java相关证书_java实现安全证书相关操作

package test;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.PrintStream;

import java.security.Key;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.KeyStore;

import java.security.Principal;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.SecureRandom;

import java.security.Signature;

import java.security.cert.Certificate;

import java.security.cert.CertificateException;

import java.security.cert.CertificateFactory;

import java.security.cert.CertificateFactorySpi;

import java.security.cert.X509Certificate;

import java.util.ArrayList;

import java.util.Calendar;

import java.util.Collection;

import java.util.Date;

import java.util.Enumeration;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

import java.util.regex.Matcher;

import java.util.regex.Pattern;

import javax.crypto.KeyGenerator;

import javax.crypto.SecretKey;

import javax.crypto.spec.SecretKeySpec;

import org.junit.Test;

import sun.misc.BASE64Decoder;

import sun.misc.BASE64Encoder;

import sun.security.pkcs.ContentInfo;

import sun.security.pkcs.PKCS10;

import sun.security.pkcs.PKCS7;

import sun.security.tools.KeyStoreUtil;

import sun.security.x509.AlgorithmId;

import sun.security.x509.CertificateAlgorithmId;

import sun.security.x509.CertificateIssuerName;

import sun.security.x509.CertificateSerialNumber;

import sun.security.x509.CertificateSubjectName;

import sun.security.x509.CertificateValidity;

import sun.security.x509.CertificateVersion;

import sun.security.x509.CertificateX509Key;

import sun.security.x509.X500Name;

import sun.security.x509.X500Signer;

import sun.security.x509.X509CertImpl;

import sun.security.x509.X509CertInfo;

public class ReadKeyStoreTest {

/**

* 列出store中所有的私钥和公钥 以及签名信息

*

* @param ks

* @param storePass

* @param priKeyPass

* @throws Exception

*/

private void listKeyAndCertificate(KeyStore ks, String storePass,

String priKeyPass) throws Exception {

System.out.println("size=" + ks.size());

Enumeration enum1 = ks.aliases();

int i = 0;

while (enum1.hasMoreElements()) {

String alias = enum1.nextElement();

System.out.println("第" + (++i) + "个");

System.out.println("alias=" + alias);

java.security.cert.Certificate c = ks.getCertificate(alias);// alias为条目的别名

readX509Certificate((X509Certificate) c);

readPriKey(ks, alias, priKeyPass);

}

}

/**

* 列出store中私钥和cert chain信息

*

* @param ks

* @param alias

* @param pass

* @throws Exception

*/

private void readPriKey(KeyStore ks, String alias, String pass)

throws Exception {

Key key = ks.getKey(alias, pass.toCharArray());

if (null == key) {

System.out.println("no priviate key of " + alias);

return;

}

System.out.println();

System.out.println("algorithm=" + key.getAlgorithm());

System.out.println("format=" + key.getFormat());

System.out.println("toString=" + key);

readCertChain(ks, alias);

}

/**

* 列出store中 cert chain信息

*

* @param ks

* @param alias

* @throws Exception

*/

private void readCertChain(KeyStore ks, String alias) throws Exception {

Certificate[] certChain = ks.getCertificateChain(alias);

System.out.println("chain of " + alias);

if (null == certChain) {

System.out.println("no chain");

return;

}

int i = 0;

for (Certificate c : certChain) {

System.out.println("index " + (i++) + " in chain of " + alias);

readX509Certificate((X509Certificate) c);

}

}

/**

* 列出x509Certificate的基本信息

*

* @param t

*/

private void readX509Certificate(X509Certificate t) {

System.out.println(t);

System.out.println("输出证书信息:\n" + t.toString());

System.out.println("版本号:" + t.getVersion());

System.out.println("序列号:" + t.getSerialNumber().toString(16));

System.out.println("主体名：" + t.getSubjectDN());

System.out.println("签发者：" + t.getIssuerDN());

System.out.println("有效期：" + t.getNotBefore());

System.out.println("签名算法：" + t.getSigAlgName());

byte[] sig = t.getSignature();// 签名值

PublicKey pk = t.getPublicKey();

byte[] pkenc = pk.getEncoded();

System.out.println("签名 ：");

for (int i = 0; i 

System.out.print(sig[i] + ",");

System.out.println();

System.out.println("公钥： ");

for (int i = 0; i 

System.out.print(pkenc[i] + ",");

System.out.println();

