Java X509v3CertificateBuilder.build方法代碼示例

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public X509Certificate generate(String dn, KeyPair keyPair) throws CertificateException {
    try {
        Security.addProvider(new BouncyCastleProvider());
        AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(algorithm);
        AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
        AsymmetricKeyParameter privateKeyAsymKeyParam = PrivateKeyFactory.createKey(keyPair.getPrivate().getEncoded());
        SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
        ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(privateKeyAsymKeyParam);
        X500Name name = new X500Name(dn);
        Date from = new Date();
        Date to = new Date(from.getTime() + days * 86400000L);
        BigInteger sn = new BigInteger(64, new SecureRandom());
        X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(name, sn, from, to, name, subPubKeyInfo);

        if (subjectAltName != null)
            v3CertGen.addExtension(Extension.subjectAlternativeName, false, subjectAltName);
        X509CertificateHolder certificateHolder = v3CertGen.build(sigGen);
        return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
    } catch (CertificateException ce) {
        throw ce;
    } catch (Exception e) {
        throw new CertificateException(e);
    }
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
private static X509Certificate generateCertificate(KeyPair keyPair)
        throws OperatorCreationException, CertificateException {
  Calendar endCalendar = Calendar.getInstance();
  endCalendar.add(Calendar.YEAR, 10);
  X509v3CertificateBuilder x509v3CertificateBuilder =
          new X509v3CertificateBuilder(new X500Name("CN=localhost"),
                  BigInteger.valueOf(1),
                  Calendar.getInstance().getTime(),
                  endCalendar.getTime(),
                  new X500Name("CN=localhost"),
                  SubjectPublicKeyInfo.getInstance(keyPair.getPublic()
                          .getEncoded()));
  ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA")
          .build(keyPair.getPrivate());
  X509CertificateHolder x509CertificateHolder =
          x509v3CertificateBuilder.build(contentSigner);
  return new JcaX509CertificateConverter().setProvider("BC")
          .getCertificate(x509CertificateHolder);
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public void addSelfSignedCertificate(String certificateAlias, String dn, String password) {
	try {
		KeyPair keys = generateKeyPair();

		Calendar start = Calendar.getInstance();
		Calendar expiry = Calendar.getInstance();
		expiry.add(Calendar.YEAR, 1);
		X500Name name = new X500Name(dn);
		X509v3CertificateBuilder certificateBuilder = new X509v3CertificateBuilder(name, BigInteger.ONE,
				start.getTime(), expiry.getTime(), name, SubjectPublicKeyInfo.getInstance(keys.getPublic().getEncoded()));
		ContentSigner signer = new JcaContentSignerBuilder("SHA1WithRSA").setProvider(new BouncyCastleProvider()).build(keys.getPrivate());
		X509CertificateHolder holder = certificateBuilder.build(signer);
		Certificate cert = new JcaX509CertificateConverter().setProvider(new BouncyCastleProvider()).getCertificate(holder);

		Entry entry = new PrivateKeyEntry(keys.getPrivate(), new Certificate[]{ cert });
		keystore.setEntry(certificateAlias, entry, new PasswordProtection(password.toCharArray()));
	} catch (GeneralSecurityException | OperatorCreationException ex) {
		throw new RuntimeException("Unable to generate self-signed certificate", ex);
	}
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public static X509CertificateHolder makeCertificate(AsymmetricCipherKeyPair subKP, String _subDN, AsymmetricCipherKeyPair issKP, String _issDN, boolean _ca)
    throws IOException, OperatorCreationException
{
    RSAKeyParameters lwPubKey = (RSAKeyParameters)subKP.getPublic();

    X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
        new X500Name(_issDN),
        allocateSerialNumber(),
        new Date(System.currentTimeMillis()),
        new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 100)),
        new X500Name(_subDN),
        new SubjectPublicKeyInfo(new AlgorithmIdentifier(PKCSObjectIdentifiers.rsaEncryption, DERNull.INSTANCE), new RSAPublicKey(lwPubKey.getModulus(), lwPubKey.getExponent()))
    );

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1WithRSAEncryption");
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);

    ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build((AsymmetricKeyParameter)issKP.getPrivate());

    v3CertGen.addExtension(
        X509Extension.basicConstraints,
        false,
        new BasicConstraints(_ca));

    return v3CertGen.build(sigGen);
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public void addKeyPair(String alias, char[] privateKeyPassword, String commonName, String unit, String organization, String location, String state, String country, String emailAdress) throws OperatorCreationException, CertificateException, KeyStoreException, NoSuchAlgorithmException, FileNotFoundException
{
	//generating random KeyPair
	KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
	keyPairGenerator.initialize(2048);
	KeyPair keyPair = keyPairGenerator.generateKeyPair();
	
	//generating certificate for KeyPair
	X500Name issuer = new X500Name("CN="+commonName+",OU="+unit+",O="+organization+",L="+location+",ST="+state+",C="+country+",EmailAddress="+emailAdress);
    BigInteger serial = BigInteger.valueOf(1);
    X500Name subject = issuer;
    PublicKey pubKey = keyPair.getPublic();

    //generate certificate
    X509v3CertificateBuilder generator = new JcaX509v3CertificateBuilder(issuer, serial, new Date(System.currentTimeMillis()),
            new Date(System.currentTimeMillis() + 1000L * 60 * 60 * 24 * 365 * 20), subject, pubKey);
    
    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").build(keyPair.getPrivate());
    X509CertificateHolder certHolder = generator.build(sigGen);
    X509Certificate cert = new JcaX509CertificateConverter().getCertificate( certHolder );
    
    //add certificate
	keystore.setKeyEntry(alias, keyPair.getPrivate(), privateKeyPassword, new Certificate[] {cert});
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public X509CertificateHolder generateCertificate(String subjectName, PublicKey subjectPublicKey, String issuerName, KeyPair issuerKeyPair) {
	try {			
		SubjectPublicKeyInfo subjectPubKeyInfo = generatePublicKeyInfo(subjectPublicKey);
		SubjectPublicKeyInfo issuerPubKeyInfo = generatePublicKeyInfo(issuerKeyPair.getPublic());
		
		X509v3CertificateBuilder v3CertGen = initializeCertificateBuilder(subjectPubKeyInfo, subjectName, issuerName);

		addCRLSitributionPoints(issuerName, v3CertGen);
		addKeyIdentifiers(subjectPubKeyInfo, issuerPubKeyInfo, v3CertGen);
		addAuthorityInformationAccess(issuerName, v3CertGen);

		ContentSigner sigGen = generateContentSignerBuilder(issuerKeyPair.getPrivate());
		X509CertificateHolder certHolder = v3CertGen.build(sigGen);

		return certHolder;

	} catch (Exception e) {
		LOGGER.error("Error while generating certificate: " + e.getMessage());
		throw new RuntimeException("Error while generating certificate", e);
	} 
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
protected void generateCA() throws NoSuchProviderException, NoSuchAlgorithmException, IOException, OperatorCreationException {
    KeyPair pair = generateKey();
    LocalDateTime startDate = LocalDate.now().atStartOfDay();

    X509v3CertificateBuilder builder= new X509v3CertificateBuilder(
            new X500Name("CN=ca"),
            new BigInteger("0"),
            Date.from(startDate.atZone(ZoneId.systemDefault()).toInstant()),
            Date.from(startDate.plusDays(3650).atZone(ZoneId.systemDefault()).toInstant()),
            new X500Name("CN=ca"),
            SubjectPublicKeyInfo.getInstance(pair.getPublic().getEncoded()));
    JcaContentSignerBuilder csBuilder= new JcaContentSignerBuilder("SHA512WithRSAEncryption");
    ContentSigner signer = csBuilder.build(pair.getPrivate());
    X509CertificateHolder holder = builder.build(signer);
    try (PemWriter writer = new PemWriter(new FileWriter(pemPath.toFile()))) {
        writer.writeObject(new PemObject("CERTIFICATE", holder.toASN1Structure().getEncoded()));
    }
    try (PemWriter writer = new PemWriter(new FileWriter(keyPath.toFile()))) {
        writer.writeObject(new PemObject("PRIVATE KEY", pair.getPrivate().getEncoded()));
    }
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public X509Certificate generateCertificate(PKCS10CertificationRequest csr, BigInteger serial, int expireDays) throws NoSuchProviderException, NoSuchAlgorithmException, IOException, OperatorCreationException, CertificateException {
    AlgorithmIdentifier sigAlgorithmId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA512WithRSAEncryption");
    AlgorithmIdentifier digestAlgorithmId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgorithmId);

