生成 X509 证书时得到 "data isn't an object ID (tag = 49)"

Question

我正在尝试为我的密钥库生成我自己的 CSR，但它并不顺利，那个错误让我很困惑。这是我的代码：

import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.bouncycastle.pkcs.PKCS10CertificationRequestBuilder;
import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder;

public class CreateKeyTest {

    public static void main(String[] args) throws OperatorCreationException, IOException, GeneralSecurityException {
    KeyPairGenerator kpg;
    KeyPair kp;
    RSAPublicKey pubKey;
    RSAPrivateKey privKey;

    FileOutputStream out;
    KeyStore ks;
    FileInputStream in;
    FileInputStream bFis;

    try {
        ks = KeyStore.getInstance("JKS");

        kpg = KeyPairGenerator.getInstance("RSA");
        kpg.initialize(1024);
        kp = kpg.generateKeyPair();
        pubKey = (RSAPublicKey) kp.getPublic();
        privKey = (RSAPrivateKey) kp.getPrivate();

        // generate CSR
        ContentSigner sign = new JcaContentSignerBuilder("SHA1withRSA").build(privKey);

        X500NameBuilder nBuilder = new X500NameBuilder();
        nBuilder.addRDN(BCStyle.CN, "TestCSR");
        nBuilder.addRDN(BCStyle.C, "ER");
        nBuilder.addRDN(BCStyle.E, "test@test.com");
        X500Name name = nBuilder.build();

        PKCS10CertificationRequestBuilder cerReq = new JcaPKCS10CertificationRequestBuilder(name, pubKey);
        PKCS10CertificationRequest request = cerReq.build(sign);

        PEMWriter pWr = new PEMWriter(new FileWriter(new File("D:\test.csr")));
        pWr.writeObject(request);
        pWr.flush();
        pWr.close();

        bFis = new FileInputStream("D:\test.csr");
        BufferedInputStream ksbufin = new BufferedInputStream(bFis);
        X509Certificate certificate = (X509Certificate) CertificateFactory.getInstance("X.509")
                .generateCertificate(ksbufin);

        ks.setKeyEntry("RSA_key", kp.getPrivate(), "changeit".toCharArray(),
                new java.security.cert.Certificate[] { certificate });

        out = new FileOutputStream("key.store");
        ks.store(out, "changeit".toCharArray());

        System.out.println("New Keystore Generated");
        out.close();
    } catch (KeyStoreException | IOException | CertificateException | NoSuchAlgorithmException
            | OperatorCreationException e) {
        System.out.println(e.getMessage());
        e.printStackTrace();
    }
}
}

当我执行它时，它给我显示异常：X509.ObjectIdentifier() -- data isn't an object ID (tag = 49)，并且可以回溯到generateCertificate(ksbufin)。但是我检查了 test.cer 里面确实有证书数据，那个异常消息让我很困惑，甚至不知道那是什么意思（object ID？tag = 49？我没有请参阅我在代码中生成了一个 ID。）。

谁能帮我解决这个问题？

Answer 1

错误信息正确，test.csr不包含证书。您使用 PKCS10CertificationRequest 构建了它，因此它包含一个证书签名请求 (CSR)。

您已经生成了一对私钥和 public，以及一个 CSR。 CSR 是对证书颁发机构 (CA) 的证书请求。它包含 public 密钥和证书的一些预期属性（CN、C、OU 等）。 CSR 使用私钥签名，必须发送给 CA。 CA 将提取 public 密钥，生成证书并对其进行签名。参见

如果您想要证书，您需要获得 CA 对证书的签名

生成 X509 证书时得到 "data isn't an object ID (tag = 49)"

Got "data isn't an object ID (tag = 49)" while generating X509 cert

java

keystore

csr