java解析证书的例子(包括基本项目、扩展项目)
package ciso.security.test;
/**
* <p>Title: Light Weight APIs for crypto </p>
* <p>Description: 一个上海CA证书(根证书和用户证书)进行处理的例子</p>
* <p>Copyright: Copyright (c) 2003</p>
* <p>Company: 中国信息安全组织(CISO) </p>
* @author rainbow(webmaster)
* @version 1.0.2003.0620
*/
import java.io.*;
import org.bouncycastle.asn1.*;
import org.bouncycastle.asn1.util.*;
import org.bouncycastle.asn1.x509.*;
import org.bouncycastle.util.encoders.*;
public class CertManager {
String eoid[][]={
{new String("Subject Key Identifier"), new String("2.5.29.14")},
{new String("Key Usage"), new String("2.5.29.15")},
{new String("Private Key Usage Period"),new String("2.5.29.16")},
{new String("Subject Alternative Name"),new String("2.5.29.17")},
{new String("Issuer Alternative Name"), new String("2.5.29.18")},
{new String("Basic Constraints"), new String("2.5.29.19")},
{new String("CRL Number"), new String("2.5.29.20")},
{new String("Reason code"), new String("2.5.29.21")},
{new String("Hold Instruction Code"), new String("2.5.29.23")},
{new String("Invalidity Date"), new String("2.5.29.24")},
{new String("Delta CRL indicator"), new String("2.5.29.27")},
{new String("Issuing Distribution Point"),new String("2.5.29.28")},
{new String("Certificate Issuer"), new String("2.5.29.29")},
{new String("Name Constraints"), new String("2.5.29.30")},
{new String("CRL Distribution Points"), new String("2.5.29.31")},
{new String("Certificate Policies"), new String("2.5.29.32")},
{new String("Policy Mappings"), new String("2.5.29.33")},
{new String("Authority Key Identifier"),new String("2.5.29.35")},
{new String("Policy Constraints"), new String("2.5.29.36")},
{new String("Extended Key Usage"), new String("2.5.29.37")}};
byte buf[];
public CertManager() {
int fLength=0;
try {
FileInputStream fis=new FileInputStream("..\\mycert\\ca.der");
fLength=fis.available();
buf=new byte[fLength];
fis.read(buf,0,fLength);
}
catch (Exception ex) {
System.out.println("读证书文件出错!");
return;
}
}
public byte[] getExtensionBytes(String oid,X509Extensions exts)
{
if (exts != null)
{
X509Extension ext = exts.getExtension(new DERObjectIdentifier(oid));
if (ext != null)
{
return ext.getValue().getOctets();
}
}
return null;
}
public void getCert()
{
ByteArrayInputStream bIn;
DERInputStream dIn;
String dump = "";
try
{
bIn = new ByteArrayInputStream(buf);
dIn = new DERInputStream(bIn);
ASN1Sequence seq = (ASN1Sequence)dIn.readObject();
//dump = DERDump.dumpAsString(seq);
// 调试输出语句
//System.out.println(dump);
// 证书的基本信息
System.out.println("<<=============证书的基本信息===============>>");
X509CertificateStructure cert = new X509CertificateStructure(seq);
System.out.println("证书版本:\t"+cert.getVersion());
System.out.println("序列号:\t\t"+cert.getSerialNumber().getValue().toString(16));
System.out.println("算法标识:\t"+cert.getSignatureAlgorithm().getObjectId().getId());
System.out.println("签发者:\t\t"+cert.getIssuer());
System.out.println("开始时间:\t"+cert.getStartDate().getTime());
System.out.println("结束时间:\t"+cert.getEndDate().getTime());
System.out.println("主体名:\t\t"+cert.getSubject());
System.out.print("签名值:\t");
DERBitString signature=cert.getSignature();
String strSign=new String(Hex.encode(signature.getBytes()));
System.out.println(strSign);
System.out.println("主体公钥:\t");
SubjectPublicKeyInfo pukinfo=cert.getSubjectPublicKeyInfo();
System.out.println("\t标识符:\t"+pukinfo.getAlgorithmId().getObjectId().getId());
byte[] byPuk=pukinfo.getPublicKeyData().getBytes();
String strPuk=new String(Hex.encode(byPuk));
System.out.println("\t公钥值:\t"+strPuk);
// 证书的扩展信息
System.out.println("<<===========证书的扩展信息==============>>");
X509Extensions ext=cert.getTBSCertificate().getExtensions();
// 15 --key usage 19 ---basic constrains
// 31-- crl point 32 ---certificate policy
getKeyUsage(ext);
getBasicConstrains(ext);
getCRLPoint(ext);
getCertPolicy(ext);
}
catch (Exception e)
{
e.printStackTrace();
return ;
}