}

/**

* 创建一个新的keystore

*

* @param storePass

* @param storeType

*            PKCS12/JKS

* @return

* @throws Exception

*/

private KeyStore createKeyStore(String storePass, String storeType)

throws Exception {

KeyStore ks = KeyStore.getInstance(storeType);

ks.load(null, storePass.toCharArray());

return ks;

}

/**

* 加载一个已有的keyStore

*

* @param path

* @param storePass

* @param storeType

*            PKCS12/JKS

* @return

* @throws Exception

*/

private KeyStore loadKeyStore(String path, String storePass,

String storeType) throws Exception {

FileInputStream in = new FileInputStream(path);

KeyStore ks = KeyStore.getInstance(storeType);

ks.load(in, storePass.toCharArray());

in.close();

return ks;

}

/**

* 从文件加载一个证书

*

* @param path

* @param certType

* @return

* @throws Exception

*/

private Certificate loadCert(String path, String certType) throws Exception {

CertificateFactory cf = CertificateFactory.getInstance(certType);

FileInputStream in = new FileInputStream(path);

Certificate c = cf.generateCertificate(in);

in.close();

return c;

}

/**

* 生成一个由根证书签名的store

*

* @param rootStore

* @param rootAlias

* @param rootKeyPass

* @param subjectStr

* @param storeType

* @param storePass

* @param alg

* @param keySize

* @param keyPass

* @return

* @throws Exception

*/

public KeyStore generateSignedKeyStore(KeyStore rootStore,

String rootAlias, String rootKeyPass, String subjectStr,

String storeType, String storePass, String alias, String alg,

int keySize, String keyPass) throws Exception {

PrivateKey rootKey = null;

X509CertImpl rootCert = null;

X509CertInfo rootInfo = null;

CertificateSubjectName rootsubject = null;

// 签发者

X500Name issueX500Name = new X500Name(subjectStr);

if (null != rootStore) {

rootKey = (PrivateKey) rootStore.getKey(rootAlias,

rootKeyPass.toCharArray());

rootCert = (X509CertImpl) rootStore.getCertificate(rootAlias);

rootInfo = (X509CertInfo) rootCert.get(X509CertImpl.NAME + "."

+ X509CertImpl.INFO);

rootsubject = (CertificateSubjectName) rootInfo

.get(X509CertInfo.SUBJECT);

issueX500Name = (X500Name) rootsubject

.get(CertificateIssuerName.DN_NAME);

}

// 签发者

CertificateIssuerName issuerName = new CertificateIssuerName(

issueX500Name);

// 被签发者

X500Name subjectX500Name = new X500Name(subjectStr);

CertificateSubjectName subjectName = new CertificateSubjectName(

subjectX500Name);

// 有效期设置

Calendar calendar = Calendar.getInstance();

Date startDate = calendar.getTime();

calendar.add(Calendar.DATE, 85);

Date endDate = calendar.getTime();

CertificateValidity certificateValidity = new CertificateValidity(

startDate, endDate);

// 序列号

CertificateSerialNumber sn = new CertificateSerialNumber(

(int) (startDate.getTime() / 1000L));

// 版本

CertificateVersion certVersion = new CertificateVersion(

CertificateVersion.V3);

// 算法

// TODO 获取算法的代码有问题

AlgorithmId algorithmId = new AlgorithmId(

"RSA".equals(alg) ? AlgorithmId.sha1WithRSAEncryption_oid

: AlgorithmId.sha1WithDSA_oid);

// 密钥对

KeyPairGenerator keygen = KeyPairGenerator.getInstance(alg);

keygen.initialize(keySize, new SecureRandom());

KeyPair kp = keygen.genKeyPair();

X509CertInfo certInfo = new X509CertInfo();

certInfo.set("version", certVersion);

certInfo.set("serialNumber", sn);

// localX500Signer.getAlgorithmId();

certInfo.set("algorithmID", new CertificateAlgorithmId(algorithmId));

certInfo.set("key", new CertificateX509Key(kp.getPublic()));

certInfo.set("validity", certificateValidity);

certInfo.set("subject", subjectName);

certInfo.set("issuer", issuerName);

// 扩展信息

// if (System.getProperty("sun.security.internal.keytool.skid") !=

// null)

// {

// CertificateExtensions localCertificateExtensions = new

// CertificateExtensions();

