Java JcaX509CertificateConverter类代码示例

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
private Certificate generateSelfSignedCertChain(KeyPair kp, X500Name subject, String hostname)
        throws CertificateException, OperatorCreationException, IOException {
    SecureRandom rand = new SecureRandom();
    PrivateKey privKey = kp.getPrivate();
    PublicKey pubKey = kp.getPublic();
    ContentSigner sigGen = new JcaContentSignerBuilder(DEFAULT_SIG_ALG).build(privKey);

    SubjectPublicKeyInfo subPubKeyInfo = new SubjectPublicKeyInfo(
            ASN1Sequence.getInstance(pubKey.getEncoded()));

    Date now = new Date(); // now

    /* force it to use a English/Gregorian dates for the cert, hardly anyone
       ever looks at the cert metadata anyway, and its very likely that they
       understand English/Gregorian dates */
    Calendar c = new GregorianCalendar(Locale.ENGLISH);
    c.setTime(now);
    c.add(Calendar.YEAR, 1);
    Time startTime = new Time(now, Locale.ENGLISH);
    Time endTime = new Time(c.getTime(), Locale.ENGLISH);

    X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
            subject,
            BigInteger.valueOf(rand.nextLong()),
            startTime,
            endTime,
            subject,
            subPubKeyInfo);

    if (hostname != null) {
        GeneralNames subjectAltName = new GeneralNames(
                new GeneralName(GeneralName.iPAddress, hostname));
        v3CertGen.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
    }

    X509CertificateHolder certHolder = v3CertGen.build(sigGen);
    return new JcaX509CertificateConverter().getCertificate(certHolder);
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
public void setCertificate(byte[] certificateBytes){
    try {
        X509CertificateHolder certificateHolder = new X509CertificateHolder(certificateBytes);
        this.certificate = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
    } catch (Exception e) {
        Log.e("Server", "setCertificate");
        Log.e("StackTrace", Log.getStackTraceString(e));
    }
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
static void initialiseCertificate(Context c, KeyPair keyPair){
    Calendar calendar = Calendar.getInstance();
    calendar.add(Calendar.DAY_OF_MONTH, -1);
    Date notBefore = calendar.getTime();
    calendar.add(Calendar.YEAR, 10);
    Date notAfter = calendar.getTime();

    X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
    nameBuilder.addRDN(BCStyle.CN, "an2linuxclient");
    nameBuilder.addRDN(BCStyle.SERIALNUMBER, new BigInteger(128, new Random()).toString(16));

    X509v3CertificateBuilder certificateBuilder = new JcaX509v3CertificateBuilder(
            nameBuilder.build(),
            BigInteger.ONE,
            notBefore, notAfter,
            nameBuilder.build(),
            keyPair.getPublic()
    );
    try {
        ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider("BC").build(keyPair.getPrivate());
        X509Certificate certificate = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateBuilder.build(contentSigner));

        SharedPreferences deviceKeyPref = c.getSharedPreferences(
                c.getString(R.string.device_key_and_cert), MODE_PRIVATE);
        deviceKeyPref.edit().putString(c.getString(R.string.certificate),
                Base64.encodeToString(certificate.getEncoded(), Base64.NO_WRAP)).apply();
        Log.d("TlsHelper", "Generated new certificate successfully");
    } catch (Exception e){
        Log.e("TlsHelper", "initialiseCertificate");
        Log.e("StackTrace", Log.getStackTraceString(e));
    }
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
private static X509Certificate getCertificate(Context c){
    SharedPreferences deviceKeyPref = c.getSharedPreferences(c.getString(R.string.device_key_and_cert), MODE_PRIVATE);
    try {
        byte[] certificateBytes = Base64.decode(deviceKeyPref.getString(c.getString(R.string.certificate), ""), Base64.DEFAULT);
        X509CertificateHolder certificateHolder = new X509CertificateHolder(certificateBytes);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
    } catch (Exception e) {
        Log.e("TlsHelper", "getCertificate");
        Log.e("StackTrace", Log.getStackTraceString(e));
        return null;
    }
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
public static X509Certificate generateSignedCertificate(X509Certificate caCertificate, PrivateKey caPrivateKey, PublicKey publicKey, String CN) 
		throws NoSuchAlgorithmException, OperatorCreationException, CertificateException, 
		KeyStoreException, UnrecoverableKeyException, IOException, 
		InvalidKeyException, NoSuchPaddingException, InvalidParameterSpecException, 
		InvalidKeySpecException, InvalidAlgorithmParameterException, IllegalBlockSizeException, 
		BadPaddingException {

