使用自签名证书生成签名

Question

我有以下使用自签名证书生成签名的示例代码

public static String generateSignature(String data) throws Exception {

        System.out.println("@@inside generateSignature: " + data);

        String signature;

        String jksFilepath = "E:\test.jks";

        try {
            // Adding Security Provider for PKCS 12
            Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
            // Setting password for the e-Token

            // logging into token
            ks = KeyStore.getInstance("jks");


            FileInputStream fileInputStream = new FileInputStream(jksFilepath);

            // Loading Keystore
            // System.out.println("loading keystore");
            ks.load(fileInputStream, JKSPassword);
            Enumeration<String> e = ks.aliases();

            while (e.hasMoreElements()) {
                alias = e.nextElement();
                // System.out.println("Alias of the e-Token : "+ alias);

                UserCert = (X509Certificate) ks.getCertificate(alias);

                UserCertPubKey = (PublicKey) ks.getCertificate(alias).getPublicKey();

                // System.out.println("loading Private key");
                UserCertPrivKey = (PrivateKey) ks.getKey(alias, JKSPassword);
            }

            // Method Call to generate Signature
            signature = MakeSignature(data);

            return signature;

        } catch (Exception e) {
            e.printStackTrace();
            System.out.println("generateSignature" + e.getCause());
            throw new Exception();
        }

    }

    private static String MakeSignature(String data) {

        System.out.println("@@inside MakeSignature...");

        try {
            PrivateKey privateKey = (PrivateKey) ks.getKey(alias, JKSPassword);
            myPubCert = (X509Certificate) ks.getCertificate(alias);
            Store certs = new JcaCertStore(Arrays.asList(myPubCert));

            CMSSignedDataGenerator generator = new CMSSignedDataGenerator();

            generator.addSignerInfoGenerator(new JcaSimpleSignerInfoGeneratorBuilder().setProvider("BC").build("SHA256withRSA", privateKey, myPubCert));

            generator.addCertificates(certs);

            CMSTypedData data1 = new CMSProcessableByteArray(data.getBytes());

            CMSSignedData signed = generator.generate(data1, true);

            BASE64Encoder encoder = new BASE64Encoder();

            String signedContent = encoder.encode((byte[]) signed.getSignedContent().getContent());

            String envelopedData = encoder.encode(signed.getEncoded());

            return envelopedData;
        } catch (Exception e) {
            e.printStackTrace();
            System.out.println("MakeSignature ==" + e.getCause());
            return "";
        }
    }

还有一些相关的功能，但是为了简单起见，我就不加了。

现在我想使用 PHP 做完全相同的事情。

JKS 无法在 PHP 上作为 Java.

的密钥库

我尝试了 open_ssl 函数和不同的加密方法集。但是我没有得到与我通过此 java 代码获得的预期结果相同的结果（"not same" 是关于生成签名的比特率和长度）。

有人可以帮我在 PHP 中实现相同的签名生成吗？

Answer 1

我觉得PHP官方文档写的很清楚：http://php.net/manual/en/function.openssl-csr-new.php

示例 #1 创建自签名证书

<?php
$dn = array(
    "countryName" => "GB",
    "stateOrProvinceName" => "Somerset",
    "localityName" => "Glastonbury",
    "organizationName" => "The Brain Room Limited",
    "organizationalUnitName" => "PHP Documentation Team",
    "commonName" => "Wez Furlong",
    "emailAddress" => "wez@example.com"
);

// Generate a new private (and public) key pair
$privkey = openssl_pkey_new(array(
    "private_key_bits" => 2048,
    "private_key_type" => OPENSSL_KEYTYPE_RSA,
));

// Generate a certificate signing request
$csr = openssl_csr_new($dn, $privkey, array('digest_alg' => 'sha256'));

// Generate a self-signed cert, valid for 365 days
$x509 = openssl_csr_sign($csr, null, $privkey, $days=365, array('digest_alg' => 'sha256'));

// Save your private key, CSR and self-signed cert for later use
openssl_csr_export($csr, $csrout) and var_dump($csrout);
openssl_x509_export($x509, $certout) and var_dump($certout);
openssl_pkey_export($privkey, $pkeyout, "mypassword") and var_dump($pkeyout);

