Java生成SM2证书基于BouncyCastle(cer)
可以先加QQ 783021975 咨询相关问题。代码后续会更新一部分
【SM2证书】利用BC的X509v3CertificateBuilder组装X509国密证书
整理中。完全是Java代码调用BouncCastle生成的哦。先来个图看下 签名算法 和 公钥参数都是 符合SM2算法的
2018年6月22日更新:CRL分布点，添加证书策略，颁发者密钥标识，使用者密钥标识，密钥用法，增强密钥用法，基本约束
可以先加QQ 783021975 咨询相关问题。
2017年8月17日10:37:14 增加生成cer证书代码
1 /** 2 * 国密证书签名算法标识 3 */ 4 private static String SignAlgor = "1.2.156.10197.1.501"; 5 /** 6 * 生成国密ROOT证书方法 7 * @param pageCert.getCn()+","+ 8 * @throws Exception 9 */ 10 public static void genSM2CertByRoot() throws Exception { 11 SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); 12 org.bouncycastle.jce.provider.BouncyCastleProvider bouncyCastleProvider = new org.bouncycastle.jce.provider.BouncyCastleProvider(); 13 Security.addProvider(bouncyCastleProvider); 14 //证书的名称 15 String fileName = "root"+new Date().getTime()/1000; 16 String path = "保存的路径"; 17 String rootCertPath = path+fileName+".cer"; 18 try { 19 KeyPair kp = KeyGenUtil.getKeyPair2SM2(path,fileName);//这块就是生成SM2公私钥对 https://zb.oschina.net/service/70e3fdaf699a724b 20 System.out.println("=====公钥算法====="+kp.getPublic().getAlgorithm()); 21 BCECPrivateKey bcecPrivateKey = (BCECPrivateKey) kp.getPrivate();//使用ECPrivateKey PrivateKey都可以 22 BCECPublicKey bcecPublicKey = (BCECPublicKey) kp.getPublic();//使用ECPublicKey PublicKey都可以 23 //申请服务器证书信息 我是通过网页得到传递的参数 。如果测试 写死即可。这一步没有什么的。 24 X500Principal principal = new X500Principal("CN=小帅丶博客,O=小帅丶博客"); 25 //X500Principal principal = new X500Principal("CN="+pageCert.getCn()+",O="+pageCert.getO()); 26 X509V3CertificateGenerator certGen = new X509V3CertificateGenerator(); 27 certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis())); 28 certGen.setIssuerDN(principal);certGen.setNotBefore(new Date()); 29 certGen.setNotAfter(CertAuthAssist.getYearLater(5)); 30 certGen.setSubjectDN(principal); 31 certGen.setSignatureAlgorithm(SignAlgor); 32 certGen.setPublicKey(bcecPublicKey); 33 //添加CRL分布点 QQ:783021975 34 certGen.addExtension(Extension.cRLDistributionPoints, true, XSCertExtension.getCRLDIstPoint()); 35 //添加证书策略 QQ:783021975 36 certGen.addExtension(Extension.certificatePolicies, true, new DERSequence(XSCertExtension.getPolicyInfo())); 37 //颁发者密钥标识 38 DigestCalculator calculator = new BcDigestCalculatorProvider().get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1)); 39 X509ExtensionUtils extensionUtils = new X509ExtensionUtils(calculator ); 40 certGen.addExtension(Extension.authorityKeyIdentifier, false, extensionUtils.createAuthorityKeyIdentifier(publicKeyInfo)); 41 //使用者密钥标识 42 certGen.addExtension(Extension.subjectKeyIdentifier, false,extensionUtils.createSubjectKeyIdentifier(publicKeyInfo)); 43 //密钥用法 QQ:783021975 44 certGen.addExtension(Extension.keyUsage,true,XSCertExtension.getKeyUsage()); 45 //增强密钥用法 QQ:783021975 46 certGen.addExtension(Extension.extendedKeyUsage,true,XSCertExtension.getExtendKeyUsage()); 47 //基本约束 48 BasicConstraints basicConstraints = new BasicConstraints(0); 49 certGen.addExtension(Extension.basicConstraints, true, basicConstraints); 50 X509Certificate rootCert = certGen.generateX509Certificate(bcecPrivateKey, "BC"); 51 FileOutputStream outputStream = new FileOutputStream(rootCertPath); 52 outputStream.write(rootCert.getEncoded());outputStream.close(); 53 } catch (Exception e) { 54 logger.info("======根证书申请失败"+e.getMessage());return null; 55 } 56}
自愿购买 有需要请加QQ:783021975
CertAuthAssist.getYearLater()方法：
1/** 2 * 计算当前时间的N年后 3 * @param later 正整数 4 * @return 5 */ 6 public static Date getYearLater(int later) { 7 Date date = new Date(); 8 try { 9 Calendar calendar = Calendar.getInstance(); 10 calendar.add(Calendar.YEAR,later); 11 date = calendar.getTime(); 12 } catch (Exception e) { 13 System.out.println(e.getMessage()); 14 } 15 return date; 16 }
本项目支持
1.生成RSA算法cer证书
2.SM2算法cer证书。
3.生成根证书。子证书。三级证书
4.字符串公私钥转 公私钥对象 支持SM2算法
需要用到的BC包
1 <!-- https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk15on --> 2 <dependency> 3 <groupId>org.bouncycastle</groupId> 4 <artifactId>bcpkix-jdk15on</artifactId> 5 <version>1.57</version> 6 </dependency> 7 <!-- https://mvnrepository.com/artifact/org.bouncycastle/bcmail-jdk16 --> 8 <dependency> 9 <groupId>org.bouncycastle</groupId> 10 <artifactId>bcmail-jdk15on</artifactId> 11 <version>1.56</version> 12 </dependency>
模块说明