	X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);

	builder.addRDN(BCStyle.CN, CN);

	// We want this root certificate to be valid for one year
	Calendar calendar = Calendar.getInstance();
	calendar.add(Calendar.YEAR, 1);

	ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider(BC).build(caPrivateKey);
	X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(
			caCertificate, 
			new BigInteger(80, new Random()), 
			new Date(System.currentTimeMillis() - 50000),
			calendar.getTime(),
			new X500Principal(builder.build().getEncoded()),
			publicKey);

	// Those are the extensions needed for the certificate to be a leaf certificate that authenticates a SSL server
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.15"), true, new X509KeyUsage(X509KeyUsage.keyEncipherment));
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.37"), true, new DERSequence(KeyPurposeId.id_kp_serverAuth));

	X509CertificateHolder certificateHolder = certGen.build(sigGen);
	X509Certificate certificate = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certificateHolder);

	return certificate;

}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
public static X509Certificate generateRootCertificate(KeyPair keys, String CN) 
		throws NoSuchAlgorithmException, OperatorCreationException, CertificateException, 
		KeyStoreException, UnrecoverableKeyException, IOException, 
		InvalidKeyException, NoSuchPaddingException, InvalidParameterSpecException, 
		InvalidKeySpecException, InvalidAlgorithmParameterException, IllegalBlockSizeException, 
		BadPaddingException {

	X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);

	builder.addRDN(BCStyle.CN, CN);

	// We want this root certificate to be valid for one year 
	Calendar calendar = Calendar.getInstance();
	calendar.add( Calendar.YEAR, 1 );

	ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider(BC).build(keys.getPrivate());
	X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(
			builder.build(), 
			new BigInteger(80, new Random()), 
			new Date(System.currentTimeMillis() - 50000),
			calendar.getTime(),
			builder.build(),
			keys.getPublic());

	// Those are the extensions needed for a CA certificate
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.19"), true, new BasicConstraints(true));
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.15"), true, new X509KeyUsage(X509KeyUsage.digitalSignature));
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.37"), true, new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));

	X509CertificateHolder certificateHolder = certGen.build(sigGen);

	X509Certificate certificate = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certificateHolder);

	return certificate;

}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
private Certificate generateSelfSignedCertChain(KeyPair kp, X500Name subject, String hostname)
        throws CertificateException, OperatorCreationException, IOException {
    SecureRandom rand = new SecureRandom();
    PrivateKey privKey = kp.getPrivate();
    PublicKey pubKey = kp.getPublic();
    ContentSigner sigGen = new JcaContentSignerBuilder(DEFAULT_SIG_ALG).build(privKey);

    SubjectPublicKeyInfo subPubKeyInfo = new SubjectPublicKeyInfo(
            ASN1Sequence.getInstance(pubKey.getEncoded()));

    Date startDate = new Date(); // now

    Calendar c = Calendar.getInstance();
    c.setTime(startDate);
    c.add(Calendar.YEAR, 1);
    Date endDate = c.getTime();

    X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
            subject,
            BigInteger.valueOf(rand.nextLong()),
            startDate, endDate,
            subject,
            subPubKeyInfo);

    if (hostname != null) {
        GeneralNames subjectAltName = new GeneralNames(
                new GeneralName(GeneralName.iPAddress, hostname));
        v3CertGen.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
    }

