使用另一个自签名 x509Certificate 签署 X509Certificate [作为 CA]

Question

我已经创建了一个自签名证书并成功对其进行了编码。但我想用另一个自签名证书签署此证书，该证书将充当证书颁发机构。

代码如下：

X509Certificate caCert;
KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load(null, null);
CertAndKeyGen keypair = new CertAndKeyGen("RSA", "SHA1WithRSA", null);
X500Name x500Name = new X500Name(commonName, organizationalUnit, organization, city, state, country);
keypair.generate(keysize);
PrivateKey privKey = keypair.getPrivateKey();

X509Certificate[] chain = new X509Certificate[1];

chain[0] = keypair.getSelfCertificate(x500Name, new Date(), (long) validity * 24 * 60 * 60);
keypair.getCertRequest(x500Name);

keyStore.setKeyEntry(alias, privKey, keyPass, chain);

keyStore.store(new FileOutputStream("test.keystore"), keyPass);
caCert = (X509Certificate) keyStore.getCertificate(alias);
File crtFile = new File("saif.der");
writeCertificate(new FileOutputStream(crtFile), caCert);

Answer 1

使用 bouncycastle 的 X509V3CertificateGenerator class 创建用户证书。然后最后使用X509V3CertificateGenerator.generateX509Certificate(privateKey)方法生成X509Certificate。这里的私钥将是来自 PKCS12 的自签名证书的私钥。以 PKCS12 格式保存用户证书。