// Show any errors that occurred here
while (($e = openssl_error_string()) !== false) {
    echo $e . "\n";
}

然后就可以调用openssl_sign:http://php.net/manual/en/function.openssl-sign.php，使用生成的私钥进行签名。

如果你想在PHP代码中使用Java(JKS)的密钥，你应该先导出密钥，然后使用PHP函数加载密钥。

Answer 2

以下代码 Java 和 PHP 从 PKCS12 密钥库 (keystore.pfx) 中获取一个私钥并签署 data.txt 文件的内容。使用相同的密钥库和数据两个实现 return 完全相同的输出：

我只使用普通 Java（没有 bouncycastle）因为 java.security 类可以很好地处理 PKCS12 输入：

public static void main(String[] args) throws Exception {

    String keyStoreFile = "keystore.pfx";
    char[] password = "password".toCharArray();

    String dataFile = "data.txt";

    PrivateKey priv = loadPrivateKey(keyStoreFile, password);

    byte[] signature = signData(priv, dataFile);

    System.out.println(Base64.getEncoder().encodeToString(signature));
}

private static byte[] signData(PrivateKey priv, String dataFile) throws Exception {
    Signature dsa = Signature.getInstance("SHA256withRSA");

    dsa.initSign(priv);

    try (FileInputStream fis = new FileInputStream(dataFile);
         BufferedInputStream bufin = new BufferedInputStream(fis);) {

        byte[] buffer = new byte[1024];
        int len;
        while ((len = bufin.read(buffer)) >= 0) {
            dsa.update(buffer, 0, len);
        }

        bufin.close();

        byte[] realSig = dsa.sign();
        return realSig;
    }
}

private static PrivateKey loadPrivateKey(String keyStoreFile, char[] password) throws Exception {
    try (FileInputStream fin = new FileInputStream(keyStoreFile)) {
        KeyStore ks = KeyStore.getInstance("PKCS12", "SunJSSE");
        ks.load(fin, password);
        PrivateKey priv = (PrivateKey) ks.getKey("1", password);
        return priv;
    }
}

和 PHP 版本：

<?php
//data you want to sign
$data = file_get_contents("data.txt");

$cert_store = file_get_contents("keystore.pfx");
openssl_pkcs12_read($cert_store, $cert_info, "password");

//create signature
openssl_sign($data, $signature, $cert_info['pkey'], OPENSSL_ALGO_SHA256);

//finally encode
$r = base64_encode($signature);
print $r;
?>

我使用 OpenSSL 生成了 PKCS12 keystore.pfx 文件：

# generate new RSA private key
openssl genrsa -out private.pem 1024
# CSR and signed certificate are needed to export as PKCS12 store
openssl req -new -key private.pem -out certificate.csr
openssl x509 -req -days 365 -in certificate.csr -signkey private.pem -out certificate.crt
# export as PKCS12 keystore
openssl pkcs12 -export -out keystore.pfx -inkey private.pem -in certificate.crt -passout pass:password

您也可以使用 OpenSSL 签署 data.txt：

openssl dgst -sha256 -sign private.pem < data.txt | openssl base64

所有版本都会输出相同的结果。

如果你有一个JKS keystore并且想使用存储在这个keystore中的私钥，你可以将JKS keystore导出到PKCS12：

keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.pfx \
    -srcstoretype JKS -deststoretype PKCS12 -deststorepass password \
    -srcalias alias -destalias 1

还有一点要注意，因为这似乎总是令人困惑：

您不使用证书签署数据。您使用（私人）密钥签署数据。证书或多或少只是一段用私钥签名的数据。自签名证书使用您自己的私钥签名。而证书颁发机构 (CA) 颁发的证书是使用 CA 的私钥签名的。

在上面的示例中，生成的证书签名请求 (CSR) 和证书基本上只是为了将私钥导入 PKCS12 密钥库而创建的。您也可以使用普通 private.pem 密钥文件进行签名，但是当您使用 PKCS12 密钥库时，我也做了同样的事情。

使用自签名证书生成签名

Generating signature using self signed certificate

php

java

x509certificate

self-signed-certificate