    X509CertificateHolder certHolder = v3CertGen.build(sigGen);
    return new JcaX509CertificateConverter().getCertificate(certHolder);
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
/**
 * Generates a short-living certificate for the keyPair.
 */
private X509Certificate generateCertificate() throws NoSuchProviderException, NoSuchAlgorithmException, CertificateException, SignatureException, InvalidKeyException, IOException, OperatorCreationException {
    /* The certificate starts to be valid one minute in the past to be safe
     * if the clocks are a bit out of sync. */
    Calendar startDate = Calendar.getInstance();
    startDate.add(Calendar.MINUTE, -1);
    /* The certificate is not valid anymore after two minutes. This should
     * be enough to complete the protocol. */
    Calendar expiryDate = Calendar.getInstance();
    expiryDate.add(Calendar.MINUTE, +2);
    AlgorithmIdentifier sha1withRSA = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA");
    ContentSigner signer = new BcRSAContentSignerBuilder(
            new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA"),
            new DefaultDigestAlgorithmIdentifierFinder().find(sha1withRSA))
            .build(keyPair.getPrivate());
    X500Name subjectName = new X500Name("CN=Wallet Protocol Server Ephemeral Certificate");
    BcX509v3CertificateBuilder certBuilder = new BcX509v3CertificateBuilder(
            subjectName,
            BigInteger.ONE,
            startDate.getTime(), expiryDate.getTime(),
            subjectName,
            keyPair.getPublic()
    );
    X509CertificateHolder certHolder = certBuilder.build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().getCertificate(certHolder);
    return cert;
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
public static X509Certificate generateCertificate(OutputStream output) throws NoSuchAlgorithmException, OperatorCreationException, CertificateException, KeyStoreException, NoSuchProviderException, IOException {
	BouncyCastleProvider provider = new BouncyCastleProvider(); // Use SpongyCastle provider, supports creating X509 certs
	KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
	generator.initialize(2048, new SecureRandom());
	
	KeyPair keyPair = generator.generateKeyPair();
	
	SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
	ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider(provider).build(keyPair.getPrivate());
	
	Date startDate = new Date();
	Calendar calendar = Calendar.getInstance();
	calendar.setTime(startDate);
	calendar.add(Calendar.YEAR, YEARS_VALID);
    Date endDate = calendar.getTime();
	
	X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(new X500Name(ISSUER),
			BigInteger.ONE, 
			startDate, endDate, new X500Name(ISSUER),
			publicKeyInfo);

	X509CertificateHolder certificateHolder = certBuilder.build(signer);
	
	X509Certificate certificate = new JcaX509CertificateConverter().setProvider(provider).getCertificate(certificateHolder);
	
	KeyStore keyStore = KeyStore.getInstance("PKCS12", provider);
	keyStore.load(null, null);
	keyStore.setKeyEntry("Jumble Key", keyPair.getPrivate(), null, new X509Certificate[] { certificate });
	
	keyStore.store(output, "".toCharArray());
	
	return certificate;
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
public static void generateSelfSignedCertificate() throws Exception {
    String alias = "nuntius";
    KeyStore ks = KeyStore.getInstance("AndroidKeyStore");
    ks.load(null);
    Enumeration<String> aliases = ks.aliases();
    boolean found = false;
    while (aliases.hasMoreElements()) {
        String currentAlias = aliases.nextElement();
        if (alias.equals(currentAlias)) {
            found = true;
            Log.i(TAG, "Self Signed Certificate found in keystore");
            Key key = ks.getKey(alias, pwd);
            Log.i(TAG, "Key: " + key);
            Certificate certificate = ks.getCertificate(alias);
            Log.i(TAG, "Certificate: " + certificate);
        }
    }

    if (found) {
        return;
    }

    Log.i(TAG, "Self Signed Certificate not found in keystore. Generating a new one...");

    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
    keyGen.initialize(1024);
    KeyPair keyPair = keyGen.generateKeyPair();

    X500Name subject = new X500Name("CN=nuntius");
    X500Name issuer = subject ;

    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
            issuer,
            new BigInteger(64, new SecureRandom()),
            NOT_BEFORE,
            NOT_AFTER,
            subject,
            keyPair.getPublic());

    ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(keyPair.getPrivate());
    X509CertificateHolder certHolder = builder.build(signer);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(certHolder);
    cert.verify(keyPair.getPublic());

    Log.i(TAG, "Certificate generated: " + cert);

    ks.setKeyEntry(alias, keyPair.getPrivate(), pwd, new Certificate[] { cert });
}
 

import org.spongycastle.cert.jcajce.JcaX509CertificateConverter; //导入依赖的package包/类
public static Certificate parseCertificate(byte[] certificateBytes) throws IOException, CertificateException {
    X509CertificateHolder certificateHolder = new X509CertificateHolder(certificateBytes);
    return new JcaX509CertificateConverter().setProvider(BC).getCertificate(certificateHolder);
}