我正在尝试将JXTA移植到App Engine上运行。鉴于BouncyCastle“BC”提供程序尚未受到App Engine的支持,我必须将现有的JXTA代码移植到使用白名单类生成X509Certificate。我的加密知识很少,我不确定我所尝试的是否可行。这是来自JXTA项目的PSEUtils.java的原始代码:
在该方法中:
问题在于我无法让
我找到了以下SO链接,演示了这段代码的工作方式: 我尝试转换genCert,但由于某种原因,我无法从编码的公钥创建SubjectPublicKeyInfo?
非常感谢您的帮助。
有一个辅助类,其中包含了java.security.cert.X509Certificate:
public static class IssuerInfo {
public X509Certificate cert; // subject Cert
public PrivateKey subjectPkey; // subject private key
public X509Certificate issuer; // issuer Cert
public PrivateKey issuerPkey; // issuer private key
}
在该方法中:
public static IssuerInfo genCert(X500Principal subject, KeyPair keypair, IssuerInfo issuerinfo)
我将主题作为参数传入:
new X500Principal("CN="+useCN)
密钥对(来自原始代码):
KeyPairGenerator g = KeyPairGenerator.getInstance("RSA");
g.initialize(1024, UTILS.srng);
KeyPair keypair = g.generateKeyPair();
并且jxta编码的IssuerInfo。
现在,由于我无法引入bouncycastle.jce包,因此必须删除JXTA使用的X509Principal和X509V3CertificateGenerator代码,并尝试使用符合GAE限制的实现进行替换。以下是我目前使用org.bouncycastle.X509.X509v3CertificateBuilder生成证书的方法。
SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keypair.getPublic().getEncoded());
X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
new X500Name(issuer.getName()),
BigInteger.ONE,
today, until,
new X500Name(subject.getName()),
subPubKeyInfo);
问题在于我无法让
keypair.getPublic().getEncoded()
与 SubjectPublicKeyInfo.getInstance()
方法一起工作。会抛出java.lang.IllegalArgumentException: unknown object in factory: [B异常。
经检查,公钥似乎已经被填充:
Sun RSA public key, 1024 bits
modulus: 117521430893506212334140912845641570591161279468597426442875306202350445904550279678434051874985419676760802566018092318362676224355315431299979507080364677679613392086245588766565617009250512996843008784370448997729071786062596049780632058501646041736216482596596901215941577208285499619376322050871534546271
public exponent: 65537
我找到了以下SO链接,演示了这段代码的工作方式: 我尝试转换genCert,但由于某种原因,我无法从编码的公钥创建SubjectPublicKeyInfo?
非常感谢您的帮助。
public static IssuerInfo genCert(X500Principal subject, KeyPair keypair, IssuerInfo issuerinfo) {
IssuerInfo info = new IssuerInfo();
try {
// set up issuer
PrivateKey signer;
X500Principal issuer;
if (null == issuerinfo) { // self-signed root cert
signer = keypair.getPrivate();
issuer = new X500Principal(subject.getEncoded());
} else { // issuer signed service sert
signer = issuerinfo.subjectPkey;
X500Principal issuer_subject = issuerinfo.cert.getSubjectX500Principal();
issuer = new X500Principal(issuer_subject.getEncoded());
}
// set validity 10 years from today
Date today = new Date();
Calendar cal = Calendar.getInstance();
cal.setTime(today);
cal.add(Calendar.YEAR, 10);
Date until = cal.getTime();
SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(keypair.getPublic().getEncoded());
//**Can't get here so i'm not sure if the rest of this works?**
AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA");
AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
RSAPrivateCrtKeyParameters cps = (RSAPrivateCrtKeyParameters) keypair.getPrivate();
ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(cps);
X509CertificateHolder certHolder = v3CertGen.build(sigGen);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
// Read user Certificate
InputStream is1 = new ByteArrayInputStream(certHolder.getEncoded());
X509Certificate eeCert = (X509Certificate) cf.generateCertificate(is1);
is1.close();