// localCertificateExtensions.set("SubjectKeyIdentifier", new

// SubjectKeyIdentifierExtension(new

// KeyIdentifier(this.publicKey).getIdentifier()));

// certInfo.set("extensions", localCertificateExtensions);

// }

X509CertImpl newcert = new X509CertImpl(certInfo);

// TODO 这里的签名算法可能有问题 貌似应该用rootcert的签名算法 待测试

KeyStore ks = this.createKeyStore(storePass, storeType);

Certificate[] certChain = null;

// 如果rootStore为空 则生成自签名证书

if (null == rootStore) {

newcert.sign(kp.getPrivate(), "SHA1WithRSA");

certChain = new Certificate[] { newcert };

} else {

newcert.sign(rootKey, "SHA1WithRSA");

certChain = new Certificate[] { newcert, rootCert };

}

// ks.setCertificateEntry("zrbin", newcert);

ks.setKeyEntry(alias, kp.getPrivate(), keyPass.toCharArray(), certChain);

return ks;

}

@Test

public void testReadCer() throws Exception {

String path = "d:\\test.cer";

String certType = "X.509";

CertificateFactory cf = CertificateFactory.getInstance(certType);

FileInputStream in = new FileInputStream(path);

Collection cs = (Collection) cf

.generateCertificates(in);

in.close();

System.out.println("size=" + cs.size());

for (Certificate c : cs) {

readX509Certificate((X509Certificate) c);

}

}

@Test

public void testReadP12() throws Exception {

String storePass = "123456";

String keyPass = "123456";

String path = "d:\\zrbin.p12";

KeyStore ks = loadKeyStore(path, storePass, "PKCS12");

listKeyAndCertificate(ks, storePass, keyPass);

}

@Test

public void testReadKeyStore() throws Exception {

String storePass = "123456";

String keyPass = "123456";

String path = "d:\\test.keystore";

KeyStore ks = loadKeyStore(path, storePass, "JCEKS");

listKeyAndCertificate(ks, storePass, keyPass);

}

@Test

public void testExportCert() throws FileNotFoundException, Exception {

String pass = "123456";

FileInputStream in = new FileInputStream("d:\\zrbin.p12");

boolean rfc = true;

KeyStore ks = KeyStore.getInstance("PKCS12");

ks.load(in, pass.toCharArray());

Certificate cert = ks.getCertificate("zrbin");

PrintStream out = new PrintStream("D:\\zrbin.cer");

if (rfc) {

BASE64Encoder encoder = new BASE64Encoder();

out.println("-----BEGIN CERTIFICATE-----");

encoder.encodeBuffer(cert.getEncoded(),

out);

out.println("-----END CERTIFICATE-----");

} else {

out.write(cert.getEncoded());

}

out.write(cert.getEncoded());

}

@Test

public void testImportCert() throws Exception {

CertificateFactory cf = CertificateFactory.getInstance("X.509");

FileInputStream storeIn = new FileInputStream("d:\\server.keystore");

FileInputStream in = new FileInputStream("d:\\zrbin.cer");

FileInputStream rootin = new FileInputStream("d:\\root.cer");

X509CertImpl cert = (X509CertImpl) cf.generateCertificate(in);

X509CertImpl rootcert = (X509CertImpl) cf.generateCertificate(rootin);

KeyStore ks = KeyStore.getInstance("JKS");

ks.load(null, "123456".toCharArray());

ks.deleteEntry("zrbin");

// ks.setCertificateEntry("zrbin", cert);

ks.setCertificateEntry("root", rootcert);

in.close();

FileOutputStream out = new FileOutputStream("d:\\server.keystore");

ks.store(out, "123456".toCharArray());

}

@Test

public void testImportSigenedCert() throws Exception {

String alias = "test";

CertificateFactory cf = CertificateFactory.getInstance("X.509");

FileInputStream storeIn = new FileInputStream("d:\\test.keystore");

KeyStore ks = KeyStore.getInstance("JKS");

ks.load(storeIn, "123456".toCharArray());

PrivateKey priKey = (PrivateKey) ks.getKey(alias,

"123456".toCharArray());

FileInputStream in = new FileInputStream("d:\\test.cer");

Collection certCollection = (Collection) cf

.generateCertificates(in);

System.out.println(certCollection.size());

if (certCollection.size() == 0) {

System.out.println("没有要导入的证书");

return;

