项目中用到的数字证书的创建，签名实现

首先 需要下载jar包 bcprov-jdk15-145.jar



实体类



package com.hongan.lh.cert;

import java.security.KeyPair;
import java.security.cert.X509Certificate;

public class CertInfo {
private KeyPair key;
private X509Certificate cert;
public KeyPair getKey() {
return key;
}
public void setKey(KeyPair key) {
this.key = key;
}
public X509Certificate getCert() {
return cert;
}
public void setCert(X509Certificate cert) {
this.cert = cert;
}
}



帮助类



package com.hongan.lh.cert;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.InputStreamReader;
import java.security.Key;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;

import org.bouncycastle.openssl.PEMReader;
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.openssl.PasswordFinder;

public class HongAnUtils {
public static KeyPair getPrivateKey(String rootMiyuePath,
final String rootMiyuePwd) throws Exception {
PEMReader reader = new PEMReader(new InputStreamReader(
new FileInputStream(rootMiyuePath)), new PasswordFinder() {

public char[] getPassword() {
// TODO Auto-generated method stub
return rootMiyuePwd.toCharArray();
}

});
KeyPair key = (KeyPair) reader.readObject();
return key;
}

public static void saveX509Certificate(X509Certificate certificate,
String rootcertPath) throws Exception {
FileOutputStream stream = new FileOutputStream(rootcertPath);
stream.write(certificate.getEncoded());
stream.close();
}

public static void savePEM(PrivateKey key, String rootMiyuePwd,
String rootMiyuePath) throws Exception {
PEMWriter writer = new PEMWriter(new FileWriter(rootMiyuePath));
writer.writeObject(key, "DESEDE", rootMiyuePwd.toCharArray(),
new SecureRandom());
writer.close();
}

public static KeyPair generateRSAKeyPair() throws Exception {
KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA");

kpGen.initialize(1024, new SecureRandom());

return kpGen.generateKeyPair();
}

public static byte[] RSASign(PrivateKey key, byte[] src) throws Exception {

java.security.Signature sign = java.security.Signature.getInstance(
"SHA1withRSA", "BC");
sign.initSign(key);
sign.update(src);
return sign.sign();
}

public static boolean RSAVerifySign(PublicKey key, byte[] crypt, byte[] src)
throws Exception {

java.security.Signature sign = java.security.Signature.getInstance(
"SHA1withRSA", "BC");
sign.initVerify(key);
sign.update(src);
return sign.verify(crypt);
}

public static X509Certificate getCertificate(String rootCertPath)
throws Exception {
CertificateFactory factory = CertificateFactory.getInstance("X.509");
FileInputStream inputStream = new FileInputStream(rootCertPath);
X509Certificate certificate = (X509Certificate) factory
.generateCertificate(inputStream);
return certificate;
}

public static void write(String file, byte[] data) throws Exception {
FileOutputStream outputStream = new FileOutputStream(file);
outputStream.write(data);
outputStream.close();
}

public static byte[] read(String file) throws Exception {
FileInputStream stream = new FileInputStream(file);
byte[] by = new byte[stream.available()];
stream.read(by);
stream.close();
return by;
}

public static byte[] encrypt(Key key, byte[] b, String suan)
throws Exception {
Cipher newcipher = Cipher.getInstance(suan);
newcipher.init(Cipher.ENCRYPT_MODE, key);
return newcipher.doFinal(b);
}

public static byte[] encryptByKouling(byte[] s, String suan, String kou)
throws Exception {
PBEKeySpec spec = new PBEKeySpec(kou.toCharArray());
SecretKeyFactory factory = SecretKeyFactory.getInstance(suan);
SecretKey key = factory.generateSecret(spec);
Cipher cipher = Cipher.getInstance(suan);
PBEParameterSpec pps = new PBEParameterSpec(new byte[] { 0xF, 0x0, 0x1,
0x2, 0x3, 0x4, 0x5, 0x6 }, 1);
cipher.init(Cipher.ENCRYPT_MODE, key, pps);
byte[] debyte = cipher.doFinal(s);
return debyte;
}

public static byte[] decryptByKouling(byte[] s, String suan, String kou)
throws Exception {
PBEKeySpec spec = new PBEKeySpec(kou.toCharArray());
SecretKeyFactory factory = SecretKeyFactory.getInstance(suan);
SecretKey key = factory.generateSecret(spec);
Cipher cipher = Cipher.getInstance(suan);
PBEParameterSpec pps = new PBEParameterSpec(new byte[] { 0xF, 0x0, 0x1,
0x2, 0x3, 0x4, 0x5, 0x6 }, 1);
cipher.init(Cipher.DECRYPT_MODE, key, pps);
byte[] debyte = cipher.doFinal(s);
return debyte;
}
}



证书操作类



package com.hongan.lh.cert;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Security;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Date;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.PBEParameterSpec;
import javax.security.auth.x500.X500Principal;

import org.bouncycastle.asn1.DEROutputStream;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.x509.X509V1CertificateGenerator;

import sun.security.x509.X509CertImpl;
import sun.security.x509.X509CertInfo;

public class HongAnCA {

/**
* @param args
* @throws Exception
*/
public static void main(String[] args) throws Exception {

