JAVA认证 百分网手机站

JAVA对数字证书的常用操作

时间:2017-05-12 15:21:08 JAVA认证 我要投稿

JAVA对数字证书的常用操作

  Java是一个面向对象的语言。对程序员来说,这意味着要注意应中的数据和操纵数据的方法(method),而不是严格地用过程来思考。以下是关于JAVA对数字证书的常用操作,欢迎大家参考!

  一:需要包含的包

  import java.security. * ;

  import java.io. * ;

  import java.util. * ;

  import java.security. * ;

  import java.security.cert. * ;

  import sun.security.x509. *

  import java.security.cert.Certificate;

  import java.security.cert.CertificateFactory;

  二:从文件中读取证书

  用keytool将.keystore中的证书写入文件中,然后从该文件中读取证书信息

  CertificateFactory cf = CertificateFactory.getInstance( " X.509 " );

  FileInputStream in = new FileInputStream( " out.csr " );

  Certificate c = cf.generateCertificate(in);

  String s = c.toString();

  三:从密钥库中直接读取证书

  String pass = " 123456 " ;

  FileInputStream in = new FileInputStream( " .keystore " );

  KeyStore ks = KeyStore.getInstance( " JKS " );

  ks.load(in,pass.toCharArray());

  java.security.cert.Certificate c = ks.getCertificate(alias); // alias为条目的别名

  四:JAVA程序中显示证书指定信息

  System.out.println( " 输出证书信息:\n " + c.toString());

  System.out.println( " 版本号: " + t.getVersion());

  System.out.println( " 序列号: " + t.getSerialNumber().toString( 16 ));

  System.out.println( " 主体名: " + t.getSubjectDN());

  System.out.println( " 签发者: " + t.getIssuerDN());

  System.out.println( " 有效期: " + t.getNotBefore());

  System.out.println( " 签名算法: " + t.getSigAlgName());

  byte [] sig = t.getSignature(); // 签名值

  PublicKey pk = t.getPublicKey();

  byte [] pkenc = pk.getEncoded();

  System.out.println( " 公钥 " );

  for ( int i = 0 ;i < pkenc.length;i ++ )System.out.print(pkenc[i] + " , " );

  五:JAVA程序列出密钥库所有条目

  String pass = " 123456 " ;

  FileInputStream in = new FileInputStream( " .keystore " );

  KeyStore ks = KeyStore.getInstance( " JKS " );

  ks.load(in,pass.toCharArray());

  Enumeration e = ks.aliases();

  while (e.hasMoreElements())

  java.security.cert.Certificate c = ks.getCertificate((String)e.nextElement());

  六:JAVA程序修改密钥库口令

  String oldpass = " 123456 " ;

  String newpass = " 654321 " ;

  FileInputStream in = new FileInputStream( " .keystore " );

  KeyStore ks = KeyStore.getInstance( " JKS " );

  ks.load(in,oldpass.toCharArray());

  in.close();

  FileOutputStream output = new FileOutputStream( " .keystore " );

  ks.store(output,newpass.toCharArray());

  output.close();

  七:JAVA程序修改密钥库条目的口令及添加条目

  FileInputStream in = new FileInputStream( " .keystore " );

  KeyStore ks = KeyStore.getInstance( " JKS " );

  ks.load(in,storepass.toCharArray());

  Certificate [] cchain = ks.getCertificate(alias);获取别名对应条目的证书链

  PrivateKey pk = (PrivateKey)ks.getKey(alias,oldkeypass.toCharArray());获取别名对应条目的私钥

  ks.setKeyEntry(alias,pk,newkeypass.toCharArray(),cchain);向密钥库中添加条目

  第一个参数指定所添加条目的别名,假如使用已存在别名将覆盖已存在条目,使用新别名将增加一个新条目,第二个参数为条目的私钥,第三个为设置的新口令,第四个为该私钥的公钥的证书链

  FileOutputStream output=new FileOutputStream("another");

  ks.store(output,storepass.toCharArray())将keystore对象内容写入新文件

  八:JAVA程序检验别名和删除条目

  FileInputStream in = new FileInputStream( " .keystore " );

  KeyStore ks = KeyStore.getInstance( " JKS " );

  ks.load(in,storepass.toCharArray());

  ks.containsAlias( " sage " );检验条目是否在密钥库中,存在返回true

  ks.deleteEntry( " sage " );删除别名对应的条目

  FileOutputStream output = new FileOutputStream( " .keystore " );

  ks.store(output,storepass.toCharArray())将keystore对象内容写入文件,条目删除成功

  九:JAVA程序签发数字证书

  (1)从密钥库中读取CA的证书

  FileInputStream in = new FileInputStream( " .keystore " );

  KeyStore ks = KeyStore.getInstance( " JKS " );

  ks.load(in,storepass.toCharArray());

  java.security.cert.Certificate c1 = ks.getCertificate( " caroot " );