}

// 如果没有对应的私钥，直接导入certficateEntry

if (null == priKey) {

for (Certificate _cert : certCollection) {

ks.setCertificateEntry(alias, _cert);

break;

}

} else {

Certificate importCert = null;

for (Certificate cert : certCollection) {

if (ks.getCertificate(alias).getPublicKey()

.equals(cert.getPublicKey())) {

importCert = cert;

break;

}

}

if (null == importCert) {

System.out.println("错误：no replay cert");

}

certCollection.remove(importCert);

if (X509CertImpl.isSelfSigned((X509Certificate) importCert, null)) {

System.out.println("证书未被ca签名,无需导入");

} else {

// 构建认证链

List certList = new ArrayList(

ks.size());

Map cerMap = new HashMap();

Enumeration aliasEnum = ks.aliases();

// 把不包括当前回复的都加到map里

while (aliasEnum.hasMoreElements()) {

String _alias = aliasEnum.nextElement();

if (!_alias.equals(alias)) {

X509CertImpl _cert = (X509CertImpl) ks

.getCertificate(_alias);

cerMap.put(_cert.getSubjectDN(), _cert);

}

}

for (Certificate cert : certCollection) {

cerMap.put(((X509Certificate) cert).getSubjectDN(), cert);

}

certList.add(importCert);

Principal issuerName = ((X509Certificate) importCert)

.getIssuerDN();

while (cerMap.keySet().contains(issuerName)) {

X509Certificate _rootCert = (X509Certificate) cerMap

.remove(issuerName);

if (null == _rootCert) {

System.out.println(issuerName + "的根证书为空");

return;

}

certList.add(_rootCert);

issuerName = _rootCert.getIssuerDN();

}

X509CertImpl rootCert = (X509CertImpl) certList.get(certList

.size() - 1);

if (!X509CertImpl.isSelfSigned(rootCert, null)) {

System.out.println("构建证书链错误,请先导入颁发者(" + issuerName

+ ")的CA证书");

return;

}

Certificate[] certChain = certList

.toArray(new Certificate[certList.size()]);

ks.setKeyEntry(alias, priKey, "123456".toCharArray(), certChain);

}

}

in.close();

FileOutputStream out = new FileOutputStream("d:\\test.keystore");

ks.store(out, "123456".toCharArray());

out.close();

}

@Test

public void testGenerateKeyStore() throws Exception {

KeyPairGenerator kg = KeyPairGenerator.getInstance("RSA");

KeyPair kp = kg.genKeyPair();

System.out.println(KeyStoreUtil.niceStoreTypeName("PKCS12"));

System.out.println(kp.getPrivate());

System.out.println(kp.getPublic());

KeyStore ks = KeyStore.getInstance("JKS");

}

@Test

public void testX500Name() throws IOException, CertificateException {

// for(byte i=48;i<=57;i++){

// System.out.println((char)i);

// }

// RFC 1779 (CN, L, ST, O, OU, C, STREET)

// RFC 2253 (CN/name, L/location, ST/station, O/org, OU/orgunit,

// C/country, STREET, DC, UID)

X500Name subjectName = new X500Name(

"CN=www.jiangtech.com,L=ZuChongZhi road,ST=Shang Hai,O=Jiangdatech,OU=ENTERPRISE APP,C=China,STREET=ZuChongZhi Road");

X500Name subjectName1 = new X500Name(

"CN=www.jiangtech.com,L=ZuChongZhi road,ST=Shang Hai,O=Jiangdatech,OU=ENTERPRISE APP,C=China,STREET=ZuChongZhi Road");

// X509CertInfo certInfo = new X509CertInfo();

// certInfo.set(X509CertInfo.SUBJECT, new CertificateSubjectName(

// subjectName));

System.out.println(subjectName.hashCode());

System.out.println(subjectName1.hashCode());

}

/**

* 证书验证

*

* @throws Exception

*/

@Test

public void testValidate() throws Exception {

KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");

// kpg.initialize()

KeyPair kp = kpg.genKeyPair();

KeyStore rootStore = this.loadKeyStore("d:/root.keystore", "123456",

"JKS");

PrivateKey rootKey = (PrivateKey) rootStore.getKey("jdcert",

"123456".toCharArray());

KeyStore store1 = this.loadKeyStore("d:/jd_signed.keystore", "123456",

"JKS");

X509CertImpl rootCert = (X509CertImpl) rootStore

.getCertificate("jdcert");

