一个好用的X.509证书生成工具

需要生成一个PKCS#12格式的证书，里面需要有证书和私钥，用于发送电子邮件时的签名和加密(S/MIME)，同时，需要证书支持KeyUsage extension，因为需要通过检查KeyUsage来判断这个证书只能用于签名或者只能用于加密或者都可以。

关于KeyUsage extension，介绍如下：

Key usage is a multi valued extension consisting of a list of names of the permitted key usages.

 

Java X509Certificate类也有获得KeyUsage的方法：

public abstract boolean[] getKeyUsage ()
Since: API Level 1

Returns the KeyUsage extension as a boolean array.

The ASN.1 definition of KeyUsage:

 KeyUsage ::= BIT STRING {
      digitalSignature        (0),
      nonRepudiation          (1),
      keyEncipherment         (2),
      dataEncipherment        (3),
      keyAgreement            (4),
      keyCertSign             (5),
      cRLSign                 (6),
      encipherOnly            (7),
      decipherOnly            (8) }

Returns

    the KeyUsage extension or null if there's none in the certificate. 

 

openssl命令行是最强大的，但是那些参数让我头疼，特别是需要证书中含有KeyUsage。这里找到一个生成证书的GUI工具，刚好生成的证书里面也会包含KeyUsage：

 

TekCERT

http://www.yasinkaplan.com/tekcert.asp

 

 

1. Run TekCERT from Start / Program Files / TekCERT.

2. Click "Generate Certificate" button to create the certificate after filling necessary fields. You need to enter at least a valid "Name" for the certificate. Generated certificates are located in "Local Computer/Personal" store.
   

3. You can export public key in .cer (DER encoded X.509) format or with private key in .pfx format in after creating the certificate for client deployment. Click "Browse Certificates" tab, select the generated certificate and click "Export" button.