通过SCEP在java中生成CSR请求

Question

我正在尝试从 Android 设备向服务器发送证书签名请求。服务器在iOS设备上正常运行，并使用 OpenSSL 跟随SCEP procedure。

所以这是我的问题： 我可以发送已签名的封装CSR，但服务器无法读取封装的CSR。我从服务器得到以下错误：

pki.rb:26:in initialize: Could not parse the PKCS7: header too long (ArgumentError)

相关的ruby服务器代码：

#receive object and put it in object data
[...]

# Verify Input Data
p7sign = OpenSSL::PKCS7.new(data)
store = OpenSSL::X509::Store.new
p7sign.verify(nil, store, nil, OpenSSL::PKCS7::NOVERIFY)
signers = p7sign.signers

# Encrypted data (LINE 26 :)
p7enc = OpenSSL::PKCS7.new(p7sign.data)

# Certificate Signing Request
csr = p7enc.decrypt(ssl.key, ssl.certificate)

# Signed Certificate
request = OpenSSL::X509::Request.new(csr)

Java代码（Android）：

我正在使用Bouncy Castle来生成CSR和Volley（Google）来发送它。

主要：

//Generate PEM formated CSR
byte[] pemCsr = getPemFromCsr(generateCSR());
//Envelop it in a PKCS#7 object
byte[] envelopedData = getDerFromCMSEnvelopedData(envelopData(pemCsr));
//Sign it in a PKCS#7 object
byte[] signedData = getDerFromCMSSignedData(signData(envelopedData));

sendCsrRequest(signedData);

CSR：

//Generate the CSR
private static PKCS10CertificationRequest genrateCertificationRequest(){
    // Build the CN for the cert we 
    X500NameBuilder nameBld = new X500NameBuilder(BCStyle.INSTANCE);
    nameBld.addRDN(BCStyle.CN, "cn");   
    nameBld.addRDN(BCStyle.O, "o"); 
    nameBld.addRDN(BCStyle.NAME, "name");   
    X500Name principal = nameBld.build();

    // Generate the certificate signing request (csr = PKCS10)
    String sigAlg = "SHA1withRSA";
    JcaContentSignerBuilder csb = new JcaContentSignerBuilder(sigAlg);
    ContentSigner cs = csb.build(privateKey);

    DERPrintableString password = new DERPrintableString("mychallenge");
    PKCS10CertificationRequestBuilder crb = new JcaPKCS10CertificationRequestBuilder(principal, publicKey);
    crb.addAttribute((ASN1ObjectIdentifier) PKCSObjectIdentifiers.pkcs_9_at_challengePassword, password);
    PKCS10CertificationRequest csr = crb.build(cs);

    return csr;
}
//Envelop the CSR
private static CMSEnvelopedData envelopData(byte[] pemCsr) {
    CMSTypedData msg     = new CMSProcessableByteArray(pemCsr);
    CMSEnvelopedDataGenerator edGen = new CMSEnvelopedDataGenerator();
    edGen.addRecipientInfoGenerator(new JceKeyTransRecipientInfoGenerator(x509Certificate).setProvider("BC"));
    CMSEnvelopedData ed = edGen.generate(msg,new JceCMSContentEncryptorBuilder(CMSAlgorithm.DES_EDE3_CBC).setProvider("BC").build());
    return ed;
}
//Sign the enveloped CSR
private static CMSSignedData signData(byte[] data){
    ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(privateKey);
    CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
    generator.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()).build(signer, (X509Certificate) x509Certificate));
    CMSTypedData cmsdata = new CMSProcessableByteArray(data);
    CMSSignedData signedData = generator.generate(cmsdata, true);
    return signedData;
}

我还准备好粘贴其他代码（Volley请求，utils转换器），但目前可能还不够。

SCEP已经在使用iOS设备，因此服务器很干净。 Ruby可以创建签名的PKCS＃7，所以我猜我的签名步骤没问题。 但是，如果我发送一个空的签名PKCS＃7，我出乎意料地有同样的错误。

提前感谢您的帮助。

Answer 1

似乎信封的ASN1对于OpenSSL来说并不正确。

与此同时，Google Volley会自动添加＆＃34; \ n＆＃34;在回应中也引起了问题。