X509CertInfo rootInfo = (X509CertInfo) rootCert.get(X509CertImpl.NAME

+ "." + X509CertImpl.INFO);

CertificateSubjectName rootsubject = (CertificateSubjectName) rootInfo

.get(X509CertInfo.SUBJECT);

Certificate[] chain = rootStore.getCertificateChain("jdcert");

rootCert.verify(kp.getPublic());

}

/**

* 测试签发证书

*/

@Test

public void testGenerateSignedKeyStore() {

try {

KeyStore rootStore = this.loadKeyStore("d:/root.keystore",

"123456", "JKS");

String rootAlias = "test";

String subjectStr = "CN=zhaorb@jiangdatech.com,L=PU Dong,ST=Shang Hai,O=Jiangdatech,OU=ENTERPRISE APP,C=China,STREET=ZuChongZhi Road";

String alg = "RSA";

String storeType = "JKS";

int keySize = 1024;

String keyPass = "123456";

String rootKeyPass = "123456";

String storePass = "123456";

String alias = "test";

KeyStore ks = this.generateSignedKeyStore(null, rootAlias,

rootKeyPass, subjectStr, storeType, storePass, alias, alg,

keySize, keyPass);

OutputStream out = new FileOutputStream(

new File("d:/test.keystore"));

ks.store(out, "123456".toCharArray());

} catch (Exception e) {

e.printStackTrace();

}

}

/**

* 测试签发证书

*/

@Test

public void testGenerateSecKeyStore() {

try {

String rootAlias = "test";

String subjectStr = "CN=zhaorb@jiangdatech.com,L=PU Dong,ST=Shang Hai,O=Jiangdatech,OU=ENTERPRISE APP,C=China,STREET=ZuChongZhi Road";

String alg = "DES";

String storeType = "JKS";

int keySize = 1024;

String keyPass = "123456";

String rootKeyPass = "123456";

String storePass = "123456";

String alias = "test";

KeyStore ks = this.createKeyStore("123456", "JCEKS");

KeyGenerator keygen = KeyGenerator.getInstance("DES");

SecretKey secKey = keygen.generateKey();

ks.setKeyEntry(alias, secKey, "123456".toCharArray(),null);

OutputStream out = new FileOutputStream(

new File("d:/test.keystore"));

ks.store(out, "123456".toCharArray());

} catch (Exception e) {

e.printStackTrace();

}

}

@Test

/**

* 关于p7b的操作 未实现

*/

public void testGeneratePKCS7KeyStore() {

try {

/*ContentInfo info = new ContentInfo(arg0);

//PKCS7 pkcs7 = new PKCS7()

String rootAlias = "test";

String subjectStr = "CN=zhaorb@jiangdatech.com,L=PU Dong,ST=Shang Hai,O=Jiangdatech,OU=ENTERPRISE APP,C=China,STREET=ZuChongZhi Road";

String alg = "DES";

String storeType = "JKS";

int keySize = 1024;

String keyPass = "123456";

String rootKeyPass = "123456";

String storePass = "123456";

String alias = "test";

KeyStore ks = this.createKeyStore("123456", "PKCS7");

KeyGenerator keygen = KeyGenerator.getInstance("RSA");

//SecretKey secKey = keygen.generateKey();

//ks.setKeyEntry(alias, secKey, "123456".toCharArray(),null);

OutputStream out = new FileOutputStream(

new File("d:/test.keystore"));

ks.store(out, "123456".toCharArray());*/

} catch (Exception e) {

e.printStackTrace();

}

}

@Test

public void testReadJCEKS() throws Exception{

KeyStore ks = this.loadKeyStore("D:/test.keystore","123456", "JCEKS");

Enumeration aliasEnum = ks.aliases();

while(aliasEnum.hasMoreElements()){

String alias = aliasEnum.nextElement();

SecretKeySpec secKey = (SecretKeySpec) ks.getKey(alias, "123456".toCharArray());

System.out.println(ks.getCertificate(alias));

//System.out.println(ks.);

System.out.println(secKey.getClass());

System.out.println(secKey.getFormat());

System.out.println(secKey.getEncoded());

}

}

public PKCS10 readCsr() throws Exception {

File f = new File("D:/test.csr");

InputStream in = new FileInputStream(f);

ByteArrayOutputStream out = new ByteArrayOutputStream(1024);

byte[] bytes = new byte[(int) f.length()];

in.read(bytes);