// CreateRootCert("中国|广东省|深圳市|公司A|3650|1000000000000001|HARootPwd|c://ca//HARoot.pem|c://ca//HARoot.cer");
// BackupRootCert("c://ca//honganbackup.p12|p12pass|c://ca//HARoot.pem|HARootPwd|c://ca//HARoot.cer");
// RestoreRootCert("c://ca//honganbackup.p12|p12pass|c://ca//honganroot_restore.pem|privkeypass|c://ca//honganroot_restore.cer");
// CreateUserCert("中国|广东省|深圳市|一家|廖敏|[email protected]|3333333|365|1000000000000002|c://ca//廖敏.pem|user1pass|c://ca//廖敏.cer|c://ca//HARoot.pem|HARootPwd|c://ca//HARoot.cer");
// ExportCompanyKeyByUserCert("c://ca//companykey.dat|keypassword|c://ca//廖敏.cer|c://ca//廖敏.dat");
// CreateCompanyKey("ABCDEFGHIJKLMNOPQRSTUVWXYZ123456|c://ca//companykey.dat|keypassword");
// ExportCompanyKeyByUserCert("c://ca//companykey.dat|keypassword|c://ca//廖敏.cer|c://ca//廖敏.dat");

}

public static byte[] CreateRootCert(String certInfo) throws Exception {
Security.addProvider(new BouncyCastleProvider());
String[] splt = certInfo.split("//|");
String country = splt[0];
String provice = splt[1];
String shi = splt[2];
String company = splt[3];
String validateTime = splt[4];
String seriszeString = splt[5];
String rootMiyuePwd = splt[6];
String rootMiyuePath = splt[7];
String rootcertPath = splt[8];
String certSubject = "C=" + country + ",S=" + provice + ",L=" + shi
+ ",O=" + company + ",CN=" + company;
KeyPair pair = HongAnUtils.generateRSAKeyPair();
X509V1CertificateGenerator certGen = new X509V1CertificateGenerator();
certGen.setSerialNumber(new BigInteger(seriszeString));
certGen.setNotBefore(new Date(System.currentTimeMillis()));
certGen.setNotAfter(new Date(System.currentTimeMillis()
+ Long.parseLong(validateTime) * 24 * 60 * 60 * 1000L));
certGen.setSubjectDN(new X500Principal(certSubject));
certGen.setPublicKey(pair.getPublic());
certGen.setIssuerDN(new X500Principal(certSubject));
certGen.setSignatureAlgorithm("SHA1WithRSA");
X509Certificate certificate = certGen.generate(pair.getPrivate());
HongAnUtils.saveX509Certificate(certificate, rootcertPath);
HongAnUtils.savePEM(pair.getPrivate(), rootMiyuePwd, rootMiyuePath);
return certificate.getEncoded();

}

public static void BackupRootCert(String certInfo) throws Exception {
Security.addProvider(new BouncyCastleProvider());
String[] splt = certInfo.split("//|");
String backPath = splt[0];
String backPwd = splt[1];
String rootMiyuePath = splt[2];
final String rootMiyuePwd = splt[3];
String rootCertPath = splt[4];
CertificateFactory factory = CertificateFactory.getInstance("X.509");
FileInputStream inputStream = new FileInputStream(rootCertPath);
X509Certificate certificate = (X509Certificate) factory
.generateCertificate(inputStream);
KeyPair key = HongAnUtils.getPrivateKey(rootMiyuePath, rootMiyuePwd);
Certificate[] chain = new Certificate[1];
chain[0] = certificate;
KeyStore store = KeyStore.getInstance("PKCS12", "BC");
store.load(null, null);
store.setCertificateEntry("root", certificate);
store.setKeyEntry("rootPriKey", key.getPrivate(), null, chain);
store.store(new FileOutputStream(backPath), backPwd.toCharArray());
}

public static void RestoreRootCert(String certInfo) throws Exception {
Security.addProvider(new BouncyCastleProvider());
String[] splt = certInfo.split("//|");
String bakpath = splt[0];
String bakpwd = splt[1];
String yuanpem = splt[2];
String pempwd = splt[3];
String certPath = splt[4];
InputStream stream = new FileInputStream(bakpath);
KeyStore store = KeyStore.getInstance("PKCS12", "BC");
store.load(stream, bakpwd.toCharArray());
X509Certificate certificate = (X509Certificate) store
.getCertificate("root");
PrivateKey key = (PrivateKey) store.getKey("rootPriKey", null);
HongAnUtils.saveX509Certificate(certificate, certPath);
HongAnUtils.savePEM(key, pempwd, yuanpem);
}

// ca.CreateUserCert("中国|广东省|深圳市|一家|廖敏|[email protected]|3333333|365|1000000000000002|c://ca//廖敏.pem|user1pass|c://ca//于泳涛.cer|c://ca//HARoot.pem|HARootPwd|c://ca//HARoot.cer");
public static CertInfo CreateUserCert(String certInfo) throws Exception {
Security.addProvider(new BouncyCastleProvider());
String[] splt = certInfo.split("//|");
String country = splt[0];
String provice = splt[1];
String shi = splt[2];
String company = splt[3];
String userName = splt[4];
String email = splt[5];
String cellphone = splt[6];

