java pem 私钥,从证书别名到带有使用Java包含私钥的PEM文件

I have this code to generate a CER file using the alias:

public class TestFromAliasToCER {

public static final int KEY_SIZE = 1024;

public static final String BEGIN_CERT = "-----BEGIN CERTIFICATE-----";

public static final String END_CERT = "-----END CERTIFICATE-----";

public final static String LINE_SEPARATOR = System.getProperty("line.separator");

public static void main(String[] args) throws FileNotFoundException, IOException, NoSuchAlgorithmException, NoSuchProviderException, KeyStoreException, CertificateException {

KeyStore keyStore = KeyStore.getInstance ("Windows-MY");

keyStore.load (null, null);

Enumeration aux = keyStore.aliases();

String alias = aux.nextElement();

X509Certificate certificate = (X509Certificate) keyStore.getCertificate (alias);

String certString = formatCrtFileContents(certificate);

PrintWriter out = new PrintWriter("cert.CER");

out.println(certString);

out.close();

}

public static String formatCrtFileContents(final Certificate certificate) throws CertificateEncodingException {

final Base64.Encoder encoder = Base64.getMimeEncoder(64, LINE_SEPARATOR.getBytes());

final byte[] rawCrtText = certificate.getEncoded();

final String encodedCertText = new String(encoder.encode(rawCrtText));

final String prettified_cert = BEGIN_CERT + LINE_SEPARATOR + encodedCertText + LINE_SEPARATOR + END_CERT;

return prettified_cert;

}

}

This creates the cer file with

-----BEGIN CERTIFICATE-----

data

-----END CERTIFICATE-----

I want to be able to create a PEM Certificate with the private key included, is it possible? If not, why?

I'm not restricted to Java only and free to use any Java API, but preferable with the least user interaction as possible.

解决方案

Although I don't see it documented, according to the source the SunMSCAPI provider implements only a stub for getEncoded and cannot export Windows privatekey so you can't do this with JCA.

You could of course write JNI or JNA to call Windows CAPI, but that's not simple.

To use existing tools without user interaction you can use Runtime or ProcessBuilder to

run certutil with arguments -exportpfx -user -p password certid filename

run powershell and tell it to select an object in cert:\currentuser\my and invoke the Export('PFX','password') method -- examples for machine rather than user cert here

or in (only) recent powershell use Export-PFXCertificate cmdlet documentation here

and after any of these, extract from pkcs12 to PEM with openssl pkcs12, or if you prefer with Java by:

load the PKCS12 keystore and get the PrivateKey entry

call getEncoded and encode the result in folded (MIME) base64 like you did for the certificate except use -----BEGIN/END PRIVATE KEY-----

Warning: Java produces an unencrypted (PKCS8) privatekey, so make certain no unauthorized user or program ever has access to this file, your disk/filesystem or any backup(s).