java生成证书

1. import java.io.BufferedInputStream;  
2. import java.io.ByteArrayInputStream;  
3. import java.io.ByteArrayOutputStream;  
4. import java.io.IOException;  
5. import java.io.InputStream;  
6. import java.io.OutputStream;  
7. import java.math.BigInteger;  
8. import java.security.KeyFactory;  
9. import java.security.KeyPair;  
10. import java.security.KeyPairGenerator;  
11. import java.security.PrivateKey;  
12. import java.security.PublicKey;  
13. import java.security.Security;  
14. import java.security.cert.Certificate;  
15. import java.security.cert.CertificateFactory;  
16. import java.security.cert.X509Certificate;  
17. import java.security.spec.PKCS8EncodedKeySpec;  
18. import java.util.Date;  
19. import java.util.Hashtable;  
20. import java.util.Vector;  
21.   
22. import org.bouncycastle.asn1.ASN1Sequence;  
23. import org.bouncycastle.asn1.DERBMPString;  
24. import org.bouncycastle.asn1.DERInputStream;  
25. import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;  
26. import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier;  
27. import org.bouncycastle.asn1.x509.BasicConstraints;  
28. import org.bouncycastle.asn1.x509.SubjectKeyIdentifier;  
29. import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;  
30. import org.bouncycastle.asn1.x509.X509Extensions;  
31. import org.bouncycastle.jce.X509Principal;  
32. import org.bouncycastle.jce.interfaces.PKCS12BagAttributeCarrier;  
33. import org.bouncycastle.jce.provider.BouncyCastleProvider;  
34. import org.bouncycastle.jce.provider.JDKPKCS12KeyStore;  
35. import org.bouncycastle.x509.X509V3CertificateGenerator;  
36. import org.bouncycastle.x509.extension.SubjectKeyIdentifierStructure;  
37. import org.springframework.core.io.Resource;  
38.   
39. import steel.share.clientcert.ClientCert;  
40.   
41.   
42. public class ClientCertGenerator {  
43.       
44.     private Resource rootCertFilePath;  
45.   
46.     private Resource rootKeyFilePath;  
47.   
48.     private int serialNumber;  
49.   
50.     public void genClientCert(ClientCert clientCert, OutputStream fileOutputStream) {  
51.         try {  
52.               
53.             X509Certificate rootCert = loadRootCertificate();  
54.               
55.             PrivateKey rootPrivateKey = loadRootPrivateKeyByKeyFile();  
56.               
57.             KeyPair clientKeyPair = genClientKeyPair();  
58.               
59.             X509Certificate signedCert = signCert(rootCert.getPublicKey(), rootPrivateKey, rootCert, clientKeyPair,  
60.                     clientCert);  
61.   
62.               
63.             PKCS12BagAttributeCarrier bagAttributeCarrier = (PKCS12BagAttributeCarrier) signedCert;  
64.             bagAttributeCarrier.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_friendlyName, new DERBMPString(  
65.                     clientCert.getCommonName() + "'s key"));  
66.             bagAttributeCarrier.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_localKeyId,  
67.                     new SubjectKeyIdentifierStructure(clientKeyPair.getPublic()));  
68.   
69.               
70.             Certificate[] certChain = new Certificate[1];  
71.             certChain[0] = signedCert;  
72.   
73.             JDKPKCS12KeyStore ks = new JDKPKCS12KeyStore.BCPKCS12KeyStore();  
74.             ks.engineSetKeyEntry(clientCert.getCommonName(), clientKeyPair.getPrivate(), clientCert.getPassword()  
75.                     .toCharArray(), certChain);  
76.             ks.engineStore(fileOutputStream, clientCert.getPassword().toCharArray());  
77.   
78.         } catch (Exception e) {  
79.             throw new RuntimeException(e.getMessage(), e);  
80.         }  
81.     }  
82.   
83.       
84.     private X509Certificate loadRootCertificate() {  
85.         InputStream certIn = null;  
86.         try {  
87.               
88.             CertificateFactory fac = CertificateFactory.getInstance("X.509");  
89.   
90.             return (X509Certificate) fac.generateCertificate(rootCertFilePath.getInputStream());  
91.         } catch (Exception e) {  
92.             throw new RuntimeException(e.getMessage(), e);  
93.         } finally {  
94.             if (certIn != null) {  
95.                 try {  
96.                     certIn.close();  
97.                 } catch (IOException ie) {  
98.                 }  
99.             }  
100.         }  
101.     }  
102.   
103.       
104.     private PrivateKey loadRootPrivateKeyByKeyFile() {  
105.         BufferedInputStream privateIn = null;  
106.         ByteArrayOutputStream privateByteOut = null;  
107.         try {  
108.               
109.             privateIn = (BufferedInputStream) rootKeyFilePath.getInputStream();  
110.             privateByteOut = new ByteArrayOutputStream();  
111.             int len = 0;  
112.             while ((len = privateIn.read()) != -1) {  
113.                 privateByteOut.write(len);  
114.             }  
115.             byte[] privateBytes = privateByteOut.toByteArray();  
116.               
117.             PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateBytes);  
118.             KeyFactory keyFactory = KeyFactory.getInstance("RSA");  
119.             PrivateKey rootPrivateKey = keyFactory.generatePrivate(keySpec);  
120.   
121.             return rootPrivateKey;  
122.         } catch (Exception e) {  
123.             throw new RuntimeException(e.getMessage(), e);  
124.         } finally {  
125.             if (privateIn != null) {  
126.                 try {  
127.                     privateIn.close();  
128.                 } catch (IOException ie) {  
129.                 }  
130.             }  
131.             if (privateByteOut != null) {  
132.                 try {  
133.                     privateByteOut.close();  
134.                 } catch (IOException ie) {  
135.                 }  
136.             }  
137.         }  
138.     }  
139.   
