devbox
Li_阴宅
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

java后端工具类之从0到1生成数字证书（RSA）_java 生成rsa的证书

作者：Li_阴宅 | 2024-07-02 23:56:34

赞

踩

java 生成rsa的证书

开放签电子签章系统-开源版这周（2023-12-15）就要上线发布了，为了让开源版能够更好的服务广大研发工程师，接下来会详细的说说开源版从代码层面的具体实现，以便大家在工作过程中更好使用开放签电子签章系统。本文主要讲开放签开源电子签章系统Java后端代码中关于数字证书生成的Java代码。

一、需要引用的jar包：

bouncycastle

java.security

二、核心代码：

（1）生成数字证书主题信息

  1. import org.bouncycastle.asn1.x500.X500NameBuilder;
  2. import org.bouncycastle.asn1.x500.style.BCStyle;
  3.  
  4. import java.io.ByteArrayInputStream;
  5. import java.io.ByteArrayOutputStream;
  6. import java.security.Key;
  7. import java.security.KeyStore;
  8. import java.security.cert.Certificate;
  9. import java.util.Enumeration;
  10.  
  11. public class CertificateUtils {
  12.  
  13.     /**
  14.      * 生成证书主题信息
  15.      *
  16.      * @param C  Country Name (国家代号),eg: CN
  17.      * @param ST State or Province Name (洲或者省份),eg: Beijing
  18.      * @param L  Locality Name (城市名),eg: Beijing
  19.      * @param O  Organization Name (可以是公司名称),eg: xxxxxx网络技术有限公司
  20.      * @param OU Organizational Unit Name (可以是单位部门名称)
  21.      * @param CN Common Name (服务器ip或者域名或者公司名称),eg: 192.168.30.71 or www.baidu.com or xxxxxx网络技术有限公司
  22.      * @return X500Name Subject
  23.      */
  24.     public static String buildSubject(String C, String ST, String L,
  25.                                         String O, String OU, String CN) {
  26.         X500NameBuilder x500NameBuilder = new X500NameBuilder();
  27.         x500NameBuilder.addRDN(BCStyle.C, C);
  28.         x500NameBuilder.addRDN(BCStyle.ST, ST);
  29.         x500NameBuilder.addRDN(BCStyle.L, L);
  30.         if(O != null)
  31.             x500NameBuilder.addRDN(BCStyle.O, O);
  32.         if(OU != null)
  33.             x500NameBuilder.addRDN(BCStyle.OU, OU);
  34.         x500NameBuilder.addRDN(BCStyle.CN, CN);
  35.         System.out.println(x500NameBuilder.build().toASN1Primitive().toString());
  36.         return x500NameBuilder.build().toString();
  37.     }
  38.  
  39.     public static byte [] coverToPfx(byte [] jks, String password) {
  40.         try {
  41.  
  42.             KeyStore inputKeyStore = KeyStore.getInstance("JKS");
  43.             ByteArrayInputStream inputStream = new ByteArrayInputStream(jks);
  44.             inputKeyStore.load(inputStream, password.toCharArray());
  45.  
  46.             KeyStore outputKeyStore = KeyStore.getInstance("PKCS12");
  47.  
  48.             outputKeyStore.load(null, password.toCharArray());
  49.  
  50.             Enumeration enums = inputKeyStore.aliases();
  51.  
  52.             while (enums.hasMoreElements()) { //   we   are   readin   just   one   certificate.
  53.  
  54.                 String keyAlias = (String) enums.nextElement();
  55.  
  56.                 if (inputKeyStore.isKeyEntry(keyAlias)) {
  57.                     Key key = inputKeyStore.getKey(keyAlias, password.toCharArray());
  58.                     Certificate[] certChain = inputKeyStore
  59.                             .getCertificateChain(keyAlias);
  60.  
  61.                     outputKeyStore.setKeyEntry("", key, password
  62.                             .toCharArray(), certChain);
  63.                 }
  64.             }
  65.  
  66.             ByteArrayOutputStream out = new ByteArrayOutputStream();
  67.             outputKeyStore.store(out, password.toCharArray());
  68.             out.close();
  69.             return out.toByteArray();
  70.         } catch (Exception e) {
  71.             e.printStackTrace();
  72.         }
  73.         return null;
  74.     }
  75.  
  76.  
  77. }