String base64String = new String(bytes, "ISO-8859-1");

System.out.println(base64String);

Pattern p = Pattern

.compile("-----BEGIN NEW CERTIFICATE REQUEST-----([\\s\\S]*?)-----END NEW CERTIFICATE REQUEST-----([\\s\\S]*)");

BASE64Decoder decoder = new BASE64Decoder();

Matcher m = p.matcher(base64String);

if (m.find()) {

String s = m.group(1);

System.out.println(s.trim());

byte[] bArray = decoder.decodeBuffer(s);

PKCS10 csr = new PKCS10(bArray);

System.out.println(csr);

return csr;

}

throw new Exception("文件错误 ，无法读取csr");

}

@Test

public void testReadCsr() throws Exception {

PKCS10 csr = readCsr();

}

@Test

public void createCsr() throws Exception {

String storePass = "123456";

String alias = "test";

String alg = null;

KeyStore ks = this.loadKeyStore("d:/test.keystore", storePass, "JKS");

Certificate cert = ks.getCertificate(alias);

PrivateKey priKey = (PrivateKey) ks.getKey(alias,

"123456".toCharArray());

PublicKey pubKey = cert.getPublicKey();

PKCS10 csr = new PKCS10(pubKey);

String signAlg = null;

if (alg == null) {

alg = priKey.getAlgorithm();

if (("DSA".equalsIgnoreCase(alg)) || ("DSS".equalsIgnoreCase(alg)))

signAlg = "SHA1WithDSA";

else if ("RSA".equalsIgnoreCase((String) alg))

signAlg = "SHA1WithRSA";

else

throw new Exception("Cannot derive signature algorithm");

}

Signature signature = Signature.getInstance(signAlg);

signature.initSign(priKey);

X500Name x500Name = new X500Name(((X509Certificate) cert)

.getSubjectDN().toString());

X500Signer x500Signer = new X500Signer(signature, x500Name);

((PKCS10) csr).encodeAndSign(x500Signer);

File f = new File("D:/test.csr");

if (f.exists()) {

f.delete();

}

((PKCS10) csr).print(new PrintStream(new File("D:/test.csr")));

}

/**

* 签名

*

* @throws Exception

*/

@Test

public void testSignature() throws Exception {

KeyStore rootStore = this.loadKeyStore("d:/root.keystore", "123456",

"JKS");

PrivateKey rootKey = (PrivateKey) rootStore.getKey("root",

"123456".toCharArray());

X509CertImpl rootX509Cert = (X509CertImpl) rootStore

.getCertificate("root");

X500Name issuerX500Name = (X500Name) rootX509Cert.get(X509CertImpl.NAME

+ "." + X509CertImpl.INFO + "." + X509CertInfo.SUBJECT + "."

+ CertificateSubjectName.DN_NAME);

// 有效期设置

Calendar calendar = Calendar.getInstance();

Date startDate = calendar.getTime();

calendar.add(Calendar.DATE, 85);

Date endDate = calendar.getTime();

CertificateValidity certificateValidity = new CertificateValidity(

startDate, endDate);

// 序列号

CertificateSerialNumber sn = new CertificateSerialNumber(

(int) (startDate.getTime() / 1000L));

PKCS10 csr = this.readCsr();

PublicKey pubKey = csr.getSubjectPublicKeyInfo();

X500Name subjectX500Name = csr.getSubjectName();

// TODO 未实现

Signature signature = Signature.getInstance("Sha1WithRSA");

X500Signer signer = new X500Signer(signature, subjectX500Name);

AlgorithmId algorithmId = signer.getAlgorithmId();

X509CertInfo info = new X509CertInfo();

info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(

algorithmId));

info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(

subjectX500Name));

info.set(X509CertInfo.ISSUER, new CertificateIssuerName(issuerX500Name));

info.set(X509CertInfo.KEY, new CertificateX509Key(pubKey));

info.set(X509CertInfo.VERSION, new CertificateVersion(

CertificateVersion.V3));

info.set(X509CertInfo.VALIDITY, certificateValidity);

info.set(X509CertInfo.SERIAL_NUMBER, sn);

X509CertImpl newCert = new X509CertImpl(info);

newCert.sign(rootKey, "SHA1WithRSA");

OutputStream out = new FileOutputStream("d:/test.cer");

out.write(newCert.getEncoded());

out.write(rootX509Cert.getEncoded());

out.close();

}

}