java 证书公钥 私钥_Java 密钥库 证书 公钥 私钥

Java 密钥库 证书 公钥 私钥

1.密钥库

密钥库keystore是存储一个或多个密钥条目的文件，每个密钥条目以一个别名标识，它包含密钥和证书相关信息。可以使用java自带工具keytool生成，也可以通过程序编码实现。

密钥库文件格式(实际上，扩展名并不重要)，比较常用的是jks和pkcs12。

格式

扩展名

描述

特点

JKS

.jks/.ks

密钥库的Java实现版本，provider为SUN

密钥库和私钥用不同的密码进行保护

JCEKS

.jce

密钥库的JCE实现版本，provider为SUN JCE

相对于JKS安全级别更高，保护Keystore私钥时采用3DES

PKCS12

.p12/.pfx

个人信息交换语法标准

包含私钥、公钥及其证书，密钥库和私钥用相同密码进行保护

BKS

.bks

密钥库的BC实现版本，provider为BC

基于JCE实现

2.使用Java的keytool工具生成密钥库

keytool -genkeypair -alias fire -storetype PKCS12 -keyalg RSA -keystore fire.pkcs12 -storepass 13987664391 -validity 3650 -keysize 2048

您的名字与姓氏是什么?

[Unknown]: xu.dm

您的组织单位名称是什么?

[Unknown]: com.home

您的组织名称是什么?

[Unknown]: home

您所在的城市或区域名称是什么?

[Unknown]: km

您所在的省/市/自治区名称是什么?

[Unknown]: yn

该单位的双字母国家/地区代码是什么?

[Unknown]: cn

CN=xu.dm, OU=com.home, O=home, L=km, ST=yn, C=cn是否正确?

[否]: y

3.查看密钥库keystore证书BASE64信息

keytool -list -rfc -keystore fire.pkcs12 -storepass 13987664391

密钥库类型: PKCS12

密钥库提供方: SUN

您的密钥库包含 1 个条目

别名: fire

创建日期: 2021-1-25

条目类型: PrivateKeyEntry

证书链长度: 1

证书[1]:

-----BEGIN CERTIFICATE-----

MIIDUTCCAjmgAwIBAgIEKcHXqjANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJj

bjELMAkGA1UECBMCeW4xCzAJBgNVBAcTAmttMQ0wCwYDVQQKEwRob21lMREwDwYD

VQQLEwhjb20uaG9tZTEOMAwGA1UEAxMFeHUuZG0wHhcNMjEwMTI1MDM0MDM1WhcN

MzEwMTIzMDM0MDM1WjBZMQswCQYDVQQGEwJjbjELMAkGA1UECBMCeW4xCzAJBgNV

BAcTAmttMQ0wCwYDVQQKEwRob21lMREwDwYDVQQLEwhjb20uaG9tZTEOMAwGA1UE

AxMFeHUuZG0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCSPMos3BDL

SPHyS7dg+X6G1ce2vcEvXCbeGaptl7qs7kE78iHjXJd6lGLPwAn0iwNz+mEyqC94

jHFORypFlVHHExKvCe71u1TAxcEFc3ngGyJCxzPw2+1ET7EW0nQYlqM0ZKgqL+Tr

qCuYs+mJWmdqg4S+hXLi3f8heLTIA5+QAxucWwtVJyH0SF+5A+qWlF/Tk90+b8E5

Iv1d0bNZV7phwztgvJA7YlYrlo/lRUw4DQh+bqNmxjGApCN7rMVmICliYJJsLJZh

hIY98cscZ0A2buMXZIHkIWs9ThpJNpU4RQa6dZx17VaDiVfNa49r8Aj1RTApMz3/

WsiSuaKpkgHhAgMBAAGjITAfMB0GA1UdDgQWBBQdi78WTJWP9dYCc08GSHfdUPLD

xDANBgkqhkiG9w0BAQsFAAOCAQEAItCX9SN7/2rkvPoP51I9sap+TjjIwEQU6oEy

2B6toOCBx3akN0Kme5enLkmp2hU33R+FJhjUgXUrePlLz+yW/frE1Wi0YI+KdWZr

Fs0g7He0eRCZDMjkfnY6Pb2WHIaRJFNWwQ9Wf+7dOE9GfsgS3uVQjtpvfOAmjXlt

IerB4xbGydPsI4JnjXvyN4T6+18VT4PLnoosdSZ0bta0ZXIy3kN5GNlr9Y+Hp42c

Slenle06FQSczfb+1C/87rST20VCy0YmPq4SDdQSsiCZWAj4dWI7mJYkXnhH6AAm

QeXmUIZVmpRkPEvXIBLL3qZt7jv3Xlv65VfDsJmtNMRfC7KhbQ==

-----END CERTIFICATE-----

*******************************************

*******************************************

4.使用java代码生成密钥库

public static void createKeyStoreFile() throws Exception {

String filePath = "e:/myProgram/key/home.keystore";

final int keySize = 2048;

final String commonName = "xu.dm";

final String organizationalUnit = "com.home";

final String organization = "home";

final String city = "km";

final String state = "yn";

final String country = "cn";

final long validity = 3650; // 10 years

final String alias = "home";

final String keyPassword = "13987664391";

