Java GeneralName.dNSName方法代碼示例

import org.bouncycastle.asn1.x509.GeneralName; //導入方法依賴的package包/類
public SubjectAlternativeNameImpl(X509Certificate cert) throws IOException {
	DNSNames = new ArrayList<>();
	byte[] extVal = cert.getExtensionValue(Extension.subjectAlternativeName.getId());
	if (extVal == null)
		return;
	GeneralNames gn = GeneralNames.getInstance(X509ExtensionUtil.fromExtensionValue(extVal));
	GeneralName[] names = gn.getNames();
	for (GeneralName name : names) {
		if (name.getTagNo() == GeneralName.dNSName) {
			String dns = name.getName().toString();
			DNSNames.add(dns);
		}
	}
}
 

import org.bouncycastle.asn1.x509.GeneralName; //導入方法依賴的package包/類
public static X500PrivateCredential generateServerCertificate(KeyPair caKeyPair) throws NoSuchAlgorithmException, CertificateException, OperatorCreationException, CertIOException {
    X500Name issuerName = new X500Name("CN=bouncrca");
    X500Name subjectName = new X500Name("CN=bouncr");
    BigInteger serial = BigInteger.valueOf(2);
    long t1 = System.currentTimeMillis();
    KeyPairGenerator rsa = KeyPairGenerator.getInstance("RSA");
    rsa.initialize(2048, SecureRandom.getInstance("NativePRNGNonBlocking"));
    KeyPair kp = rsa.generateKeyPair();
    System.out.println(System.currentTimeMillis() - t1);

    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerName, serial, NOT_BEFORE, NOT_AFTER, subjectName, kp.getPublic());
    DERSequence subjectAlternativeNames = new DERSequence(new ASN1Encodable[] {
            new GeneralName(GeneralName.dNSName, "localhost"),
            new GeneralName(GeneralName.dNSName, "127.0.0.1")
    });
    builder.addExtension(Extension.subjectAlternativeName, false, subjectAlternativeNames);
    X509Certificate cert = signCertificate(builder, caKeyPair.getPrivate());

    return new X500PrivateCredential(cert, kp.getPrivate());
}
 

import org.bouncycastle.asn1.x509.GeneralName; //導入方法依賴的package包/類
/**
 * 動態生成服務器證書,並進行CA簽授
 *
 * @param issuer 頒發機構
 */
public static X509Certificate genCert(String issuer, PrivateKey caPriKey, Date caNotBefore,
    Date caNotAfter, PublicKey serverPubKey,
    String... hosts) throws Exception {
      /* String issuer = "C=CN, ST=GD, L=SZ, O=lee, OU=study, CN=ProxyeeRoot";
      String subject = "C=CN, ST=GD, L=SZ, O=lee, OU=study, CN=" + host;*/
  //根據CA證書subject來動態生成目標服務器證書的issuer和subject
  String subject = "C=CN, ST=GD, L=SZ, O=lee, OU=study, CN=" + hosts[0];
  //doc from https://www.cryptoworkshop.com/guide/
  JcaX509v3CertificateBuilder jv3Builder = new JcaX509v3CertificateBuilder(new X500Name(issuer),
      //issue#3 修複ElementaryOS上證書不安全問題(serialNumber為1時證書會提示不安全)，避免serialNumber衝突，采用時間戳+4位隨機數生成
      BigInteger.valueOf(System.currentTimeMillis() + (long) (Math.random() * 10000) + 1000),
      caNotBefore,
      caNotAfter,
      new X500Name(subject),
      serverPubKey);
  //SAN擴展證書支持的域名，否則瀏覽器提示證書不安全
  GeneralName[] generalNames = new GeneralName[hosts.length];
  for (int i = 0; i < hosts.length; i++) {
    generalNames[i] = new GeneralName(GeneralName.dNSName, hosts[i]);
  }
  GeneralNames subjectAltName = new GeneralNames(generalNames);
  jv3Builder.addExtension(Extension.subjectAlternativeName, false, subjectAltName);
  //SHA256 用SHA1瀏覽器可能會提示證書不安全
  ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(caPriKey);
  return new JcaX509CertificateConverter().getCertificate(jv3Builder.build(signer));
}
 

import org.bouncycastle.asn1.x509.GeneralName; //導入方法依賴的package包/類
private static Collection getAlternativeNames(byte[] extVal)
    throws CertificateParsingException
{
    if (extVal == null)
    {
        return Collections.EMPTY_LIST;
    }
    try
    {
        Collection temp = new ArrayList();
        Enumeration it = DERSequence.getInstance(fromExtensionValue(extVal)).getObjects();
        while (it.hasMoreElements())
        {
            GeneralName genName = GeneralName.getInstance(it.nextElement());
            List list = new ArrayList();
            list.add(Integers.valueOf(genName.getTagNo()));
            switch (genName.getTagNo())
            {
            case GeneralName.ediPartyName:
            case GeneralName.x400Address:
            case GeneralName.otherName:
                list.add(genName.getName().toASN1Primitive());
                break;
            case GeneralName.directoryName:
                list.add(X500Name.getInstance(genName.getName()).toString());
                break;
            case GeneralName.dNSName:
            case GeneralName.rfc822Name:
            case GeneralName.uniformResourceIdentifier:
                list.add(((ASN1String)genName.getName()).getString());
                break;
            case GeneralName.registeredID:
                list.add(ASN1ObjectIdentifier.getInstance(genName.getName()).getId());
                break;
            case GeneralName.iPAddress:
                list.add(DEROctetString.getInstance(genName.getName()).getOctets());
                break;
            default:
                throw new IOException("Bad tag number: " + genName.getTagNo());
            }

            temp.add(list);
        }
        return Collections.unmodifiableCollection(temp);
    }
    catch (Exception e)
    {
        throw new CertificateParsingException(e.getMessage());
    }
}