Question

生成证书时遇到问题。以下是相关代码。

@SuppressLint("SdCardPath")
public HttpsURLConnection setUpHttpsConnection(String urlString)
{
    try
    {
        CertificateFactory cf = CertificateFactory.getInstance("X.509","BC");

        AssetManager assManager = context.getAssets();
        InputStream caInput = assManager.open("testCert.pfx");

        KeyStore keyStore = KeyStore.getInstance("PKCS12");

        Certificate ca = cf.generateCertificate(caInput);

        System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());

        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca", ca);

        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
        tmf.init(keyStore);

        SSLContext context = SSLContext.getInstance("TLS");
        context.init(null, tmf.getTrustManagers(), null);

        URL url = new URL(urlString);
        HttpsURLConnection urlConnection = (HttpsURLConnection)url.openConnection();
        urlConnection.setSSLSocketFactory(context.getSocketFactory());

        return urlConnection;
    }
    catch (Exception ex)
    {
        Log.e("fff", "Failed to establish SSL connection to server: " + ex.toString());
        ex.printStackTrace();
        return null;
    }

}

程序在下一行给出错误。

CertificateFactory cf = CertificateFactory.getInstance("X.509","BC");

错误追踪;

com.android.org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory$ExCertificateException
rer: Use EGL_SWAP_BEHAVIOR_PRESERVED: true
 at com.android.org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory.engineGenerateCertificate(CertificateFactory.java:220)
 at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:196)
 at com.example.hilalinan.cert.ServiceCall.setUpHttpsConnection(ServiceCall.java:125)
 at com.example.hilalinan.cert.ServiceCall.doInBackground(ServiceCall.java:58)
 at android.os.AsyncTask$2.call(AsyncTask.java:295)
 at java.util.concurrent.FutureTask.run(FutureTask.java:237)
 at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:234)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
 at java.lang.Thread.run(Thread.java:818)
Caused by: java.lang.IllegalArgumentException: unknown object in getInstance: com.android.org.bouncycastle.asn1.ASN1Integer
 at com.android.org.bouncycastle.asn1.ASN1Sequence.getInstance(ASN1Sequence.java:98)
 at com.android.org.bouncycastle.asn1.x509.TBSCertificate.getInstance(TBSCertificate.java:64)
 at com.android.org.bouncycastle.asn1.x509.Certificate.<init>(Certificate.java:61)
 at com.android.org.bouncycastle.asn1.x509.Certificate.getInstance(Certificate.java:45)
 at com.android.org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory.readDERCertificate(CertificateFactory.java:68)
 at com.android.org.bouncycastle.jcajce.provider.asymmetric.x509.CertificateFactory.engineGenerateCertificate(CertificateFactory.java:215)
... 9 more

当我搜索此问题时，我在stackoverflow中找到了this question。我知道我的手机没有BC提供商的可信凭证。 OP 建议的问题我将BC提供商添加到我的手机。但即使我安装了，我如何为其他用户安装正在使用我的程序的用户。此外，当我用谷歌搜索它如何将BC添加到我的列表我找不到任何有用的东西。

有什么想法解决我的问题吗？

提前致谢。

Answer 1

pfx文件是PKCS＃12文件，可能包含多个证书和密钥（除非您更改了文件扩展名）。

您使用的代码需要一个简单的证书（.cer，.crt或.der）文件。

因此，您必须直接将其作为PKCS12密钥库加载，而不是尝试从中生成证书对象：

InputStream caInput = assManager.open("testCert.pfx");
String pfxPassword = "password"; // change it to the correct password
keyStore.load(caInput, pfxpassword.toCharArray());
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);

Android无法生成证书

1 个答案: