java usbkey数字证书_Java创建数字证书

BouncyCastle下载：

链接：http://pan.baidu.com/s/1vrcL4    密码：6i27

package com.what21.security05;

import java.io.InputStream;

import java.io.OutputStream;

import java.math.BigInteger;

import java.security.Key;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.KeyStore;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.Security;

import java.security.cert.Certificate;

import java.security.cert.X509Certificate;

import java.security.interfaces.RSAPrivateKey;

import java.security.interfaces.RSAPublicKey;

import java.util.Calendar;

import java.util.Date;

import org.bouncycastle.asn1.x509.BasicConstraints;

import org.bouncycastle.asn1.x509.ExtendedKeyUsage;

import org.bouncycastle.asn1.x509.KeyPurposeId;

import org.bouncycastle.asn1.x509.KeyUsage;

import org.bouncycastle.asn1.x509.X509Extensions;

import org.bouncycastle.asn1.x509.X509Name;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import org.bouncycastle.x509.X509V3CertificateGenerator;

import org.bouncycastle.x509.extension.AuthorityKeyIdentifierStructure;

import org.bouncycastle.x509.extension.SubjectKeyIdentifierStructure;

public final class CreateCert {

/**

* 生成秘钥对

*

* @param type

* @param keyLen

* @return

* @throws Exception

*/

public static KeyPair makeKeyPair(String type,int keyLen) throws Exception {

Security.addProvider(new BouncyCastleProvider());

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(type);

keyPairGenerator.initialize(keyLen);

KeyPair keyPair = keyPairGenerator.generateKeyPair();

return keyPair;

}

/**

* 制作X509证书

*

* @param publicKey 公钥

* @param privateKey 私钥

* @param issuerDN 发行者

* @param subjectDN 主题

* @param year 年限 eg : 10

* @param algorithm 算法 eg : MD5WithRSA

* @return

* @throws Exception

*/

public static X509Certificate makeCertificate(PublicKey publicKey, PrivateKey privateKey,

String issuerDN,String subjectDN, int year,String algorithm) throws Exception {

X509V3CertificateGenerator certGenerator = new X509V3CertificateGenerator();

certGenerator.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));

X509Name issuerDNName = new X509Name(issuerDN);

certGenerator.setIssuerDN(issuerDNName);

X509Name subjectDNName = new X509Name(subjectDN);

certGenerator.setSubjectDN(subjectDNName);

certGenerator.setPublicKey(publicKey);

certGenerator.setNotBefore(new Date());

int daysTillExpiry = year * 365;

Calendar expiry = Calendar.getInstance();

expiry.add(Calendar.DAY_OF_YEAR, daysTillExpiry);

certGenerator.setNotAfter(expiry.getTime());

certGenerator.setSignatureAlgorithm(algorithm);

return certGenerator.generate(privateKey);

}

/**

* 生成 KeyStore

*

* @param keyLen

* @param alias

* @param storePasswd

* @param trustPasswd

* @param fullDN

* @param output

* @throws Exception

*/

public static void generateKeyStore(int keyLen,String alias, String storePasswd,

String trustPasswd,String fullDN, OutputStream output)throws Exception {

//==============================================================================//

KeyPair rsaKeyPair = makeKeyPair("RSA",keyLen);

RSAPublicKey rsaPublicKey = (RSAPublicKey) rsaKeyPair.getPublic();

RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) rsaKeyPair.getPrivate();

//==============================================================================//

X509Certificate certificate = makeCertificate(rsaPublicKey,rsaPrivateKey, fullDN, fullDN, 10, "MD5WithRSA");

X509Certificate[] certificateChain = { certificate };

//==============================================================================//

char[] storeCPW = storePasswd.toCharArray();

char[] trustCPW = trustPasswd.toCharArray();

KeyStore keyStore = KeyStore.getInstance("JKS");

keyStore.load(null);

keyStore.setKeyEntry(alias, rsaPrivateKey, trustCPW, certificateChain);

keyStore.store(output, storeCPW);

}

/**

* @param type JKS、PKCS12...

* @param input

* @param storePasswd

* @param alias

* @param trustPasswd

* @return

* @throws Exception

*/

public static Object[] getCertAllInfo(String type,InputStream input,String storePasswd,

String alias,String trustPasswd)throws Exception {

Object[] objs = new Object[3];

char[] storeCPW = storePasswd.toCharArray();

char[] trustCPW = trustPasswd.toCharArray();

KeyStore keyStore = KeyStore.getInstance(type);

keyStore.load(input, storeCPW);

Key key = keyStore.getKey(alias, trustCPW);

if (key instanceof PrivateKey) {

Certificate cert = keyStore.getCertificate(alias);

PublicKey publicKey = cert.getPublicKey();

objs[0] = keyStore;

objs[1] = cert;

objs[2] = new KeyPair(publicKey, (PrivateKey) key);

}

return objs;

}

/**

* @param type

* @param input

* @param storePasswd

* @param alias

* @param trustPasswd

* @param keyLen2

* @param alias2

* @param storePasswd2

* @param trustPasswd2

* @param fullDN2

* @param output2

* @throws Exception

*/

public static void makeCertChain(String type,InputStream input,String storePasswd,

String alias,String trustPasswd,int keyLen2,String alias2, String storePasswd2,

String trustPasswd2,String fullDN2, OutputStream output2)throws Exception{

// 签名证书信息

Object[] objs = getCertAllInfo(type,input,storePasswd,alias,trustPasswd);

X509Certificate masterCert = (X509Certificate)objs[1];

KeyPair masterKeyPair = (KeyPair)objs[2];

masterCert.checkValidity();

//==============================================================================//

KeyPair rsaKeyPair = makeKeyPair("RSA",keyLen2);

RSAPublicKey rsaPublicKey = (RSAPublicKey) rsaKeyPair.getPublic();

RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) rsaKeyPair.getPrivate();

//==============================================================================//

X509Certificate certificate = makeCertificate(rsaPublicKey,rsaPrivateKey, fullDN2, fullDN2, 10, "MD5WithRSA");

certificate.checkValidity();

//==============================================================================//

X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));

certGen.setIssuerDN(masterCert.getSubjectX500Principal());

certGen.setNotBefore(new Date(System.currentTimeMillis()));

certGen.setNotAfter(new Date(System.currentTimeMillis() + 10000));

certGen.setSubjectDN(certificate.getSubjectX500Principal());

certGen.setPublicKey(rsaPublicKey);

certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false, new AuthorityKeyIdentifierStructure(masterCert));

certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false, new SubjectKeyIdentifierStructure(rsaPublicKey));

certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(false));

certGen.addExtension(X509Extensions.KeyUsage, true, new KeyUsage( KeyUsage.digitalSignature | KeyUsage.keyEncipherment));

certGen.addExtension(X509Extensions.ExtendedKeyUsage, true, new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));

certificate = certGen.generate(rsaPrivateKey);

//==============================================================================//

X509Certificate[] certificateChain = { masterCert,certificate };

//==============================================================================//

Security.addProvider(new BouncyCastleProvider());

char[] storeCPW = storePasswd2.toCharArray();

char[] trustCPW = trustPasswd2.toCharArray();

KeyStore outStore = KeyStore.getInstance("JKS");

outStore.load(null, null);

outStore.setKeyEntry(alias2, masterKeyPair.getPrivate(), trustCPW, certificateChain);

outStore.store(output2, storeCPW);

}

}