import org.spongycastle.asn1.x509.SubjectPublicKeyInfo; //导入依赖的package包/类
private Certificate generateSelfSignedCertChain(KeyPair kp, X500Name subject, String hostname)
        throws CertificateException, OperatorCreationException, IOException {
    SecureRandom rand = new SecureRandom();
    PrivateKey privKey = kp.getPrivate();
    PublicKey pubKey = kp.getPublic();
    ContentSigner sigGen = new JcaContentSignerBuilder(DEFAULT_SIG_ALG).build(privKey);

    SubjectPublicKeyInfo subPubKeyInfo = new SubjectPublicKeyInfo(
            ASN1Sequence.getInstance(pubKey.getEncoded()));

    Date now = new Date(); // now

    /* force it to use a English/Gregorian dates for the cert, hardly anyone
       ever looks at the cert metadata anyway, and its very likely that they
       understand English/Gregorian dates */
    Calendar c = new GregorianCalendar(Locale.ENGLISH);
    c.setTime(now);
    c.add(Calendar.YEAR, 1);
    Time startTime = new Time(now, Locale.ENGLISH);
    Time endTime = new Time(c.getTime(), Locale.ENGLISH);

    X509v3CertificateBuilder v3CertGen = new X509v3CertificateBuilder(
            subject,
            BigInteger.valueOf(rand.nextLong()),
            startTime,
            endTime,
            subject,
            subPubKeyInfo);

    if (hostname != null) {
        GeneralNames subjectAltName = new GeneralNames(
                new GeneralName(GeneralName.iPAddress, hostname));
        v3CertGen.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);
    }

    X509CertificateHolder certHolder = v3CertGen.build(sigGen);
    return new JcaX509CertificateConverter().getCertificate(certHolder);
}
 

import org.spongycastle.asn1.x509.SubjectPublicKeyInfo; //导入依赖的package包/类
static PublicKey buildPublicKey(byte[] rawBytes) throws CryptoException {
    try {
        //FIXME replacing X509EncodedKeySpec because of problem with 8.1
        //Since 8.1 Bouncycastle cryptography was replaced with implementation from Conscrypt
        //https://developer.android.com/about/versions/oreo/android-8.1.html
        //either it's a bug in Conscrypt, our public key DER structure or use of X509EncodedKeySpec changed
        //alternative needed as this adds expensive Spongycastle dependence
        ASN1InputStream bIn = new ASN1InputStream(new ByteArrayInputStream(rawBytes));
        SubjectPublicKeyInfo info = SubjectPublicKeyInfo
                .getInstance(new ASN1InputStream(bIn.readObject().getEncoded()).readObject());
        DLSequence dlSequence = (DLSequence) ASN1Primitive.fromByteArray(info.getPublicKeyData().getBytes());
        BigInteger modulus = ((ASN1Integer) dlSequence.getObjectAt(0)).getPositiveValue();
        BigInteger exponent = ((ASN1Integer) dlSequence.getObjectAt(1)).getPositiveValue();

        RSAPublicKeySpec spec = new RSAPublicKeySpec(modulus, exponent);
        KeyFactory kf = getRSAKeyFactory();
        return kf.generatePublic(spec);
    } catch (InvalidKeySpecException | IOException e) {
        throw new CryptoException(e);
    }
}
 

import org.spongycastle.asn1.x509.SubjectPublicKeyInfo; //导入依赖的package包/类
TempJCERSAPublicKey(
    SubjectPublicKeyInfo    info)
{
    try
    {
        RSAPublicKeyStructure   pubKey = new RSAPublicKeyStructure((ASN1Sequence)info.parsePublicKey());

        this.modulus = pubKey.getModulus();
        this.publicExponent = pubKey.getPublicExponent();
    }
    catch (IOException e)
    {
        throw new IllegalArgumentException("invalid info structure in RSA public key");
    }
}
 

import org.spongycastle.asn1.x509.SubjectPublicKeyInfo; //导入依赖的package包/类
public static X509Certificate generateCertificate(OutputStream output) throws NoSuchAlgorithmException, OperatorCreationException, CertificateException, KeyStoreException, NoSuchProviderException, IOException {
	BouncyCastleProvider provider = new BouncyCastleProvider(); // Use SpongyCastle provider, supports creating X509 certs
	KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
	generator.initialize(2048, new SecureRandom());
	