// keytool工具

CertAndKeyGen keyGen = new CertAndKeyGen("RSA", "SHA1WithRSA");

// 通用信息

X500Name x500Name = new X500Name(commonName, organizationalUnit, organization, city, state, country);

// 根据密钥长度生成公钥和私钥

keyGen.generate(keySize);

PrivateKey privateKey = keyGen.getPrivateKey();

// 证书

X509Certificate certificate = keyGen.getSelfCertificate(x500Name, new Date(), (long) validity * 24 * 60 * 60);

KeyStore keyStore = KeyStore.getInstance("PKCS12");

keyStore.load(null,null);

keyStore.setKeyEntry(alias,privateKey,keyPassword.toCharArray(),new Certificate[]{certificate});

FileOutputStream outputStream = new FileOutputStream(filePath);

keyStore.store(outputStream,keyPassword.toCharArray());

outputStream.close();

System.out.println("keyStore file created ...");

}

5.从密钥库keystore里提取私钥和证书

public static PrivateKey getPrivateKey() throws Exception {

String storepass = "13987664391";

String keyAlias = "honor";

BASE64Encoder base64Encoder = new BASE64Encoder();

KeyStore keystore = KeyStore.getInstance("PKCS12");

keystore.load(KeyTools.class.getResourceAsStream("/key/home.pkcs12"), storepass.toCharArray());

PrivateKey key = (PrivateKey) keystore.getKey(keyAlias, storepass.toCharArray());

System.out.println(key.toString());

String privateKeyStr = base64Encoder.encode(key.getEncoded());

System.out.println();

System.out.println("-----BEGIN PRIVATE KEY-----");

System.out.println(privateKeyStr);

System.out.println("-----END PRIVATE KEY-----");

Certificate certificate = keystore.getCertificate(keyAlias);

PublicKey publicKey = certificate.getPublicKey();

System.out.println(publicKey);

// 打印certificate的base64编码

String certificateString = base64Encoder.encode(certificate.getEncoded());

System.out.println();

System.out.println("-----BEGIN CERTIFICATE-----");

System.out.println(certificateString);

System.out.println("-----END CERTIFICATE-----");

return key;

}

6.从证书中提取公钥BASE64编码字符串

/**

* 从CERTIFICATE文本中提取public key字符串

* CERTIFICATE本质是文本以"-----BEGIN CERTIFICATE-----"

* 并以"-----END CERTIFICATE-----"结束

*/

public static String getPublicKeyFromCertificate() throws CertificateException {

InputStream inputStream = KeyTools.class.getResourceAsStream("/key/home.PKCS12.cer");

CertificateFactory ft = CertificateFactory.getInstance("X.509");

X509Certificate certificate = (X509Certificate) ft.generateCertificate(inputStream);

PublicKey publicKey = certificate.getPublicKey();

BASE64Encoder b64 = new BASE64Encoder();

String result = b64.encode(publicKey.getEncoded());

System.out.println("-----BEGIN PUBLIC KEY-----");

System.out.println(result);

System.out.println("-----END PUBLIC KEY-----");

return result;

}

7.从公钥BASE64字符串生成PublicKey对象

/**

* 从public key字符串中创建PublicKey对象

*

* @param signingKey 不包括"-----BEGIN PUBLIC KEY-----"和"-----END PUBLIC KEY-----"

*/

public static PublicKey getRsaPublicKey(String signingKey) {

try {

X509EncodedKeySpec keySpec = new X509EncodedKeySpec(new BASE64Decoder().decodeBuffer(signingKey));

KeyFactory keyFactory = KeyFactory.getInstance("RSA");

PublicKey publicKey = keyFactory.generatePublic(keySpec);

return publicKey;

} catch (Exception e) {

e.printStackTrace();

}

return null;

}

8.从密钥库keystore中提取密钥对，密钥对可以提取公钥和私钥对象

/**

* 根据Keystore生成密钥对

*/

public static KeyPair getKeyPair() throws Exception {

String storepass = "13987664391";

String keyAlias = "honor";

KeyStore keystore = KeyStore.getInstance("PKCS12");

keystore.load(KeyTools.class.getResourceAsStream("/key/home.pkcs12"), storepass.toCharArray());

RSAPrivateCrtKey key = (RSAPrivateCrtKey) keystore.getKey(keyAlias, storepass.toCharArray());

RSAPublicKeySpec spec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());

PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(spec);

return new KeyPair(publicKey, key);

}