140.       
141.     private KeyPair genClientKeyPair() {  
142.         try {  
143.               
144.             KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");  
145.             generator.initialize(2048);  
146.   
147.             return generator.generateKeyPair();  
148.         } catch (Exception e) {  
149.             throw new RuntimeException(e.getMessage(), e);  
150.         }  
151.     }  
152.   
153.       
154.     @SuppressWarnings("unchecked")  
155.     private X509Certificate signCert(PublicKey rootPublicKey, PrivateKey rootPrivateKey, X509Certificate certificate,  
156.             KeyPair clientKeyPair, ClientCert clientCert) throws Exception {  
157.   
158.         Security.addProvider(new BouncyCastleProvider());  
159.   
160.           
161.         Hashtable attrs = new Hashtable();  
162.         Vector order = new Vector();  
163.   
164.         attrs.put(X509Principal.C, clientCert.getCountryCode());  
165.         attrs.put(X509Principal.O, clientCert.getOrganizationCode());  
166.         attrs.put(X509Principal.OU, clientCert.getOrganizationalName());  
167.         attrs.put(X509Principal.CN, clientCert.getCommonName());  
168.         attrs.put(X509Principal.L, clientCert.getCityName());  
169.         attrs.put(X509Principal.ST, clientCert.getProvinceName());  
170.   
171.         order.addElement(X509Principal.CN);  
172.         order.addElement(X509Principal.OU);  
173.         order.addElement(X509Principal.O);  
174.         order.addElement(X509Principal.L);  
175.         order.addElement(X509Principal.ST);  
176.         order.addElement(X509Principal.C);  
177.   
178.         X509V3CertificateGenerator _v3CertGenerator = new X509V3CertificateGenerator();  
179.   
180.         _v3CertGenerator.reset();  
181.   
182.         Date beginDate = new Date();  
183.           
184.         _v3CertGenerator.setSerialNumber(BigInteger.valueOf(serialNumber));  
185.           
186.         _v3CertGenerator.setIssuerDN(certificate.getIssuerX500Principal());  
187.           
188.         _v3CertGenerator.setNotBefore(new Date());  
189.           
190.         _v3CertGenerator.setNotAfter(new Date(beginDate.getTime() + 730 * 24 * 60 * 60 * 1000L));  
191.           
192.         _v3CertGenerator.setSubjectDN(new X509Principal(order, attrs));  
193.         _v3CertGenerator.setPublicKey(clientKeyPair.getPublic());  
194.         _v3CertGenerator.setSignatureAlgorithm("SHA1withRSA");  
195.   
196.           
197.         _v3CertGenerator.addExtension(X509Extensions.SubjectKeyIdentifier, false,  
198.                 createSubjectKeyIdentifier(clientKeyPair.getPublic()));  
199.           
200.         _v3CertGenerator.addExtension(X509Extensions.AuthorityKeyIdentifier, false,  
201.                 createAuthorityKeyIdentifier(rootPublicKey));  
202.         _v3CertGenerator.addExtension(X509Extensions.BasicConstraints, false, new BasicConstraints(false));  
203.   
204.           
205.         X509Certificate cert = _v3CertGenerator.generate(rootPrivateKey, "BC");  
206.   
207.           
208.         cert.checkValidity(new Date());  
209.         cert.verify(rootPublicKey);  
210.   
211.         return cert;  
212.     }  
213.   
214.   
215.     @SuppressWarnings("deprecation")  
216.     public AuthorityKeyIdentifier createAuthorityKeyIdentifier(PublicKey rootPublicKey) {  
217.         try {  
218.             ByteArrayInputStream bIn = new ByteArrayInputStream(rootPublicKey.getEncoded());  
219.             SubjectPublicKeyInfo info = new SubjectPublicKeyInfo((ASN1Sequence) new DERInputStream(bIn).readObject());  
220.             return new AuthorityKeyIdentifier(info);  
221.         } catch (Exception e) {  
222.             throw new RuntimeException(e.getMessage(), e);  
223.         }  
224.     }  
225.   
226.   
227.     @SuppressWarnings("deprecation")  
228.     public SubjectKeyIdentifier createSubjectKeyIdentifier(PublicKey clientPublicKey) {  
229.         try {  
230.             ByteArrayInputStream bIn = new ByteArrayInputStream(clientPublicKey.getEncoded());  
231.             SubjectPublicKeyInfo info = new SubjectPublicKeyInfo((ASN1Sequence) new DERInputStream(bIn).readObject());  
232.             return new SubjectKeyIdentifier(info);  
233.         } catch (Exception e) {  
234.             throw new RuntimeException(e.getMessage(), e);  
235.         }  
236.     }  
237.   
238.     public Resource getRootCertFilePath() {  
239.         return rootCertFilePath;  
240.     }  
241.   
242.     public void setRootCertFilePath(Resource rootCertFilePath) {  
243.         this.rootCertFilePath = rootCertFilePath;  
244.     }  
245.   
246.     public Resource getRootKeyFilePath() {  
247.         return rootKeyFilePath;  
248.     }  
249.   
250.     public void setRootKeyFilePath(Resource rootKeyFilePath) {  
251.         this.rootKeyFilePath = rootKeyFilePath;  
252.     }  
253.   
254.     public int getSerialNumber() {  
255.         return serialNumber;  
256.     }  
257.   
258.     public void setSerialNumber(int serialNumber) {  
259.         this.serialNumber = serialNumber;  
260.     }  
261.   
262. }