStream fos = new FileOutputStream(csrFile);
    PrintStream ps = new PrintStream(fos);
    request.print(ps);
    fos.close();
}

，其中

private static Object[] getPrivateKey(KeyStore ks, String alias, char keyPass[]) 
        throws UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException {
    key = null;        
    key = ks.getKey(alias, keyPass);
    return (new Object[]{ (PrivateKey) key, keyPass });
}

现在我应该使用CA私钥对CSR进行签名，但我无法看到如何在java中实现这一点。我的jks中有“我自己的”CA私钥。

此外，一旦我设法签署CSR，我应该使用签名的CSR链接CA证书：如何在Java中完成？

我不想使用bc或其他外部库，只是“sun.security”类。

谢谢。

Answer 1

我相信帖子http://www.pixelstech.net/article/1406726666-Generate-certificate-in-Java----2中的代码示例将向您展示如何使用纯Java生成证书链。它不要求你使用Bouncy Castle。

Answer 2

很抱歉，不管你有什么愿望，除了编写你的所有加密代码并将其包含在你的项目中之外（不推荐），我建议你在这里使用Bouncy Castle。

具体来说，请参阅https://stackoverflow.com/a/7366757/751158 - 其中包含您正在寻找的确切代码。

Answer 3

我看到你已经走到了房子的BouncyCastle一侧，但以防万一其他人在想;将密钥放入KeyStore时，可以将证书链添加到条目中。例如

// build your certs 

KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load([keystore stream], password.toCharArray());// or null, null if it's a brand new store
X509Certificate[] chain = new X509Certificate[2];
chain[0] = _clientCert;
chain[1] = _caCert;
keyStore.setKeyEntry("Alias", _clientCertKey, password.toCharArray(), chain);
keyStore.store([output stream], password.toCharArray());

// do other stuff

在java中生成证书链

3 个答案: