Java X500Name类代码示例

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
public void setupHTTPSCertificate() {
    try {
        // Get the existing private/public keypair to use for the HTTPS cert
        KeyPair kerplappKeypair = getKerplappKeypair();

        /*
         * Once we have an IP address, that can be used as the hostname. We
         * can generate a self signed cert with a valid CN field to stash
         * into the keystore in a predictable place. If the IP address
         * changes we should run this method again to stomp old
         * HTTPS_CERT_ALIAS entries.
         */
        X500Name subject = new X500Name("CN=" + FDroidApp.ipAddressString);
        Certificate indexCert = generateSelfSignedCertChain(kerplappKeypair, subject,
                FDroidApp.ipAddressString);
        addToStore(HTTP_CERT_ALIAS, kerplappKeypair, indexCert);
    } catch (Exception e) {
        Log.e(TAG, "Failed to setup HTTPS certificate", e);
    }
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
public String getValueByObjectIdentifier(ASN1ObjectIdentifier identifier) {
    X500Name x500name = null;
    try {
        x500name = new JcaX509CertificateHolder(certificate).getSubject();
    } catch (CertificateEncodingException e) {
        Timber.e(e, "Error getting value by ASN1 Object identifier");
    }
    if (x500name == null) {
        return null;
    }
    RDN[] rdNs = x500name.getRDNs(identifier);
    if (rdNs.length == 0) {
        return null;
    }
    RDN c = rdNs[0];
    return IETFUtils.valueToString(c.getFirst().getValue());
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
public void setupHTTPSCertificate() {
    try {
        // Get the existing private/public keypair to use for the HTTPS cert
        KeyPair kerplappKeypair = getKerplappKeypair();

        /*
         * Once we have an IP address, that can be used as the hostname. We
         * can generate a self signed cert with a valid CN field to stash
         * into the keystore in a predictable place. If the IP address
         * changes we should run this method again to stomp old
         * HTTPS_CERT_ALIAS entries.
         */
        X500Name subject = new X500Name("CN=" + FDroidApp.ipAddressString);
        Certificate indexCert = generateSelfSignedCertChain(kerplappKeypair, subject,
                FDroidApp.ipAddressString);
        addToStore(HTTP_CERT_ALIAS, kerplappKeypair, indexCert);
    } catch (Exception e) {
        Log.e(TAG, "Failed to setup HTTPS certificate: " + e);
        Log.e(TAG, Log.getStackTraceString(e));
    }
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
private @Nullable String getNameFromCert(TrustAnchor rootAuthority) throws PaymentRequestException.PkiVerificationException {
    org.spongycastle.asn1.x500.X500Name name = new X500Name(rootAuthority.getTrustedCert().getSubjectX500Principal().getName());
    String commonName = null, org = null, location = null, country = null;
    for (RDN rdn : name.getRDNs()) {
        AttributeTypeAndValue pair = rdn.getFirst();
        String val = ((ASN1String)pair.getValue()).getString();
        if (pair.getType().equals(RFC4519Style.cn))
            commonName = val;
        else if (pair.getType().equals(RFC4519Style.o))
            org = val;
        else if (pair.getType().equals(RFC4519Style.l))
            location = val;
        else if (pair.getType().equals(RFC4519Style.c))
            country = val;
    }
    if (org != null) {
        return Joiner.on(", ").skipNulls().join(org, location, country);
    } else {
        return commonName;
    }
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
/**
 * Create the certificate signing request (CSR) from private and public keys
 *
 * @param keyPair the KeyPair with private and public keys
 * @return PKCS10CertificationRequest with the certificate signing request
 *         (CSR) data
 * @throws IOException
 * @throws OperatorCreationException
 */
public static PKCS10CertificationRequest generateCSR(KeyPair keyPair) throws IOException,
        OperatorCreationException {
    String principal = "CN=AWS IoT Certificate" + ", O=Amazon";
    AsymmetricKeyParameter privateKey = PrivateKeyFactory.createKey(keyPair.getPrivate()
            .getEncoded());
    AlgorithmIdentifier signatureAlgorithm = new DefaultSignatureAlgorithmIdentifierFinder()
            .find("SHA1WITHRSA");
    AlgorithmIdentifier digestAlgorithm = new DefaultDigestAlgorithmIdentifierFinder()
            .find("SHA-1");
    ContentSigner signer = new BcRSAContentSignerBuilder(signatureAlgorithm, digestAlgorithm)
            .build(privateKey);

    PKCS10CertificationRequestBuilder csrBuilder = new JcaPKCS10CertificationRequestBuilder(
            new X500Name(principal), keyPair.getPublic());
    ExtensionsGenerator extensionsGenerator = new ExtensionsGenerator();
    extensionsGenerator.addExtension(Extension.basicConstraints, true, new BasicConstraints(
            true));
    csrBuilder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest,
            extensionsGenerator.generate());
    PKCS10CertificationRequest csr = csrBuilder.build(signer);

    return csr;
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
private Certificate generateSelfSignedCertChain(KeyPair kp, X500Name subject, String hostname)
        throws CertificateException, OperatorCreationException, IOException {
    SecureRandom rand = new SecureRandom();
    PrivateKey privKey = kp.getPrivate();
    PublicKey pubKey = kp.getPublic();
    ContentSigner sigGen = new JcaContentSignerBuilder(DEFAULT_SIG_ALG).build(privKey);

    SubjectPublicKeyInfo subPubKeyInfo = new SubjectPublicKeyInfo(
            ASN1Sequence.getInstance(pubKey.getEncoded()));

    Date now = new Date(); // now

    /* force it to use a English/Gregorian dates for the cert, hardly anyone
       ever looks at the cert metadata anyway, and its very likely that they
       understand English/Gregorian dates */
    Calendar c = new GregorianCalendar(Locale.ENGLISH);
    c.setTime(now);
    c.add(Calendar.YEAR, 1);
    Time startTime = new Time(now, Locale.ENGLISH);
    Time endTime = new Time(c.getTime(), Locale.ENGLISH);

    X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
            subject,
            BigInteger.valueOf(rand.nextLong()),
            startTime,
            endTime,
            subject,
            subPubKeyInfo);

    if (hostname != null) {
        GeneralNames subjectAltName = new GeneralNames(
                new GeneralName(GeneralName.iPAddress, hostname));
        v3CertGen.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
    }

    X509CertificateHolder certHolder = v3CertGen.build(sigGen);
    return new JcaX509CertificateConverter().getCertificate(certHolder);
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
/**
 * Returns either a string that "sums up" the certificate for humans, in a similar manner to what you might see
 * in a web browser, or null if one cannot be extracted. This will typically be the common name (CN) field, but
 * can also be the org (O) field, org+location+country if withLocation is set, or the email
 * address for S/MIME certificates.
 */
@Nullable
public static String getDisplayNameFromCertificate(@Nonnull X509Certificate certificate, boolean withLocation) throws CertificateParsingException {
    X500Name name = new X500Name(certificate.getSubjectX500Principal().getName());
    String commonName = null, org = null, location = null, country = null;
    for (RDN rdn : name.getRDNs()) {
        AttributeTypeAndValue pair = rdn.getFirst();
        String val = ((ASN1String) pair.getValue()).getString();
        ASN1ObjectIdentifier type = pair.getType();
        if (type.equals(RFC4519Style.cn))
            commonName = val;
        else if (type.equals(RFC4519Style.o))
            org = val;
        else if (type.equals(RFC4519Style.l))
            location = val;
        else if (type.equals(RFC4519Style.c))
            country = val;
    }
    final Collection<List<?>> subjectAlternativeNames = certificate.getSubjectAlternativeNames();
    String altName = null;
    if (subjectAlternativeNames != null)
        for (final List<?> subjectAlternativeName : subjectAlternativeNames)
            if ((Integer) subjectAlternativeName.get(0) == 1) // rfc822name
                altName = (String) subjectAlternativeName.get(1);

    if (org != null) {
        return withLocation ? Joiner.on(", ").skipNulls().join(org, location, country) : org;
    } else if (commonName != null) {
        return commonName;
    } else {
        return altName;
    }
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
/**
 * Returns either a string that "sums up" the certificate for humans, in a similar manner to what you might see
 * in a web browser, or null if one cannot be extracted. This will typically be the common name (CN) field, but
 * can also be the org (O) field, org+location+country if withLocation is set, or the email
 * address for S/MIME certificates.
 */
public static @Nullable String getDisplayNameFromCertificate(@Nonnull X509Certificate certificate, boolean withLocation) throws CertificateParsingException {
    X500Name name = new X500Name(certificate.getSubjectX500Principal().getName());
    String commonName = null, org = null, location = null, country = null;
    for (RDN rdn : name.getRDNs()) {
        AttributeTypeAndValue pair = rdn.getFirst();
        String val = ((ASN1String) pair.getValue()).getString();
        ASN1ObjectIdentifier type = pair.getType();
        if (type.equals(RFC4519Style.cn))
            commonName = val;
        else if (type.equals(RFC4519Style.o))
            org = val;
        else if (type.equals(RFC4519Style.l))
            location = val;
        else if (type.equals(RFC4519Style.c))
            country = val;
    }
    final Collection<List<?>> subjectAlternativeNames = certificate.getSubjectAlternativeNames();
    String altName = null;
    if (subjectAlternativeNames != null)
        for (final List<?> subjectAlternativeName : subjectAlternativeNames)
            if ((Integer) subjectAlternativeName.get(0) == 1) // rfc822name
                altName = (String) subjectAlternativeName.get(1);

    if (org != null) {
        return withLocation ? Joiner.on(", ").skipNulls().join(org, location, country) : org;
    } else if (commonName != null) {
        return commonName;
    } else {
        return altName;
    }
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
private static String commonNameFromX500Name(X500Name name) {
    String commonName = "";
    RDN[] rdns = name.getRDNs(BCStyle.CN);
    if (rdns == null || rdns.length == 0)
        return commonName;
    commonName = IETFUtils.valueToString(rdns[0].getFirst().getValue());
    return commonName;
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
private Certificate generateSelfSignedCertChain(KeyPair kp, X500Name subject, String hostname)
        throws CertificateException, OperatorCreationException, IOException {
    SecureRandom rand = new SecureRandom();
    PrivateKey privKey = kp.getPrivate();
    PublicKey pubKey = kp.getPublic();
    ContentSigner sigGen = new JcaContentSignerBuilder(DEFAULT_SIG_ALG).build(privKey);

    SubjectPublicKeyInfo subPubKeyInfo = new SubjectPublicKeyInfo(
            ASN1Sequence.getInstance(pubKey.getEncoded()));

    Date startDate = new Date(); // now

    Calendar c = Calendar.getInstance();
    c.setTime(startDate);
    c.add(Calendar.YEAR, 1);
    Date endDate = c.getTime();

    X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
            subject,
            BigInteger.valueOf(rand.nextLong()),
            startDate, endDate,
            subject,
            subPubKeyInfo);

    if (hostname != null) {
        GeneralNames subjectAltName = new GeneralNames(
                new GeneralName(GeneralName.iPAddress, hostname));
        v3CertGen.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
    }

    X509CertificateHolder certHolder = v3CertGen.build(sigGen);
    return new JcaX509CertificateConverter().getCertificate(certHolder);
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
/**
 * Generates a short-living certificate for the keyPair.
 */
private X509Certificate generateCertificate() throws NoSuchProviderException, NoSuchAlgorithmException, CertificateException, SignatureException, InvalidKeyException, IOException, OperatorCreationException {
    /* The certificate starts to be valid one minute in the past to be safe
     * if the clocks are a bit out of sync. */
    Calendar startDate = Calendar.getInstance();
    startDate.add(Calendar.MINUTE, -1);
    /* The certificate is not valid anymore after two minutes. This should
     * be enough to complete the protocol. */
    Calendar expiryDate = Calendar.getInstance();
    expiryDate.add(Calendar.MINUTE, +2);
    AlgorithmIdentifier sha1withRSA = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA");
    ContentSigner signer = new BcRSAContentSignerBuilder(
            new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA"),
            new DefaultDigestAlgorithmIdentifierFinder().find(sha1withRSA))
            .build(keyPair.getPrivate());
    X500Name subjectName = new X500Name("CN=Wallet Protocol Server Ephemeral Certificate");
    BcX509v3CertificateBuilder certBuilder = new BcX509v3CertificateBuilder(
            subjectName,
            BigInteger.ONE,
            startDate.getTime(), expiryDate.getTime(),
            subjectName,
            keyPair.getPublic()
    );
    X509CertificateHolder certHolder = certBuilder.build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().getCertificate(certHolder);
    return cert;
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
public static X509Certificate generateCertificate(OutputStream output) throws NoSuchAlgorithmException, OperatorCreationException, CertificateException, KeyStoreException, NoSuchProviderException, IOException {
	BouncyCastleProvider provider = new BouncyCastleProvider(); // Use SpongyCastle provider, supports creating X509 certs
	KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
	generator.initialize(2048, new SecureRandom());
	
	KeyPair keyPair = generator.generateKeyPair();
	
	SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
	ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider(provider).build(keyPair.getPrivate());
	
	Date startDate = new Date();
	Calendar calendar = Calendar.getInstance();
	calendar.setTime(startDate);
	calendar.add(Calendar.YEAR, YEARS_VALID);
    Date endDate = calendar.getTime();
	
	X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(new X500Name(ISSUER),
			BigInteger.ONE, 
			startDate, endDate, new X500Name(ISSUER),
			publicKeyInfo);

	X509CertificateHolder certificateHolder = certBuilder.build(signer);
	
