java找不到根证书和中间证书_java – 从终端实体获取根证书和中间证书

我已经使用BouncyCastle 1.56进行此测试.

此扩展可能存在(它不是强制性的)并且可能包含获取颁发者证书的URL(发行者是“当前”以上的证书,因此最终实体的发行者是中间人,中间人的发行者是根证书).

您可以使用BouncyCastle获取此扩展值：

import java.security.cert.X509Certificate;

import org.bouncycastle.asn1.x509.AccessDescription;

import org.bouncycastle.asn1.x509.AuthorityInformationAccess;

import org.bouncycastle.asn1.x509.Extension;

import org.bouncycastle.asn1.x509.GeneralName;

import org.bouncycastle.asn1.x509.X509ObjectIdentifiers;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import org.bouncycastle.x509.extension.X509ExtensionUtil;

X509Certificate cert = // end entity certificate

// get Authority Information Access extension (will be null if extension is not present)

byte[] extVal = cert.getExtensionValue(Extension.authorityInfoAccess.getId());

AuthorityInformationAccess aia = AuthorityInformationAccess.getInstance(X509ExtensionUtil.fromExtensionValue(extVal));

// check if there is a URL to issuer's certificate

AccessDescription[] descriptions = aia.getAccessDescriptions();

for (AccessDescription ad : descriptions) {

// check if it's a URL to issuer's certificate

if (ad.getAccessMethod().equals(X509ObjectIdentifiers.id_ad_caIssuers)) {

GeneralName location = ad.getAccessLocation();

if (location.getTagNo() == GeneralName.uniformResourceIdentifier) {

String issuerUrl = location.getName().toString();

// http URL to issuer (test in your browser to see if it's a valid certificate)

// you can use java.net.URL.openStream() to create a InputStream and create

// the certificate with your CertificateFactory

URL url = new URL(issuerUrl);

X509Certificate issuer = (X509Certificate) certificateFactory.generateCertificate(url.openStream());

}

}

}

因此,您可以将此代码与最终实体证书一起使用以获取中间体.然后再用中间体来获取根.

然后将根添加到TrustAnchor,验证应该有效.

注意：但正如我所说,此扩展名不是强制性的,可能不存在.在这种情况下,getExtensionValue将返回null,我知道的唯一替代方法是在google中搜索证书并下载它们(这些证书链通常是公共的,不难找到)