证书加密

数字证书加密：

概念就不阐述了，主要记录java和asp数字证书加密

1.生成数字证书

云盘分享了生成证书的keytools

http://yunpan.cn/cAeCAbEb59iZK  提取码 f93c

下载后按照证书生成命令生成pfx，和cer后缀的证书

2.证书介绍

pfx是私钥，是用户自己设置的，有密码，cer是公钥，秘钥是成对的，公钥加密私钥解密是为了加密。

而在网络传输的过程中，有时需要验证来源地址是否正确，通常会采用私钥加密公钥解密的加密方式来验证来源

java数字证书加密（sha1withRSA） 

我用的是sha1withRSA算法加密，之前还是过MD5和AES，就不一一列举了

首先介绍java中base64的两个方法

public String cadeBase64(String str){
		String signMsg64="";
		//将明文序列化
		 signMsg64=new BASE64Encoder().encode(str.getBytes());
		return signMsg64;
}

public String cadeString(String str){
		String mingwen="";
		try {
			mingwen=new String(new BASE64Decoder().decodeBuffer(str));
		} catch (IOException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
		return mingwen;
	} 

证书加密方法

需要注意的是很多人生成证书的时候没有设置别名或者是忘记了别名是什么，也就是代码中的aliases，那么我们需要判断一下

public String signMsg(String signMsg) {
		String base64 = "";
		try {
			KeyStore ks = KeyStore.getInstance("PKCS12");
			//FileInputStream ksfis = new FileInputStream("e:/tester-rsa.pfx");
			//证书路径
			String file = PKI.class.getResource("my.pfx").getPath().replaceAll("%20", " ");
			FileInputStream ksfis = new FileInputStream(file);
			BufferedInputStream ksbufin = new BufferedInputStream(ksfis);
			//客户私钥	
			char[] keyPwd = "111111".toCharArray(); 
			ks.load(ksbufin, keyPwd);
			Enumeration aliases = ks.aliases();
		      String keyAlias = null;
		      PrivateKey priK = null;
		      if (aliases != null) {
		        while (aliases.hasMoreElements()) {
		          keyAlias = (String)aliases.nextElement();
		          priK = (PrivateKey)ks.getKey(keyAlias, keyPwd);
		          if (priK != null) {
		            break;
		          }
		        }
		      }  
			Signature signature = Signature.getInstance("sha1withRSA");
			signature.initSign(priK);
			signature.update(signMsg.getBytes());
			sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
			base64 = encoder.encode(signature.sign());
		} catch(FileNotFoundException e){
		}catch (Exception ex) {
			ex.printStackTrace();
		}
		return base64;
	}

 

验证方法

public boolean enCodeByCer(String msg, String check) {
		boolean flag = false;
		try {
		  msg = new String(Base64.decodeBase64(msg));   
		  String file = PKI.class.getResource("sheytonn-rsa.cer").toURI().getPath();
		  FileInputStream inStream = new FileInputStream(file); 
	      CertificateFactory cf = CertificateFactory.getInstance("X.509");
	      Certificate cac = cf.generateCertificate(inStream);
	      PublicKey pubKey = cac.getPublicKey();
	      inStream.close();
	      Signature signetcheck = Signature.getInstance("sha1withRSA");
	      signetcheck.initVerify(pubKey);
	      signetcheck.update(msg.getBytes());
	      if (signetcheck.verify(Base64.decodeBase64(check))) {
	        flag = true;
	      }
	      else
	      {
	        flag = false;
	      }
	    }
	    catch (Exception e) {
	      flag = false;
	    }
	    return flag; 
}

asp数字证书加密

采用的sha1算法，加密json类型字符串

加密方法

 byte[] bytes = System.Text.Encoding.Default.GetBytes(jsonstr);
        X509Certificate2 cert = new X509Certificate2(HttpContext.Current.Server.MapPath("my.pfx"), "111111", X509KeyStorageFlags.MachineKeySet);
        RSACryptoServiceProvider rsapri = (RSACryptoServiceProvider)cert.PrivateKey;
        RSAPKCS1SignatureFormatter f = new RSAPKCS1SignatureFormatter(rsapri);
        byte[] result;
        f.SetHashAlgorithm("SHA1");
        SHA1CryptoServiceProvider sha = new SHA1CryptoServiceProvider();
        result = sha.ComputeHash(bytes);
        check = System.Convert.ToBase64String(f.CreateSignature(result)).ToString();
        byte[] data = System.Text.Encoding.Default.GetBytes(jsonstr); 
        msg = Convert.ToBase64String(data);

验证方法

 byte[] bytes = System.Text.Encoding.UTF8.GetBytes(msg);
        byte[] SignatureByte = Convert.FromBase64String(check);
        X509Certificate2 cert = new X509Certificate2(Server.MapPath("sheytonn-rsa.cer"), "");
        RSACryptoServiceProvider rsapri = (RSACryptoServiceProvider)cert.PublicKey.Key;
        rsapri.ImportCspBlob(rsapri.ExportCspBlob(false));
        RSAPKCS1SignatureDeformatter f = new RSAPKCS1SignatureDeformatter(rsapri);
        byte[] result;
        f.SetHashAlgorithm("SHA1");
        SHA1CryptoServiceProvider sha = new SHA1CryptoServiceProvider();
        result = sha.ComputeHash(bytes);
       

        if (f.VerifySignature(result, SignatureByte))
        { 
            Response.Write("验证成功");
            //此处做商户逻辑处理 
   
        }

贴上的代码都是可运行的，有问题可以留言咨询