UPI收单服务平台证书生成及使用指引

UPI收单服务平台证书生成及使用指引

1 证书生成

证书生成可以登录到Linux服务器上使用如下命令生成：
Lenght 2048 :

openssl genrsa -out private_signature_2048.key 2048
openssl req -new -x509 -key private_signature_2048.key -out public_signature_2048.cer -set_serial 201806211822

说明：
1、 private_signature_2048.key是生成的证书私钥
2、 2048是证书的位数。
3、 public_signature_2048.cer是生成的证书公钥
4、 201806211822为证书序列号，亦可根据自身需求填写

2 提取公钥字符串

以下是从生成的证书公钥public_signature_2048.cer中提取公钥字符串的方法，其中“file:///D:/public_signature_2048.cer”表示public_signature_2048.cer所在磁盘路径。提取的公钥字符串（public key string）用于提供银联国际进行参数配置。

public static void main(String[] args) throws Exception {

		URL url=null;
		try {
			url =  new URL("file:///D:/public_signature_2048.cer");
		} catch (MalformedURLException e1) {
			e1.printStackTrace();
		}
		System.out.println("公钥所在路径:"+url.getFile());  
		X509Certificate cert = null;
		try {
			cert = X509Certificate.getInstance(new FileInputStream(url.getFile()));
		} catch (FileNotFoundException e) {
			e.printStackTrace();
		} catch (Exception e) {
			e.printStackTrace();
		} 
		PublicKey publicKey = cert.getPublicKey();  
		String publicKeyString = "";
		try {
			publicKeyString = Base64Utils.encode(publicKey.getEncoded());
		} catch (Exception e) {
			e.printStackTrace();
		}
		System.out.println("-----------------public key--------------------");  
		System.out.println(publicKeyString);  
		System.out.println("-----------------public key--------------------");
	}

3 签名示例代码

public static String signUais(byte[] data, String privateKey) throws Exception { 
    	MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
		messageDigest.update(data);
		byte[] hashData = messageDigest.digest();
    	
        byte[] keyBytes = Base64Utils.decode(privateKey);    
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);    
        
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");    
        PrivateKey privateK = keyFactory.generatePrivate(pkcs8KeySpec);    
        Signature signature = Signature.getInstance("NONEWithRSA");    
        signature.initSign(privateK);    
        signature.update(hashData);  
        byte[] sign = signature.sign();
        System.out.println(DigitalTrans.byte2hex(sign));
        return Base64Utils.encode(sign);    
}

4 验签示例代码

public static boolean verifyUais(byte[] data, String publicKey, String sign) throws Exception {
		MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
		messageDigest.update(data);
		byte[] hashData = messageDigest.digest();

		byte[] keyBytes = Base64Utils.decode(publicKey);
		X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
		KeyFactory keyFactory = KeyFactory.getInstance("RSA");
		PublicKey publicK = keyFactory.generatePublic(keySpec);
		Signature signature = Signature.getInstance("NONEWithRSA");
		signature.initVerify(publicK);
		signature.update(hashData);
		return signature.verify(Base64Utils.decode(sign));
	}

5 加密示例代码

private static final int MAX_ENCRYPT_BLOCK = 117;

private static String encryptByPublicKey(byte[] data, String publicKey) throws Exception {
		byte[] keyBytes = Base64Utils.decode(publicKey);
		X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(keyBytes);
		KeyFactory keyFactory = KeyFactory.getInstance("RSA");
		Key publicK = keyFactory.generatePublic(x509KeySpec);
		// 对数据加密
		Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
		cipher.init(Cipher.ENCRYPT_MODE, publicK);
		int inputLen = data.length;
		ByteArrayOutputStream out = new ByteArrayOutputStream();
		int offSet = 0;
		byte[] cache;
		int i = 0;
		// 对数据分段加密
		while (inputLen - offSet > 0) {
			if (inputLen - offSet > MAX_ENCRYPT_BLOCK) {
				cache = cipher.doFinal(data, offSet, MAX_ENCRYPT_BLOCK);
			} else {
				cache = cipher.doFinal(data, offSet, inputLen - offSet);
			}
			out.write(cache, 0, cache.length);
			i++;
			offSet = i * MAX_ENCRYPT_BLOCK;
		}
		byte[] encryptedData = out.toByteArray();
		out.close();
		return Base64Utils.encode(encryptedData);
	}

6 解密示例代码

public static byte[] decryptByPrivateKey(byte[] encryptedData, String privateKey)    
            throws Exception {    
        byte[] keyBytes = Base64Utils.decode(privateKey);    
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(keyBytes);    
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");    
        Key privateK = keyFactory.generatePrivate(pkcs8KeySpec);    
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());    
        cipher.init(Cipher.DECRYPT_MODE, privateK);    
        int inputLen = encryptedData.length;    
        ByteArrayOutputStream out = new ByteArrayOutputStream();    
        int offSet = 0;    
        byte[] cache;    
        int i = 0;    
        // 对数据分段解密    
        while (inputLen - offSet > 0) {    
            if (inputLen - offSet > MAX_DECRYPT_BLOCK) {    
                cache = cipher.doFinal(encryptedData, offSet, MAX_DECRYPT_BLOCK);    
            } else {    
                cache = cipher.doFinal(encryptedData, offSet, inputLen - offSet);    
            }    
            out.write(cache, 0, cache.length);    
            i++;    
            offSet = i * MAX_DECRYPT_BLOCK;    
        }    
        byte[] decryptedData = out.toByteArray();    
        out.close();    
        return decryptedData;    
    }