}
// 取密钥的使用
public void getKeyUsage(X509Extensions ext)
{
DERObjectIdentifier derOid = new DERObjectIdentifier("2.5.29.15");
X509Extension item = null;
boolean isCritical;
ASN1OctetString value;
try {
item=ext.getExtension(derOid);
isCritical=item.isCritical();
value=item.getValue();
}
catch (Exception ex) {
return;
}
System.out.println(new String(Hex.encode(value.getOctets())));
}
// 取基本限制
public void getBasicConstrains(X509Extensions ext)
{
byte[] bytes = getExtensionBytes("2.5.29.19",ext);
if (bytes != null)
{
try
{
DERInputStream dIn = new DERInputStream(new ByteArrayInputStream(bytes));
ASN1Sequence seq = (ASN1Sequence)dIn.readObject();
if (seq.size() == 2)
{
if (((DERBoolean)seq.getObjectAt(0)).isTrue())
{
int pathlen=((DERInteger)seq.getObjectAt(1)).getValue().intValue();
System.out.println("是CA证书\t"+"max path len="+pathlen);
}
else
{
System.out.println("不是ca证书!");
}
}
else if (seq.size() == 1)
{
if (seq.getObjectAt(0) instanceof DERBoolean)
{
if (((DERBoolean)seq.getObjectAt(0)).isTrue())
{
System.out.println(Integer.MAX_VALUE);
}
}
}
}
catch (Exception e)
{
throw new RuntimeException("error processing key usage extension");
}
}
}
// 取crl分布点
public void getCRLPoint(X509Extensions ext)
{
byte[] byContent = getExtensionBytes("2.5.29.31",ext);
if (byContent != null)
{
try
{
DERInputStream dIn = new DERInputStream(new ByteArrayInputStream(byContent));
ASN1Sequence seq = (ASN1Sequence)dIn.readObject();
int dpCount=seq.size();
for(int i=0;i<dpCount;i++)
{
// 第一个分布点(DistributionPoint)
ASN1Sequence point1=(ASN1Sequence)seq.getObjectAt(i);
DERObject tobj=(DERTaggedObject)point1.getObjectAt(0);
System.out.println("CRL分布点"+(i+1)+":");
while(tobj instanceof DERTaggedObject&&!((DERTaggedObject)tobj).isEmpty())
{
System.out.println("\ttagNo:"+((DERTaggedObject)tobj).getTagNo());
if(tobj instanceof DERTaggedObject)
tobj=((DERTaggedObject)tobj).getObject();
}
DEROctetString os=(DEROctetString)tobj.getDERObject();
String str=new String(os.getOctets());
System.out.println("\t"+str);
}
}
catch (Exception e)
{
System.out.println("crl分布点处理出错了!");
}
}
}
// 取证书策略
public void getCertPolicy(X509Extensions ext)
{
byte[] byContent = getExtensionBytes("2.5.29.32",ext);
if (byContent != null)
{
try
{
DERInputStream dIn = new DERInputStream(new ByteArrayInputStream(byContent));
ASN1Sequence seq = (ASN1Sequence)dIn.readObject();
//String dump = DERDump.dumpAsString(seq);
// 调试输出语句
//System.out.println("证书策略:"+dump);
for(int i=0;i<seq.size();i++)
{
getPolicyInfo((ASN1Sequence)seq.getObjectAt(i));
}
}
catch(Exception e)
{
e.printStackTrace();
}
}
}
private void getPolicyInfo(ASN1Sequence seq)
{
if(seq.size()==2)
{
DERObjectIdentifier objID=(DERObjectIdentifier)seq.getObjectAt(0);
System.out.println("证书策略标识:"+objID.getId());
ASN1Sequence seqQualifier=(ASN1Sequence)seq.getObjectAt(1);
for(int i=0;i<seqQualifier.size();i++)
getPolicyQualifierInfo((ASN1Sequence)seqQualifier.getObjectAt(i));
}
else
System.out.println("解析策略声明时出错!");
}
private void getPolicyQualifierInfo(ASN1Sequence seq)
{
if(seq.size()==2)
{
DERObjectIdentifier objID=(DERObjectIdentifier)seq.getObjectAt(0);
System.out.println("策略声明标识:"+objID.getId());
DERIA5String ia5=(DERIA5String)seq.getObjectAt(1);
System.out.println("声明内容:"+ia5.getString());
}
}
public static void main(String[] args) {
CertManager cm = new CertManager();
cm.getCert();
}
}
上面代码使用了文件输入流来检查证书，适用于对单个证书文件的操作。如果想对证书库进行操作，就需要对代码作一下改动，以便能够读取keystore。
String storeFile = "c:\\default.keystore";
String storePass = "11111111";
String alias = "root";
DERInputStream dIn = null;
try{
KeyStore ks = KeyStore.getInstance("jks");
ks.load(new FileInputStream(storeFile), storePass.toCharArray());
X509Certificate cert = (X509Certificate)ks.getCertificate(alias);
dIn = new DERInputStream(new ByteArrayInputStream(cert.getEncoded()));
ASN1Sequence seq = (ASN1Sequence)dIn.readObject();
//重用代码
}catch(Exception e){
e.printStackTrace();
}