基本上,我需要在构成请求的实体首先签署之前隔离构造的CSR(证书签名请求)的数据,最好是用Java。非常感谢提前!
如果随后将签名附加到CSR,因为CSR数据最初将由HSM签名,这也是有用的。
答案 0 :(得分:7)
我希望这会有所帮助:
import java.io.ByteArrayOutputStream;
import java.io.PrintStream;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.Signature;
import javax.security.auth.x500.X500Principal;
import sun.security.pkcs10.*;
import sun.security.x509.*;
public class GenerateCSR {
private static PublicKey publicKey = null;
private static PrivateKey privateKey = null;
private static KeyPairGenerator keyGen = null;
private static GenerateCSR gcsr = null;
private GenerateCSR() {
try {
keyGen = KeyPairGenerator.getInstance("RSA");
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
}
keyGen.initialize(2048, new SecureRandom());
KeyPair keypair = keyGen.generateKeyPair();
publicKey = keypair.getPublic();
privateKey = keypair.getPrivate();
}
public static GenerateCSR getInstance() {
if (gcsr == null)
gcsr = new GenerateCSR();
return gcsr;
}
public String getCSR(String cn) throws Exception {
byte[] csr = generatePKCS10(cn, "Java", "JournalDev", "Cupertino",
"California", "USA");
return new String(csr);
}
/**
*
* @param CN
* Common Name, is X.509 speak for the name that distinguishes
* the Certificate best, and ties it to your Organization
* @param OU
* Organizational unit
* @param O
* Organization NAME
* @param L
* Location
* @param S
* State
* @param C
* Country
* @return
* @throws Exception
*/
private static byte[] generatePKCS10(String CN, String OU, String O,
String L, String S, String C) throws Exception {
// generate PKCS10 certificate request
String sigAlg = "MD5WithRSA";
PKCS10 pkcs10 = new PKCS10(publicKey);
Signature signature = Signature.getInstance(sigAlg);
signature.initSign(privateKey);
// common, orgUnit, org, locality, state, country
X500Principal principal = new X500Principal( "CN=Ole Nordmann, OU=ACME, O=Sales, C=NO");
// pkcs10CertificationRequest kpGen = new PKCS10CertificationRequest(sigAlg, principal, publicKey, null, privateKey);
// byte[] c = kpGen.getEncoded();
X500Name x500name=null;
x500name= new X500Name(principal.getEncoded());
pkcs10.encodeAndSign(x500name, signature);
ByteArrayOutputStream bs = new ByteArrayOutputStream();
PrintStream ps = new PrintStream(bs);
pkcs10.print(ps);
byte[] c = bs.toByteArray();
try {
if (ps != null)
ps.close();
if (bs != null)
bs.close();
} catch (Throwable th) {
}
return c;
}
public PublicKey getPublicKey() {
return publicKey;
}
public PrivateKey getPrivateKey() {
return privateKey;
}
public static void main(String[] args) throws Exception {
GenerateCSR gcsr = GenerateCSR.getInstance();
System.out.println("Public Key:\n"+gcsr.getPublicKey().toString());
System.out.println("Private Key:\n"+gcsr.getPrivateKey().toString());
String csr = gcsr.getCSR("journaldev.com <http://www.journaldev.com>");
System.out.println("CSR Request Generated!!");
System.out.println(csr);
}
}
答案 1 :(得分:1)
我使用Bouncy Castle库来生成证书请求而无需签名。我面临的问题是,许多可用于生成CSR的应用程序都负责生成它并对其进行签名。我只想制作一个未签名的CSR。不幸的是,由于公司政策,我无法透露用于生成未签名CSR的代码,但我列出了许多应该帮助其他人的提示。以下是一些可能会帮助其他人尝试做同样事情的步骤:
使用以下网站查看使用openssl或其他工具生成的示例CSR数据。
此网站甚至包含一个示例证书对象,以便查看它的实际效果。
熟悉ASN1编码。这就是证书数据的编码方式,您需要使用Bouncy Castle对CSR进行编码。
使用Bouncy Castle生成CSR数据。以下是初始化CSR数据中常见字段的代码段。
// Create Organization Name<br/>
DERObjectIdentifier oidOrgName = new DERObjectIdentifier("2.5.4.10");
DERPrintableString prntstrOrgName = new DERPrintableString("Test Organization");
DERSet setOrgName = new DERSet(new DERSequence(new ASN1Encodable[] {oidOrgName, prntstrOrgName}));
// Create org unit name
DERObjectIdentifier oidOrgUnitName = new DERObjectIdentifier(2.5.4.11);
DERPrintableString prntstrOrgUnitName = new DERPrintableString("Org Unit Name");
DERSet setOrgUnitName = new DERSet(new DERSequence(new ASN1Encodable[] {oidOrgUnitName, prntstrOrgUnitName}));