java keytool 自签证书

最新推荐文章于 2024-08-05 20:29:20 发布

原创最新推荐文章于 2024-08-05 20:29:20 发布 · 2k 阅读

1 ·

本内容遵循CC 4.0 BY-SA版权协议

标签

#java #证书

java 同时被 2 个专栏收录

59 篇文章

订阅专栏

证书

2 篇文章

订阅专栏

本文详细介绍了如何使用Java的keytool工具自动生成并签署SSL证书，包括服务器和客户端证书的创建、签名证书的申请及导入。内容涵盖keytool的genkey、gencert、certreq和importcert等命令的使用，以及Java代码实现证书签发的过程。

server：

1.生成：

keytool -genkey -validity 365 -keysize 1024 -alias server -keyalg RSA -keystore e://cert_new//server.jks -dname "CN=eilpm, OU=eilpm, O=eilpm, L=beijing, ST=beijing, C=CN" -storepass 111111 -keypass 111111

4.自签证书：（或者采取代码签发）

keytool -gencert -alias server -infile e://cert_new//M13521166690_20151208100030424.crt -outfile e://cert_new//M13521166690_20151208100030424.cer -keystore e://cert_new//server.jks -storepass 111111 -keypass 111111

client：

2.生成：

keytool -genkey -validity 365 -keysize 1024 -alias cgp -keyalg RSA -keystore e://cert_new//M13521166690_20151208100030424.jks -dname "CN=阿里, OU=百度, O=新浪, L=beijing, ST=beijing, C=CN" -storepass 222222 -keypass 222222

3.生成申请：

keytool -certreq -keystore e://cert_new//M13521166690_20151208100030424.jks -alias cgp -file e://cert_new//M13521166690_20151208100030424.crt -storepass 222222

5.导入签名证书：

keytool -importcert -alias cgp -file e://cert_new//M13521166690_20151208100030424.cer -storepass 222222

以上需要jdk1.8，否则不支持keytool -gencert

代码签发：

package com;


import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.util.Date;

import sun.security.x509.AlgorithmId;
import sun.security.x509.CertificateAlgorithmId;
import sun.security.x509.CertificateIssuerName;
import sun.security.x509.CertificateSerialNumber;
import sun.security.x509.CertificateValidity;
import sun.security.x509.X500Name;
import sun.security.x509.X509CertImpl;
import sun.security.x509.X509CertInfo;

public class SignCert {

    public static void main(String[] args) throws Exception{
        //签发者信息
        FileInputStream fis = new FileInputStream("e:\\cert\\server.jks");
        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(fis, "111111".toCharArray());
        Certificate c1 = ks.getCertificate("server");
        PrivateKey caprk = (PrivateKey) ks.getKey("server", "111111".toCharArray());//证书私钥
        fis.close();
        byte[] encode1 = c1.getEncoded();
        X509CertImpl cimpl = new X509CertImpl(encode1);
        X509CertInfo cinfol = (X509CertInfo) cimpl.get(X509CertImpl.NAME+"."+X509CertImpl.INFO);
        X500Name issuer = (X500Name) cinfol.get(X509CertInfo.SUBJECT+"."+CertificateIssuerName.DN_NAME);

        //待签发者
        FileInputStream fis2 = new FileInputStream("e:\\cert\\M13521166690_20151208100030424.cer");
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        Certificate c2 = cf.generateCertificate(fis2);
        fis2.close();
        byte[] encode2 = c2.getEncoded();
        X509CertImpl cimp2 = new X509CertImpl(encode2);
        X509CertInfo cinfo2 = (X509CertInfo) cimp2.get(X509CertImpl.NAME+"."+X509CertImpl.INFO);
        Date begindate = new Date();//设置有效期
        Date enddate = new Date(begindate.getTime()+3000*24*60*60*1000L);
        CertificateValidity cv = new CertificateValidity(begindate,enddate);
        cinfo2.set(X509CertInfo.VALIDITY, cv);
        int sn = (int) (begindate.getTime()/1000);//设置证书的序列号
        CertificateSerialNumber csn = new CertificateSerialNumber(sn);
        cinfo2.set(X509CertInfo.SERIAL_NUMBER, csn);
        cinfo2.set(X509CertInfo.ISSUER+"."+CertificateIssuerName.DN_NAME, issuer);//设置证书的签发者是谁
        AlgorithmId algorithm = new AlgorithmId(AlgorithmId.sha256WithRSAEncryption_oid);//设置证书的算法
        cinfo2.set(CertificateAlgorithmId.NAME+"."+CertificateAlgorithmId.ALGORITHM, algorithm);
        X509CertImpl newcert = new X509CertImpl(cinfo2);//创建一个证书并使用签发者的私钥对待签发者进行签名
        newcert.sign(caprk, "SHA256WithRSA");
        System.out.println(newcert);
        ks.setCertificateEntry("cgp", newcert);//将新条目存入到密钥库中
        FileOutputStream fos = new FileOutputStream("e:\\cert\\M13521166690_20151208100030424.jks");//再把密钥库输出到一个新的密钥库中
        ks.store(fos, "111111".toCharArray());
        fos.close();
    }
}