	X509Certificate certificate = new JcaX509CertificateConverter().setProvider(provider).getCertificate(certificateHolder);
	
	KeyStore keyStore = KeyStore.getInstance("PKCS12", provider);
	keyStore.load(null, null);
	keyStore.setKeyEntry("Jumble Key", keyPair.getPrivate(), null, new X509Certificate[] { certificate });
	
	keyStore.store(output, "".toCharArray());
	
	return certificate;
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
/**
 * @param certificate certificate
 * @return common name
 * @throws IllegalArgumentException if certificate is incorrect type
 */
@NonNull
public static String getCommonName(Certificate certificate) {
    assertX509Certificate(certificate);
    String result = null;
    try {
        X500Name x500name = new JcaX509CertificateHolder((X509Certificate) certificate).getSubject();
        RDN cn = x500name.getRDNs(BCStyle.CN)[0];
        result = IETFUtils.valueToString(cn.getFirst().getValue());
    } catch (CertificateEncodingException ignored) {
    }

    return (result == null) ? "" : result;
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
public static void generateSelfSignedCertificate() throws Exception {
    String alias = "nuntius";
    KeyStore ks = KeyStore.getInstance("AndroidKeyStore");
    ks.load(null);
    Enumeration<String> aliases = ks.aliases();
    boolean found = false;
    while (aliases.hasMoreElements()) {
        String currentAlias = aliases.nextElement();
        if (alias.equals(currentAlias)) {
            found = true;
            Log.i(TAG, "Self Signed Certificate found in keystore");
            Key key = ks.getKey(alias, pwd);
            Log.i(TAG, "Key: " + key);
            Certificate certificate = ks.getCertificate(alias);
            Log.i(TAG, "Certificate: " + certificate);
        }
    }

    if (found) {
        return;
    }

    Log.i(TAG, "Self Signed Certificate not found in keystore. Generating a new one...");

    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
    keyGen.initialize(1024);
    KeyPair keyPair = keyGen.generateKeyPair();

    X500Name subject = new X500Name("CN=nuntius");
    X500Name issuer = subject ;

    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
            issuer,
            new BigInteger(64, new SecureRandom()),
            NOT_BEFORE,
            NOT_AFTER,
            subject,
            keyPair.getPublic());

    ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(keyPair.getPrivate());
    X509CertificateHolder certHolder = builder.build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(certHolder);
    cert.verify(keyPair.getPublic());

    Log.i(TAG, "Certificate generated: " + cert);

    ks.setKeyEntry(alias, keyPair.getPrivate(), pwd, new Certificate[] { cert });
}
 

import org.spongycastle.asn1.x500.X500Name; //导入依赖的package包/类
/**
 * Create a self-signed X.509 Certificate
 *
 * @param dn the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
 */
private X509Certificate generateCertificate(String dn) throws Exception {

    X500Name x500nameIssuer = new X500Name("CN=TestCA,L=Den Haag, C=NL");
    X500Name x500nameSubject = new X500Name(dn);
    BigInteger serial = new BigInteger(64, new Random());
    Date notBefore = new Date();

    // Set Expiration Date
    Calendar tempCal = Calendar.getInstance();
    tempCal.setTime(notBefore);
    tempCal.add(Calendar.DATE, 365);
    Date notAfter = tempCal.getTime();

    // Create Pubkey
    RSAKeyPairGenerator keyGen = new RSAKeyPairGenerator();
    keyGen.init(new RSAKeyGenerationParameters(new BigInteger("10001", 16), SecureRandom.getInstance("SHA1PRNG"), 1024, 80));
    AsymmetricCipherKeyPair keys = keyGen.generateKeyPair();
    SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(keys.getPublic());

    X509v3CertificateBuilder builder = new X509v3CertificateBuilder(
            x500nameIssuer,
            serial,
            notBefore,
            notAfter,
            Locale.US,
            x500nameSubject,
            subPubKeyInfo
    );

    try {
        // Export Private Key Info into Java PrivateKey
        BigInteger modulus = ((RSAKeyParameters) keys.getPrivate()).getModulus();
        BigInteger exponent = ((RSAKeyParameters) keys.getPrivate()).getExponent();
        RSAPrivateKeySpec privateSpec = new RSAPrivateKeySpec(modulus, exponent);
        KeyFactory factory = KeyFactory.getInstance("RSA");

        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").build(factory.generatePrivate(privateSpec));

        X509CertificateHolder holder = builder.build(sigGen);
        InputStream is = new ByteArrayInputStream(holder.toASN1Structure().getEncoded());
        return (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(is);

    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }

    throw new Exception("Unable to Create Test X509 Cert");
}