  (2)从密钥库中读取CA的私钥

  PrivateKey caprk = (PrivateKey)ks.getKey(alias,cakeypass.toCharArray());

  (3)从CA的证书中提取签发者的信息

  byte [] encod1 = c1.getEncoded(); 提取CA证书的编码

  X509CertImpl cimp1 = new X509CertImpl(encod1); 用该编码创建X509CertImpl类型对象

  X509CertInfo cinfo1 = (X509CertInfo)cimp1.get(X509CertImpl.NAME + " . " + X509CertImpl.INFO); 获取X509CertInfo对象

  X500Name issuer = (X500Name)cinfo1.get(X509CertInfo.SUBJECT + " . " + CertificateIssuerName.DN_NAME); 获取X509Name类型的'签发者信息

  (4)获取待签发的证书

  CertificateFactory cf = CertificateFactory.getInstance( " X.509 " );

  FileInputStream in2 = new FileInputStream( " user.csr " );

  java.security.cert.Certificate c2 = cf.generateCertificate(in);

  (5)从待签发的证书中提取证书信息

  byte [] encod2 = c2.getEncoded();

  X509CertImpl cimp2 = new X509CertImpl(encod2); 用该编码创建X509CertImpl类型对象

  X509CertInfo cinfo2 = (X509CertInfo)cimp2.get(X509CertImpl.NAME + " . " + X509CertImpl.INFO); 获取X509CertInfo对象

  (6)设置新证书有效期

  Date begindate = new Date(); 获取当前时间

  Date enddate = new Date(begindate.getTime() + 3000 * 24 * 60 * 60 * 1000L ); 有效期为3000天

  CertificateValidity cv = new CertificateValidity(begindate,enddate); 创建对象

  cinfo2.set(X509CertInfo.VALIDITY,cv); 设置有效期

  (7)设置新证书序列号

  int sn = ( int )(begindate.getTime() / 1000 ); 以当前时间为序列号

  CertificateSerialNumber csn = new CertificateSerialNumber(sn);

  cinfo2.set(X509CertInfo.SERIAL_NUMBER,csn);

  (8)设置新证书签发者

  cinfo2.set(X509CertInfo.ISSUER+"."+CertificateIssuerName.DN_NAME,issuer);应用第三步的结果

  (9)设置新证书签名算法信息

  AlgorithmId algorithm=new AlgorithmId(AlgorithmId.md5WithRSAEncryption_oid);

  cinfo2.set(CertificateAlgorithmId.NAME+"."+CertificateAlgorithmId.ALGORITHM,algorithm);

  (10)创建证书并使用CA的私钥对其签名

  X509CertImpl newcert=new X509CertImpl(cinfo2);

  newcert.sign(caprk,"MD5WithRSA"); 使用CA私钥对其签名

  (11)将新证书写入密钥库

  ks.setCertificateEntry( " lf_signed " ,newcert);

  FileOutputStream out = new FileOutputStream( " newstore " );

  ks.store(out, " newpass " .toCharArray()); 这里是写入了新的密钥库,也可以使用第七条来增加条目

  十:数字证书的检验

  (1)验证证书的有效期

  (a)获取X509Certificate类型对象

  CertificateFactory cf = CertificateFactory.getInstance( " X.509 " );

  FileInputStream in1 = new FileInputStream( " aa.crt " );

  java.security.cert.Certificate c1 = cf.generateCertificate(in1);

  X509Certificate t = (X509Certificate)c1;

  in2.close();

  (b)获取日期

  Date TimeNow=new Date();

  (c)检验有效性

  try {

  t.checkValidity(TimeNow);

  System.out.println( " OK " );

  } catch (CertificateExpiredException e) { // 过期

  System.out.println( " Expired " );

  System.out.println(e.getMessage());

  } catch ((CertificateNotYetValidException e) { // 尚未生效

  System.out.println( " Too early " );

  System.out.println(e.getMessage());}

  (2)验证证书签名的有效性

  (a)获取CA证书

  CertificateFactory cf = CertificateFactory.getInstance( " X.509 " );

  FileInputStream in2 = new FileInputStream( " caroot.crt " );

  java.security.cert.Certificate cac = cf.generateCertificate(in2);

  in2.close();

  (c)获取CA的公钥

  PublicKey pbk=cac.getPublicKey();

  (b)获取待检验的证书(上步已经获取了,就是C1)

  (c)检验证书

  boolean pass = false ;

  try {

  c1.verify(pbk);

  pass = true ;

  } catch (Exception e) {

  pass = false ;

  System.out.println(e);

【JAVA对数字证书的常用操作】相关文章:

1.java关于多线程的操作

2.JAVA IO操作知识汇总

3.Java枚举的常用方法

4.JAVA常用代码积累

5.Java数组操作方法大全

6.常用的Word操作技巧

7.电脑常用操作技巧

8.Java数组定义常用方法