Java – 签署证书programaticaly没有BC

我正在努力使用允许我在不使用keytool的情况下从java代码生成和签名证书的代码。 另外由于依赖性问题和不兼容性，我无法使用bouncycastle库。

到目前为止，我发现使用给定参数生成CSR的工作代码，它似乎工作（至少openssl工具validation它确实是一个有效的CSR）我找到的代码在这里：

http://www.journaldev.com/223/generating-a-certificate-signing-request-using-java-api

由于X500Signer缺少X500Signer类，它可以进行简单的修改。

如何使用我自己的CA签署此CSR（我在openssl生成的文本文件中有CA密钥和证书）

我也在寻找一种方法来做到这一点，但我没有找到任何例子，所以我最终查找了keytool源代码。 （可在此处找到： http ： //www.docjar.com/html/api/sun/security/tools/KeyTool.java.html ）

以下是一个如何进行签名的示例： 

 private static final String SIGNATURE_ALGORITHM = "SHA1WITHRSA"; private static final long VALIDITY_DAYS = 14L; public static byte[] sign(PKCS10 csr, X509CertImpl signerCert, PrivateKey signerPrivKey) throws CertificateException, IOException, InvalidKeyException, SignatureException { /* * The code below is partly taken from the KeyTool class in OpenJDK7. */ X509CertInfo signerCertInfo = (X509CertInfo) signerCert.get(X509CertImpl.NAME + "." + X509CertImpl.INFO); X500Name issuer = (X500Name) signerCertInfo.get(X509CertInfo.SUBJECT + "." + CertificateSubjectName.DN_NAME); /* * Set the certificate's validity: * From now and for VALIDITY_DAYS days */ Date firstDate = new Date(); Date lastDate = new Date(); lastDate.setTime(firstDate.getTime() + VALIDITY_DAYS * 1000L * 24L * 60L * 60L); CertificateValidity interval = new CertificateValidity(firstDate, lastDate); /* * Initialize the signature object */ Signature signature; try { signature = Signature.getInstance(SIGNATURE_ALGORITHM); } catch (NoSuchAlgorithmException e) { throw new RuntimeException(e); } signature.initSign(signerPrivKey); /* * Add the certificate information to a container object */ X509CertInfo certInfo = new X509CertInfo(); certInfo.set(X509CertInfo.VALIDITY, interval); certInfo.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(new Random().nextInt() & 0x7fffffff)); certInfo.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3)); try { certInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(AlgorithmId.get(SIGNATURE_ALGORITHM))); } catch (NoSuchAlgorithmException e) { throw new RuntimeException(e); } certInfo.set(X509CertInfo.ISSUER, new CertificateIssuerName(issuer)); certInfo.set(X509CertInfo.KEY, new CertificateX509Key(csr.getSubjectPublicKeyInfo())); certInfo.set(X509CertInfo.SUBJECT, new CertificateSubjectName(csr.getSubjectName())); /* * Add x509v3 extensions to the container */ CertificateExtensions extensions = new CertificateExtensions(); // Example extension. // See KeyTool source for more. boolean[] keyUsagePolicies = new boolean[9]; keyUsagePolicies[0] = true; // Digital Signature keyUsagePolicies[2] = true; // Key encipherment KeyUsageExtension kue = new KeyUsageExtension(keyUsagePolicies); byte[] keyUsageValue = new DerValue(DerValue.tag_OctetString, kue.getExtensionValue()).toByteArray(); extensions.set(KeyUsageExtension.NAME, new Extension( kue.getExtensionId(), true, // Critical keyUsageValue)); /* * Create the certificate and sign it */ X509CertImpl cert = new X509CertImpl(certInfo); try { cert.sign(signerPrivKey, SIGNATURE_ALGORITHM); } catch (NoSuchAlgorithmException e) { throw new RuntimeException(e); } catch (NoSuchProviderException e) { throw new RuntimeException(e); } /* * Return the signed certificate as PEM-encoded bytes */ ByteOutputStream bos = new ByteOutputStream(); PrintStream out = new PrintStream(bos); BASE64Encoder encoder = new BASE64Encoder(); out.println(X509Factory.BEGIN_CERT); encoder.encodeBuffer(cert.getEncoded(), out); out.println(X509Factory.END_CERT); out.flush(); return bos.getBytes(); }

在java 8中，缺少PKCS10类。 所以，不是传递PKCS10 csr，而是传递PublicKey键和X500Name名称
使用键和名称替换第47/48行的csr.getSubjectPublicKeyInfo和csr.getSubjectName

Interesting Posts