（2）数字证书生成过程信息

  1. import lombok.AllArgsConstructor;
  2. import lombok.Data;
  3. import lombok.NoArgsConstructor;
  4.  
  5. import java.util.Date;
  6.  
  7.  
  8. @Data
  9. @AllArgsConstructor
  10. @NoArgsConstructor
  11. public class GenerateCertificateInfo {
  12.  
  13.     /**
  14.      * 证书密码
  15.      */
  16.     private String password;
  17.  
  18.     /**
  19.      * 证书类型  JKS  PFX
  20.      */
  21.     private String certFileType;
  22.  
  23.     /**
  24.      * 证书库
  25.      */
  26.     private byte [] jks;
  27.  
  28.  
  29.     /**
  30.      * 签名证书
  31.      */
  32.     private byte [] pfx;
  33.  
  34.     /**
  35.      * 证书序列号
  36.      */
  37.     private String serial;
  38.     /**
  39.      * 证书签名算法     SHA1withRSA  SHA256withRSA
  40.      */
  41.     private String algorithmSignature;
  42.  
  43.     /**
  44.      *  证书算法类型： RSA、SM2
  45.      */
  46.     private String algorithm;
  47.  
  48.     /**
  49.      * 证书有效期起始时间
  50.      */
  51.     private Date termOfValidityStartTime;
  52.  
  53.     /**
  54.      * 证书有效期结束时间
  55.      */
  56.     private Date termOfValidityEndTime;
  57.  
  58.  
  59.  
  60. }

（3）根证书类

  1. import java.security.KeyStore;
  2.  
  3. public class BaseCertificateInfo {
  4.  
  5.     /**
  6.      * 根证书
  7.      */
  8.     private KeyStore cert;
  9.  
  10.     /**
  11.      * 证书别名
  12.      */
  13.     private String alias;
  14.  
  15.     /**
  16.      * 证书密码
  17.      */
  18.     private String password;
  19.  
  20.     public KeyStore getCert() {
  21.         return cert;
  22.     }
  23.  
  24.     public void setCert(KeyStore cert) {
  25.         this.cert = cert;
  26.     }
  27.  
  28.     public String getAlias() {
  29.         return alias;
  30.     }
  31.  
  32.     public void setAlias(String alias) {
  33.         this.alias = alias;
  34.     }
  35.  
  36.     public String getPassword() {
  37.         return password;
  38.     }
  39.  
  40.     public void setPassword(String password) {
  41.         this.password = password;
  42.     }
  43. }

