Java基于BC生成X509v3证书，以及部分扩展Extension的使用

转载请注明出处

https://blog.csdn.net/liweiliang0108/article/details/95191931

直接正题

先来几张图片

使用的BC库

这是个链接bcprov-1.60              这还是个链接bcpkix-1.60

代码下载地址

这是代码下载地址

已集成的扩展信息

BasicConstraints、CRLDIstPoint、CertificatePolicies、PolicyMappings、KeyUsage、ExtendedKeyUsage、SubjectAlternativeName、AuthorityInfoAccess、AuthorityKeyIdentifier、SubjectKeyIdentifier、NameConstraints。

生成证书

1. // Builder
2. X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
3. new X500Name('CN=issuer'), // issuer
4. BigInteger.ONE, // serial number
5. notBefore, // notBefore
6. notAfter, // notAfter
7. new X500Name('CN=subject'), // subject
8. publicKey // public key
9. );
11. // 添加扩展信息 Extension
12. // 基本约束
13. builder.addExtension(ExtensionUtils.getBasicConstraintsExtension(true));
14. // CRL分布点
15. builder.addExtension(ExtensionUtils.getCRLDIstPointExtension(URINames));
16. // 证书策略
17. builder.addExtension(ExtensionUtils.getCertificatePoliciesExtension());
18. // 证书策略映射
19. builder.addExtension(ExtensionUtils.getPolicyMappingsExtension());
20. // 秘钥用法
21. builder.addExtension(ExtensionUtils.getKeyUsageExtension());
22. // 增强秘钥用法
23. builder.addExtension(ExtensionUtils.getExtendedKeyUsageExtension());
24. // 备选使用者名称
25. builder.addExtension(ExtensionUtils.getSubjectAlternativeNameExtension());
26. // 权限信息访问
27. builder.addExtension(ExtensionUtils.getAuthorityInfoAccessExtension('123'));
28. // 颁发者密钥标识
29. builder.addExtension(ExtensionUtils.getAuthorityKeyIdentifierExtension(keyPair2.getPublic()));
30. // 使用者密钥标识
31. builder.addExtension(ExtensionUtils.getSubjectKeyIdentifierExtension(keyPair.getPublic()));
32. // 使用名称约束
33. builder.addExtension(ExtensionUtils.getNameConstraintsExtension());
35. // 签名
36. ContentSigner contentSigner = new JcaContentSignerBuilder('SHA256withECDSA')
37. .setProvider('BC').build(privateKey);
38. X509CertificateHolder x509CertificateHolder = builder.build(contentSigner);
39. ByteArrayInputStream inputStream = new ByteArrayInputStream(x509CertificateHolder.toASN1Structure()
40. .getEncoded());
41. CertificateFactory cf = CertificateFactory.getInstance('X.509');
42. X509Certificate certificate = (X509Certificate) cf.generateCertificate(inputStream);
43. inputStream.close();

import引入

import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.X509v3CertificateBuilder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
import org.bouncycastle.crypto.params.ECPublicKeyParameters;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder;
import org.bouncycastle.operator.bc.BcECContentSignerBuilder;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import java.io.ByteArrayInputStream;
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.Security;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Date;
import java.util.Locale;

使用前记得添加

1. static {
2. Security.addProvider(new BouncyCastleProvider());
3. }

生成KeyPair

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance('EC', 'BC');
keyPairGenerator.initialize(256);
KeyPair keypair = keyPairGenerator.generateKeyPair();

String转换Key

1. private static PrivateKey getPrivateKey(String key) {
2. org.bouncycastle.jce.spec.ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec('secp256r1');
3. org.bouncycastle.jce.spec.ECPrivateKeySpec privateKeySpec = new org.bouncycastle.jce.spec.ECPrivateKeySpec(
4. new BigInteger(key, 16), ecSpec);
5. return new BCECPrivateKey('EC', privateKeySpec, BouncyCastleProvider.CONFIGURATION);
6. }
8. private static PublicKey getPublicKey(String key) {
9. String x = key.substring(0, 64);
10. String y = key.substring(64, 128);
11. org.bouncycastle.jce.spec.ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec('secp256r1');
12. org.bouncycastle.math.ec.ECPoint ecPoint = ecSpec.getCurve().createPoint(new BigInteger(x, 16),
13. new BigInteger(y, 16));
14. org.bouncycastle.jce.spec.ECPublicKeySpec publicKeySpec = new org.bouncycastle.jce.spec.ECPublicKeySpec(ecPoint,
15. ecSpec);
16. return new BCECPublicKey('EC', publicKeySpec, BouncyCastleProvider.CONFIGURATION);
17. }

其他的转换

public static ECPrivateKeyParameters convertECPriKeyParams(PrivateKey privateKey) throws InvalidKeyException {
    ECPrivateKeyParameters bcecPrivateKey = (ECPrivateKeyParameters) ECUtil.generatePrivateKeyParameter(privateKey);
    return bcecPrivateKey;
}
public static ECPublicKeyParameters convertECPubKeyParams(PublicKey publicKey) throws InvalidKeyException {
    //转换成ECPublicKeyParameters  ECPrivateKeyParameters
    ECPublicKeyParameters bcecPublicKey = (ECPublicKeyParameters) ECUtil.generatePublicKeyParameter(publicKey);
    return bcecPublicKey;
}
public static SubjectPublicKeyInfo createSubjectPublicKeyInfo(PublicKey publicKey) {
      SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());
    SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo.getInstance(ASN1Sequence.getInstance(publicKey.getEncoded()));
    return subjectPublicKeyInfo;
}
/**
 * Used SM2
 */
public static SubjectPublicKeyInfo createSubjectPublicKeyInfo(ECPublicKeyParameters bcecPublicKey) throws IOException {
    // SM2
      ASN1OctetString p = (ASN1OctetString)new X9ECPoint(bcecPublicKey.getQ()).toASN1Primitive();
      SubjectPublicKeyInfo subjectPublicKeyInfo = new SubjectPublicKeyInfo(
              new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, GMObjectIdentifiers.sm2p256v1), p.getOctets());
    SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(bcecPublicKey);
    return subjectPublicKeyInfo;
}

现在很想添加几个‘愤怒’的表情，还是传代码吧

代码里有读取证书文件和将证书写入文件的代码，还有添加扩展Extension的代码。