    X509CertificateHolder caCert = readCertificate();
    System.out.println(caCert.getSubject());

    LocalDateTime startDate = LocalDate.now().atStartOfDay();
    X509v3CertificateBuilder builder= new X509v3CertificateBuilder(
            caCert.getSubject(),
            serial,
            Date.from(startDate.atZone(ZoneId.systemDefault()).toInstant()),
            Date.from(startDate.plusDays(expireDays).atZone(ZoneId.systemDefault()).toInstant()),
            csr.getSubject(),
            SubjectPublicKeyInfo.getInstance(csr.getSubjectPublicKeyInfo()));

    AsymmetricKeyParameter caPrivateKeyParameters = readKey(keyPath);
    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgorithmId, digestAlgorithmId)
            .build(caPrivateKeyParameters);
    X509CertificateHolder holder = builder.build(contentSigner);
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(holder);
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
public static X509Certificate generateCertificate(Credential credential, String entityId) throws Exception {
    X500Name issuer = new X500Name("o=keymanager, ou=oiosaml-sp");
    BigInteger serialNumber = BigInteger.valueOf(System.currentTimeMillis());
    Date notBefore = new Date();
    Date notAfter = new Date(System.currentTimeMillis() + 1000L * 60L * 60L * 24L * 365L * 10L);
    X500Name subject = new X500Name("cn=" + entityId + ", ou=oiosaml-sp");

    ByteArrayInputStream bIn = new ByteArrayInputStream(credential.getPublicKey().getEncoded());
    SubjectPublicKeyInfo publicKeyInfo = new SubjectPublicKeyInfo((ASN1Sequence)new ASN1InputStream(bIn).readObject());

    X509v3CertificateBuilder gen = new X509v3CertificateBuilder(issuer, serialNumber, notBefore, notAfter, subject, publicKeyInfo);

	gen.addExtension(X509Extension.subjectKeyIdentifier, false, new JcaX509ExtensionUtils().createSubjectKeyIdentifier(credential.getPublicKey()));
	gen.addExtension(X509Extension.authorityKeyIdentifier, false, new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(credential.getPublicKey()));

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(credential.getPrivateKey());
    X509CertificateHolder certificateHolder = gen.build(sigGen);

    X509Certificate x509Certificate = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
	return x509Certificate;
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
/**
 * Generate a CertificateToken suitable for a TSA
 *
 * @param algorithm
 * @param keyPair
 * @param issuer
 * @param subject
 * @param notBefore
 * @param notAfter
 * @return
 * @throws OperatorCreationException
 * @throws CertificateException
 * @throws IOException
 */
private CertificateToken generateTspCertificate(final SignatureAlgorithm algorithm, KeyPair keyPair, X500Name issuer, X500Name subject,
		final Date notBefore, final Date notAfter) throws OperatorCreationException, CertificateException, IOException {
	final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());

	final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
			new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter, subject, keyInfo);

	certBuilder.addExtension(Extension.extendedKeyUsage, true, new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

	final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId()).setProvider(BouncyCastleProvider.PROVIDER_NAME)
			.build(keyPair.getPrivate());
	final X509CertificateHolder holder = certBuilder.build(signer);

	final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
			.generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

	return new CertificateToken(cert);
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
private CertificateToken generateRootCertificateWithCrl(SignatureAlgorithm algorithm, X500Name subject, X500Name issuer, PrivateKey issuerPrivateKey,
		PublicKey publicKey, Date notBefore, Date notAfter) throws Exception {

	// generate certificate
	final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());

	final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
			new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter, subject, keyInfo);

	certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyCertSign | KeyUsage.cRLSign));

	// Sign the new certificate with the private key of the trusted third
	final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId()).setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerPrivateKey);
	final X509CertificateHolder holder = certBuilder.build(signer);

	final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
			.generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

	return new CertificateToken(cert);
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
private CertificateToken generateRootCertificateWithoutCrl(SignatureAlgorithm algorithm, X500Name subject, X500Name issuer, PrivateKey issuerPrivateKey,
		PublicKey publicKey, Date notBefore, Date notAfter) throws Exception {