（4）数字证书类型枚举

  1. public enum CertificateType {
  2.     RSA,SM2
  3. }

（5）生成数字证书

  1. import org.bouncycastle.asn1.x500.X500Name;
  2. import org.bouncycastle.asn1.x509.Extension;
  3. import org.bouncycastle.cert.X509CertificateHolder;
  4. import org.bouncycastle.cert.X509v3CertificateBuilder;
  5. import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
  6. import org.bouncycastle.operator.ContentSigner;
  7. import org.bouncycastle.operator.OperatorCreationException;
  8. import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
  9.  
  10. import java.io.*;
  11. import java.math.BigInteger;
  12. import java.security.*;
  13. import java.security.cert.Certificate;
  14. import java.security.cert.CertificateException;
  15. import java.security.cert.CertificateFactory;
  16. import java.security.cert.X509Certificate;
  17. import java.util.ArrayList;
  18. import java.util.Date;
  19. import java.util.List;
  20. import java.util.UUID;
  21.  
  22. public class GenerateRootCertificate {
  23.  
  24.     //SHA256WITHRSA
  25.  
  26.  
  27.     private String subject;
  28.  
  29.     private String algorithmSignature = "SHA256withRSA";
  30.  
  31.     private CertificateType certificateType;
  32.  
  33.     private GenerateRootCertificate(String subject,CertificateType certificateType){
  34.         this.subject = subject;
  35.         this.certificateType = certificateType;
  36.     }
  37.  
  38.  
  39.     /**
  40.      * @param subject 证书主题
  41.      *                可通过 CertificateUtils.buildSubject进行生成
  42.      */
  43.     public static GenerateRootCertificate instance(String subject,CertificateType certificateType){
  44.         return new GenerateRootCertificate(subject,certificateType);
  45.     }
  46.  
  47.  
  48.     /**
  49.      * 设置证书签名算法  SHA1withRSA  SHA256withRSA
  50.      * @param algorithmSignature
  51.      */
  52.     public void setAlgorithmSignature(String algorithmSignature){
  53.         this.algorithmSignature = algorithmSignature;
  54.     }
  55.  
  56.  
  57.     /**
  58.      * 证书类型
  59.      * @param password
  60.      * @param lifespan 单位年
  61.      *
  62.      * @return
  63.      */
  64.     public GenerateCertificateInfo generateCertificate(BaseCertificateInfo root, String password, int lifespan) throws Exception {
  65.         X500Name issuer = new X500Name(subject);
  66.         KeyStore.PrivateKeyEntry rootPK = null;
  67.         PrivateKey signPrivateKey = null;
  68.         List<Certificate> chains = new ArrayList<>(5);
  69.         if(root != null){
  70.             rootPK = (KeyStore.PrivateKeyEntry) root.getCert().getEntry(root.getAlias(),
  71.                     new KeyStore.PasswordProtection(root.getPassword().toCharArray()));
  72.             X509Certificate rootCert = (X509Certificate) rootPK.getCertificate();
  73.  
  74.             issuer = X500Name.getInstance(rootCert.getSubjectX500Principal().getEncoded());
  75.  
  76.             signPrivateKey = rootPK.getPrivateKey();
  77.  
  78.             Certificate [] rootChains = rootPK.getCertificateChain();
  79.             for (int i=0;i<rootChains.length;i++){
  80.                 chains.add(rootChains[i]);
  81.             }
  82.         }
  83.  
  84.         KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
  85.         kpg.initialize(2048);
  86.         KeyPair keyPair = kpg.generateKeyPair();
  87.  
  88.         KeyStore keyStore = KeyStore.getInstance("JKS");
  89.         keyStore.load(null, null);
  90.  
  91.         Date startDate = new Date(System.currentTimeMillis());
  92.         Date expireDate = new Date(System.currentTimeMillis() + (86400000L * 365 * lifespan));
  93.  
  94.         String serial = UUID.randomUUID().toString().replaceAll("-","");
  95.         BigInteger serialBig = str2BigInteger(serial);
  96.  
  97.         if(signPrivateKey == null){
  98.             signPrivateKey = keyPair.getPrivate();
  99.         }
  100.         Certificate cert = generateV3(issuer, new X500Name(subject),serialBig, startDate,expireDate, keyPair.getPublic(),
  101.                 signPrivateKey
  102.                 , null);
  103.  
  104.         //用户证书要放在证书链的最前面
  105.         chains.add(0,cert);
  106.  
  107.         keyStore.setKeyEntry("root", keyPair.getPrivate(), password.toCharArray(), chains.toArray(new Certificate[chains.size()]));
  108.  
  109.         ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