String validateTime = splt[7];
String seriszeString = splt[8];
String userpemPath = splt[9];
String userpemPwd = splt[10];
String usercertpath = splt[11];
String rootpempath = splt[12];
String rootpempwd = splt[13];
String rootcertpath = splt[14];
X509Certificate CA = HongAnUtils.getCertificate(rootcertpath);
String certSubject = "C=" + country + ",S=" + provice + ",L=" + shi
+ ",O=" + company + ",Email=" + email
+ ",0.9.2342.19200300.100.1.41 = " + cellphone + ",CN="
+ userName;
KeyPair pair = HongAnUtils.generateRSAKeyPair();
X509V1CertificateGenerator certGen = new X509V1CertificateGenerator();
certGen.setSerialNumber(new BigInteger(seriszeString));
certGen.setNotBefore(new Date(System.currentTimeMillis()));
certGen.setNotAfter(new Date(System.currentTimeMillis()
+ Long.parseLong(validateTime) * 24 * 60 * 60 * 1000L));
certGen.setSubjectDN(new X500Principal(certSubject));
certGen.setPublicKey(pair.getPublic());
certGen.setIssuerDN(CA.getIssuerX500Principal());
certGen.setSignatureAlgorithm("SHA1WithRSA");

X509Certificate certificate = certGen.generate(pair.getPrivate());
byte[] src = certificate.getEncoded();
KeyPair key = HongAnUtils.getPrivateKey(rootpempath, rootpempwd);
// byte[] b = HongAnUtils.RSASign(key.getPrivate(), src);
X509CertImpl newcert = new X509CertImpl(src);
X509CertInfo info = (X509CertInfo) newcert.get(newcert.getName() + "."
+ newcert.INFO);
X509CertImpl export = new X509CertImpl(info);
export.sign(key.getPrivate(), "SHA1WithRSA");

HongAnUtils.savePEM(pair.getPrivate(), userpemPwd, userpemPath);
DEROutputStream stream = new DEROutputStream(new FileOutputStream(
usercertpath));
stream.write(export.getEncoded());
stream.close();
CertInfo cert = new CertInfo();
cert.setCert(certificate);
cert.setKey(pair);
return cert;
}

// 将字符串生成密钥文件利用密码保护
// ("ABCDEFGHIJKLMNOPQRSTUVWXYZ123456|c://ca//companykey.dat|keypassword");
public static void CreateCompanyKey(String strArgs) throws Exception {
Security.addProvider(new BouncyCastleProvider());
String pwd = strArgs.split("//|")[0];
String savePathString = strArgs.split("//|")[1];
String baoPwd = strArgs.split("//|")[2];
char[] kouling = baoPwd.toCharArray();
PBEKeySpec spec = new PBEKeySpec(kouling);
SecretKeyFactory factory = SecretKeyFactory
.getInstance("PBEWithMD5AndDES");
SecretKey seKey = factory.generateSecret(spec);
Cipher cipher = Cipher.getInstance("PBEWithMD5AndDES");
PBEParameterSpec pps = new PBEParameterSpec(new byte[] { 0xF, 0x0, 0x1,
0x2, 0x3, 0x4, 0x5, 0x6 }, 1);
cipher.init(Cipher.ENCRYPT_MODE, seKey, pps);
byte[] enbyte = cipher.doFinal(pwd.getBytes("utf-8"));
FileOutputStream stream = new FileOutputStream(savePathString);
stream.write(enbyte);
stream.close();

}

// 利用用户证书的公钥 给公司密钥加密生成用户密钥
// c://ca//companykey.dat|keypassword|c://ca//廖敏.cer|c://ca//廖敏.dat");
public static void ExportCompanyKeyByUserCert(String strArgs)
throws Exception {
Security.addProvider(new BouncyCastleProvider());
String[] splt = strArgs.split("//|");
String mimaPath = splt[0];
String mima = splt[1];
String rootCertPath = splt[2];
String usermimapath = splt[3];
FileInputStream input = new FileInputStream(mimaPath);
byte[] enbyte = new byte[input.available()];
input.read(enbyte);
input.close();
PBEKeySpec spec = new PBEKeySpec(mima.toCharArray());
SecretKeyFactory factory = SecretKeyFactory
.getInstance("PBEWithMD5AndDES");
SecretKey key = factory.generateSecret(spec);
Cipher cipher = Cipher.getInstance("PBEWithMD5AndDES");
PBEParameterSpec pps = new PBEParameterSpec(new byte[] { 0xF, 0x0, 0x1,
0x2, 0x3, 0x4, 0x5, 0x6 }, 1);
cipher.init(Cipher.DECRYPT_MODE, key, pps);
byte[] debyte = cipher.doFinal(enbyte);
PublicKey pk = (PublicKey) HongAnUtils.getCertificate(rootCertPath)
.getPublicKey();
byte[] enbyteagain = HongAnUtils.encrypt(pk, debyte, "RSA");
HongAnUtils.write(usermimapath, enbyteagain);
}
}