	// generate certificate
	final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());

	final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
			new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter, subject, keyInfo);

	certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyCertSign));

	// Sign the new certificate with the private key of the trusted third
	final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId()).setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerPrivateKey);
	final X509CertificateHolder holder = certBuilder.build(signer);

	final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
			.generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

	return new CertificateToken(cert);
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
/**
 * {@link CertificateManager#getServerIdentities(X509Certificate)} should return:
 * <ul>
 *     <li>the Common Name</li>
 * </ul>
 *
 * when a certificate contains:
 * <ul>
 *     <li>no other identifiers than its CommonName</li>
 * </ul>
 */
@Test
public void testServerIdentitiesCommonNameOnly() throws Exception
{
    // Setup fixture.
    final String subjectCommonName = "MySubjectCommonName";

    final X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
            new X500Name( "CN=MyIssuer" ),                                          // Issuer
            BigInteger.valueOf( Math.abs( new SecureRandom().nextInt() ) ),         // Random serial number
            new Date( System.currentTimeMillis() - ( 1000L * 60 * 60 * 24 * 30 ) ), // Not before 30 days ago
            new Date( System.currentTimeMillis() + ( 1000L * 60 * 60 * 24 * 99 ) ), // Not after 99 days from now
            new X500Name( "CN=" + subjectCommonName ),                              // Subject
            subjectKeyPair.getPublic()
    );

    final X509CertificateHolder certificateHolder = builder.build( contentSigner );
    final X509Certificate cert = new JcaX509CertificateConverter().getCertificate( certificateHolder );

    // Execute system under test
    final List<String> serverIdentities = CertificateManager.getServerIdentities( cert );

    // Verify result
    assertEquals( 1, serverIdentities.size() );
    assertEquals( subjectCommonName, serverIdentities.get( 0 ) );
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
private void generateCertificate() throws Exception {
  Date NOT_BEFORE=new Date();
  Calendar NOT_AFTER=Calendar.getInstance();
  NOT_AFTER.add(Calendar.YEAR, 100);
  X500Name subjectAndIssuer= new X500Name("CN=peercentrum node");
  X509v3CertificateBuilder certificateBuilder = new JcaX509v3CertificateBuilder(
      subjectAndIssuer, new BigInteger(64, random), NOT_BEFORE, NOT_AFTER.getTime(), subjectAndIssuer, localPublicECKey);

  ContentSigner signer = new JcaContentSignerBuilder("SHA256withECDSA").setProvider(BC_PROVIDER).build(localPrivateECKey);
  X509CertificateHolder certHolder = certificateBuilder.build(signer);
  cert = new JcaX509CertificateConverter().setProvider(BC_PROVIDER).getCertificate(certHolder);

  //    if(certHolder.isSignatureValid(new JcaContentVerifierProviderBuilder().setProvider(BC_PROVIDER).build(localKeypair.getPublic()))==false){
  //      throw new Exception("Verification failed");
  //    }
  cert.verify(localPublicECKey, BC_PROVIDER);
  localCertificateChainArray=new Certificate[] {cert};
}
 

import org.bouncycastle.cert.X509v3CertificateBuilder; //導入方法依賴的package包/類
private static X509CertificateHolder makeV3Certificate(KeyPair subKP, String _subDN, KeyPair issKP, String _issDN)
    throws GeneralSecurityException, IOException, OperatorCreationException, CertException
{

    PublicKey subPub  = subKP.getPublic();
    PrivateKey issPriv = issKP.getPrivate();
    PublicKey  issPub  = issKP.getPublic();

    X509v3CertificateBuilder v1CertGen = new JcaX509v3CertificateBuilder(
        new X500Name(_issDN),
        BigInteger.valueOf(System.currentTimeMillis()),
        new Date(System.currentTimeMillis()),
        new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 100)),
        new X500Name(_subDN),
        subPub);

    ContentSigner signer = new JcaContentSignerBuilder("SHA1WithRSA").setProvider(BC).build(issPriv);

    X509CertificateHolder certHolder = v1CertGen.build(signer);

    ContentVerifierProvider verifier = new JcaContentVerifierProviderBuilder().setProvider(BC).build(issPub);

    assertTrue(certHolder.isSignatureValid(verifier));

    return certHolder;
}