  110.         keyStore.store(outputStream,password.toCharArray());
  111.  
  112.  
  113.         GenerateCertificateInfo certificateInfo = new GenerateCertificateInfo();
  114.         certificateInfo.setAlgorithm(certificateType.name());
  115.         certificateInfo.setAlgorithmSignature(algorithmSignature);
  116.         certificateInfo.setPassword(password);
  117.         certificateInfo.setCertFileType("jks");
  118.         certificateInfo.setSerial(serial);
  119.         certificateInfo.setJks(outputStream.toByteArray());
  120.         certificateInfo.setPfx(CertificateUtils.coverToPfx(certificateInfo.getJks(),certificateInfo.getPassword()));
  121.  
  122.         certificateInfo.setTermOfValidityStartTime(startDate);
  123.         certificateInfo.setTermOfValidityEndTime(expireDate);
  124.  
  125.         return certificateInfo;
  126.     }
  127.  
  128.     public Certificate generateV3(X500Name issuer, X500Name subject,
  129.                                          BigInteger serial, Date startDate, Date expireDate,
  130.                                          PublicKey publicKey, PrivateKey privKey, List<Extension> extensions) throws IOException, CertificateException, OperatorCreationException {
  131.  
  132.         X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
  133.                 issuer, serial, startDate, expireDate,
  134.                 subject, publicKey);
  135.         ContentSigner sigGen = new JcaContentSignerBuilder(algorithmSignature).build(privKey);
  136.         //privKey是CA的私钥，publicKey是待签名的公钥，那么生成的证书就是被CA签名的证书。
  137.         if (extensions != null){
  138.             for (Extension ext : extensions) {
  139.                 builder.addExtension(ext.getExtnId(), ext.isCritical(),ext.getExtnValue());
  140.             }
  141.         }
  142.         X509CertificateHolder holder = builder.build(sigGen);
  143.         CertificateFactory cf = CertificateFactory.getInstance("X.509");
  144.         InputStream is1 = new ByteArrayInputStream(holder.toASN1Structure()
  145.                 .getEncoded());
  146.         X509Certificate theCert = (X509Certificate) cf.generateCertificate(is1);
  147.         is1.close();
  148.         return theCert;
  149.     }
  150.  
  151.  
  152.     public static void main(String[] args) throws Exception {
  153. //
  154.         KeyStore store = loadJKS("Ting111");
  155.         BaseCertificateInfo baseCertificateInfo = new BaseCertificateInfo();
  156.         baseCertificateInfo.setAlias("root");
  157.         baseCertificateInfo.setCert(store);
  158.         baseCertificateInfo.setPassword("123456");
  159.         String x500Name = "CN=Ting222,OU=研发部,O=资源律动,L=BeiJing,ST=BeiJing,C=CN";
  160.  
  161.         GenerateCertificateInfo certificateInfo = GenerateRootCertificate.instance(x500Name,CertificateType.RSA).generateCertificate(baseCertificateInfo,"123456",10);
  162.         FileUtils.writeByteArrayToFile(new File("C:\\Users\\Administrator\\Desktop\\tem\\cert\\Ting222.jks"), certificateInfo.getJks());
  163.  
  164.     }
  165.  
  166.     private static BigInteger str2BigInteger(String str){
  167.         StringBuffer sb = new StringBuffer();
  168.         //将字符串转换为字符数组
  169.         char ch[] = str.toCharArray();
  170.         for(int i = 0; i < ch.length; i++) {
  171.             String hexString = Integer.toHexString(ch[i]);
  172.             sb.append(hexString);
  173.         }
  174.         return new BigInteger(sb.toString());
  175.     }
  176.  
  177.     private static String big2String(String str){
  178.         String result = new String();
  179.         char[] charArray = str.toString().toCharArray();
  180.         for(int i = 0; i < charArray.length; i=i+2) {
  181.             String st = ""+charArray[i]+""+charArray[i+1];
  182.             char ch1 = (char)Integer.parseInt(st, 16);
  183.             result = result + ch1;
  184.         }
  185.         return result;
  186.     }
  187.  
  188.  
  189.  
  190.     public static KeyStore loadJKS(String name) throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException {
  191.         KeyStore store = KeyStore.getInstance("JKS");
  192.         File file = new File(""+name+".jks");
  193.         store.load(new FileInputStream(file), "123456".toCharArray());
  194.         return store;
  195.     }
  196.  
  197. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Li_阴宅/article/detail/781343
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号