一个好用的X.509证书生成工具

最新推荐文章于 2024-09-15 07:26:37 发布

iteye_3854

最新推荐文章于 2024-09-15 07:26:37 发布

阅读量2.4k

点赞数

分类专栏： Java Security 文章标签： java python php

Java 同时被 2 个专栏收录

57 篇文章 0 订阅

订阅专栏

Security

4 篇文章 0 订阅

订阅专栏

需要生成一个PKCS#12格式的证书，里面需要有证书和私钥，用于发送电子邮件时的签名和加密(S/MIME)，同时，需要证书支持KeyUsage extension，因为需要通过检查KeyUsage来判断这个证书只能用于签名或者只能用于加密或者都可以。

关于KeyUsage extension，介绍如下：

Key usage is a multi valued extension consisting of a list of names of the permitted key usages.

Java X509Certificate类也有获得KeyUsage的方法：

public abstract boolean[] getKeyUsage ()
Since: API Level 1

Returns the KeyUsage extension as a boolean array.

The ASN.1 definition of KeyUsage:

 KeyUsage ::= BIT STRING {
      digitalSignature        (0),
      nonRepudiation          (1),
      keyEncipherment         (2),
      dataEncipherment        (3),
      keyAgreement            (4),
      keyCertSign             (5),
      cRLSign                 (6),
      encipherOnly            (7),
      decipherOnly            (8) }

Returns

    the KeyUsage extension or null if there's none in the certificate.

openssl命令行是最强大的，但是那些参数让我头疼，特别是需要证书中含有KeyUsage。这里找到一个生成证书的GUI工具，刚好生成的证书里面也会包含KeyUsage：

TekCERT

http://www.yasinkaplan.com/tekcert.asp

Run TekCERT from Start / Program Files / TekCERT.
Click "Generate Certificate" button to create the certificate after filling necessary fields. You need to enter at least a valid "Name" for the certificate. Generated certificates are located in "Local Computer/Personal" store.
You can export public key in .cer (DER encoded X.509) format or with private key in .pfx format in after creating the certificate for client deployment. Click "Browse Certificates" tab, select the generated certificate and click "Export" button.