android平台使用java动态生成公私钥，并导出证书文件
不依赖keytool工具，指令生成证书库，而是java代码生成，且导出到证书文件中。直接上代码：
证书工具类：
package com.daobo.security.utils
import com.daobo.security.bean.Certification
import org.bouncycastle.jce.provider.BouncyCastleProvider
import org.bouncycastle.x509.X509V1CertificateGenerator
import sun.misc.BASE64Decoder
import sun.misc.BASE64Encoder
import java.io.BufferedInputStream
import java.io.FileInputStream
import java.math.BigInteger
import java.security.*
import java.security.Security.addProvider
import java.security.cert.CertificateFactory
import java.security.cert.X509Certificate
import java.security.spec.PKCS8EncodedKeySpec
import java.security.spec.RSAKeyGenParameterSpec
import java.util.*
import javax.security.auth.x500.X500Principal
object CertificationUtil {
const val strDnInfo : String = "CN=Test Certificate"
/**
* @param pair 密钥对
* @param startDate 有效期
* @param endDate 有效期
* @param info 证书信息
* @return
* @throws InvalidKeyException
* @throws NoSuchProviderException
* @throws SignatureException
*/
@Throws(InvalidKeyException::class, NoSuchProviderException::class, SignatureException::class)
@SuppressWarnings("deprecation")
fun generateV1Certificate(pair: KeyPair, startDate: Date, endDate: Date, info: X500Principal): X509Certificate {
// generate the certificate
addProvider(BouncyCastleProvider())
val certGen = X509V1CertificateGenerator()
certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()))
certGen.setIssuerDN(info)
certGen.setNotBefore(startDate)
certGen.setNotAfter(endDate)
certGen.setSubjectDN(X500Principal(strDnInfo))
certGen.setPublicKey(pair.public)
// i get error here
certGen.setSignatureAlgorithm("SHA256WithRSAEncryption")
return certGen.generateX509Certificate(pair.private, "BC")
}
/**
* * 生成证书文件
* @param address 文件保存的路径
* @param startDate 有效期
* @param endDate 有效期
* @param info 证书信息
* @param algorithm 算法名称
* @param keySize 密钥长度
* @param random 随机源
* @throws Exception
*/
@Throws(Exception::class)
fun writeFilePkCert(fileName: String, startDate: Date, endDate: Date, info: X500Principal,
algorithm: String, keySize: Int, random: SecureRandom, kpGen : Certification) {
// create the keys
val kp = kpGen.getKeyPair(algorithm, keySize, random)
// generate the certificate
val cert = generateV1Certificate(kp, startDate, endDate, info)
// show some basic validation
cert.checkValidity(Date())
cert.verify(cert.publicKey)
CertFileUtil.getInstance(null).writeToFile(fileName,
BASE64Encoder().encode(cert.encoded))
//System.out.println("valid certificate generated:"+cert.getPublicKey());
}
@Throws(Exception::class)
fun writeFileSkCert(fileName: String, kpGen : Certification) {
//直接将私钥 string 写进到文件
CertFileUtil.getInstance(null).writeToFile(fileName,
getKeyAsString(kpGen.privateKey!!))
//System.out.println("valid certificate generated:"+cert.getPublicKey());
}
fun getKeyAsString(key: Key): String {
val keyBytes = key.encoded
val b64 = BASE64Encoder()
return b64.encode(keyBytes)
}
//将String类型转换为PrivateKey类型
@Throws(Exception::class)
fun getPrivateKeyFromString(key: String, algorithm: String): PrivateKey {
val keyFactory = KeyFactory.getInstance(algorithm)
val b64 = BASE64Decoder()
val privateKeySpec = PKCS8EncodedKeySpec(b64.decodeBuffer(key))
return keyFactory.generatePrivate(privateKeySpec)
}
/**
* 获取证书对象
* @param address 证书文件路径
* @return
* @throws Exception
*/
@Throws(Exception::class)
fun getCert(address: String): X509Certificate? {
var cert: X509Certificate? = null
val fis = FileInputStream(address)
val bis = BufferedInputStream(fis)
val cf = CertificateFactory.getInstance("X.509")
while (bis.available() > 0) {
cert = cf.generateCertificate(fis) as X509Certificate?
}
return cert
}
}certification Bean:
package com.daobo.security.bean
import java.math.BigInteger
import java.security.*
import java.text.SimpleDateFormat
import java.util.*
import javax.crypto.Cipher
class Certification {
var strName : String = ""
var strCreateTime : String = ""
var strEffectiveTime : String = ""
// 私钥:
var privateKey: PrivateKey? = null
// 公钥:
var publicKey: PublicKey? = null
constructor(name : String, createTime : String, effectiveTime: String){
strName = name
strCreateTime = createTime
strEffectiveTime = effectiveTime
}
constructor(name : String, effectiveTime : String) {
this.strName = name
this.strEffectiveTime = effectiveTime
val format = SimpleDateFormat("yyyy-MM-dd HH:mm:ss")
strCreateTime = format.format(Date())
}
@Throws(GeneralSecurityException::class, NoSuchAlgorithmException::class)
fun getKeyPair(algorithm : String, keySize : Int, random : SecureRandom) : KeyPair {
val kpGen = KeyPairGenerator.getInstance(algorithm)
kpGen.initialize(keySize, random)
val keyPair = kpGen.generateKeyPair()
this.privateKey = keyPair!!.private
this.publicKey = keyPair!!.public
return keyPair
}
fun isExpired () : Boolean {
var date = SimpleDateFormat("yyyy-MM-dd HH:mm:ss").parse(strEffectiveTime)
if(date.before(Date())){
return true
}
return false
}
// 把私钥导出为字节
fun getPrivateKey(): ByteArray {
return this.privateKey!!.encoded
}
// 把公钥导出为字节
fun getPublicKey(): ByteArray {
return this.publicKey!!.encoded
}
// 用公钥加密:
@Throws(GeneralSecurityException::class)
fun encrypt(message: ByteArray): ByteArray {
val cipher = Cipher.getInstance("RSA")
cipher.init(Cipher.ENCRYPT_MODE, this.publicKey)
return cipher.doFinal(message)
}
// 用私钥解密:
@Throws(GeneralSecurityException::class)
fun decrypt(input: ByteArray): ByteArray {
val cipher = Cipher.getInstance("RSA")
cipher.init(Cipher.DECRYPT_MODE, this.privateKey)
return cipher.doFinal(input)
}
}写文件的工具类：
package com.daobo.security.utils
import android.content.Context
import android.os.Environment
import java.io.File
import java.io.FileInputStream
import java.io.FileOutputStream
import java.io.OutputStreamWriter
import java.nio.charset.Charset
class CertFileUtil {
private var applicationContext : Context? = null
var certRootPath : String = ""
companion object {
private var instance: CertFileUtil? = null
fun getInstance(context: Context?): CertFileUtil {
if (instance == null)
instance = CertFileUtil(context)
return instance!!
}
}
private constructor (context: Context?) {
this.applicationContext = context
LogUtil.init(LogUtil.INFO_LEVEL, "$certRootPath/daobo/log/")
val state = Environment.getExternalStorageState()
if (Environment.MEDIA_MOUNTED == state) {
// 已经挂载了sd卡
certRootPath = Environment.getExternalStoragePublicDirectory(
Environment.DIRECTORY_DOWNLOADS).absolutePath
certRootPath += "/daobo/cert/"
} else {
LogUtil.info( "=== 读取 sd 状态不可用！===")
}
}
fun certPKFileName (certName : String) : String {
return certName + "_pk.cer"
}
fun certSKFileName (certName : String) : String {
return certName + "_sk.cer"
}
fun writeToFile(fileName : String, fileData : String) {
try {
val filePath = File(certRootPath)
if (!filePath.exists()) {
filePath.mkdirs()
}
val file = File(filePath, fileName)
val fos = FileOutputStream(file)
val wr = OutputStreamWriter(fos, Charset.forName("UTF-8"))
//wr.write("-----BEGIN CERTIFICATE-----\n")
wr.write(fileData)
//wr.write("\n-----END CERTIFICATE-----\n")
wr.flush()
wr.close()
//val fos = FileOutputStream(file)
//fos.write(fileData)
//fos.flush()
fos.close()
}catch (e:Exception) {
e.printStackTrace()
}
}
fun readCertFile(fileName : String) : ByteArray {
var filePath = File(certRootPath)
var files = filePath.listFiles()
if(files == null || files.isEmpty()){
//Toast.makeText(context, "文件为空！", Toast.LENGTH_SHORT).show()
LogUtil.info("directory=daoboCert=== 文件为空！===")
return ByteArray(0)
}
// 拿到输入流
for(f in files){
if(fileName == f.name){
val input = FileInputStream(files[0])
try {
// 建立存储器
var buf = ByteArray(input.available())
// 读取到存储器
input.read(buf)
return buf
} catch (e: Exception) {
e.printStackTrace()
}finally {
// 关闭输入流
input.close()
}
}
}
return ByteArray(0)
}
}说明下，需要依赖一个证书的库：bcprov-jdk15to18-165.jar （bouncycastle）链接，还需要单独去下载一个Android使用的base64编码的工具jar
公钥是有对应的生成cer证书的操作，但是私钥没有，一半经过base64直接写到文件中。公钥证书有几个关键的证书参数：
//获取发布者标识
Principal principalIssuer = x509Certificate.getIssuerDN();
//获取证书的主体标识
Principal principalSubject = x509Certificate.getSubjectDN();
//保存证书的序列号
list.add(x509Certificate.getSerialNumber())