	KeyPair keyPair = generator.generateKeyPair();
	
	SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
	ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider(provider).build(keyPair.getPrivate());
	
	Date startDate = new Date();
	Calendar calendar = Calendar.getInstance();
	calendar.setTime(startDate);
	calendar.add(Calendar.YEAR, YEARS_VALID);
    Date endDate = calendar.getTime();
	
	X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(new X500Name(ISSUER),
			BigInteger.ONE, 
			startDate, endDate, new X500Name(ISSUER),
			publicKeyInfo);

	X509CertificateHolder certificateHolder = certBuilder.build(signer);
	
	X509Certificate certificate = new JcaX509CertificateConverter().setProvider(provider).getCertificate(certificateHolder);
	
	KeyStore keyStore = KeyStore.getInstance("PKCS12", provider);
	keyStore.load(null, null);
	keyStore.setKeyEntry("Jumble Key", keyPair.getPrivate(), null, new X509Certificate[] { certificate });
	
	keyStore.store(output, "".toCharArray());
	
	return certificate;
}
 

import org.spongycastle.asn1.x509.SubjectPublicKeyInfo; //导入依赖的package包/类
/**
 * Create a self-signed X.509 Certificate
 *
 * @param dn the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
 */
private X509Certificate generateCertificate(String dn) throws Exception {

    X500Name x500nameIssuer = new X500Name("CN=TestCA,L=Den Haag, C=NL");
    X500Name x500nameSubject = new X500Name(dn);
    BigInteger serial = new BigInteger(64, new Random());
    Date notBefore = new Date();

    // Set Expiration Date
    Calendar tempCal = Calendar.getInstance();
    tempCal.setTime(notBefore);
    tempCal.add(Calendar.DATE, 365);
    Date notAfter = tempCal.getTime();

    // Create Pubkey
    RSAKeyPairGenerator keyGen = new RSAKeyPairGenerator();
    keyGen.init(new RSAKeyGenerationParameters(new BigInteger("10001", 16), SecureRandom.getInstance("SHA1PRNG"), 1024, 80));
    AsymmetricCipherKeyPair keys = keyGen.generateKeyPair();
    SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfoFactory.createSubjectPublicKeyInfo(keys.getPublic());

    X509v3CertificateBuilder builder = new X509v3CertificateBuilder(
            x500nameIssuer,
            serial,
            notBefore,
            notAfter,
            Locale.US,
            x500nameSubject,
            subPubKeyInfo
    );

    try {
        // Export Private Key Info into Java PrivateKey
        BigInteger modulus = ((RSAKeyParameters) keys.getPrivate()).getModulus();
        BigInteger exponent = ((RSAKeyParameters) keys.getPrivate()).getExponent();
        RSAPrivateKeySpec privateSpec = new RSAPrivateKeySpec(modulus, exponent);
        KeyFactory factory = KeyFactory.getInstance("RSA");

        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").build(factory.generatePrivate(privateSpec));

        X509CertificateHolder holder = builder.build(sigGen);
        InputStream is = new ByteArrayInputStream(holder.toASN1Structure().getEncoded());
        return (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(is);

    } catch (OperatorCreationException e) {
        e.printStackTrace();
    }

    throw new Exception("Unable to Create Test X509 Cert");
}
 

import org.spongycastle.asn1.x509.SubjectPublicKeyInfo; //导入依赖的package包/类
public Certificate(RtPkcs11 pkcs11, NativeLong session, NativeLong object)
        throws Pkcs11CallerException {
    CK_ATTRIBUTE[] attributes = (CK_ATTRIBUTE[]) (new CK_ATTRIBUTE()).toArray(2);
    attributes[0].type = Pkcs11Constants.CKA_SUBJECT;
    attributes[1].type = Pkcs11Constants.CKA_VALUE;

    NativeLong rv = pkcs11.C_GetAttributeValue(session, object,
            attributes, new NativeLong(attributes.length));
    if (!rv.equals(Pkcs11Constants.CKR_OK)) throw Pkcs11Exception.exceptionWithCode(rv);

    for (CK_ATTRIBUTE attr : attributes) {
        attr.pValue = new Memory(attr.ulValueLen.intValue());

    }

    rv = pkcs11.C_GetAttributeValue(session, object,
            attributes, new NativeLong(attributes.length));
    if (!rv.equals(Pkcs11Constants.CKR_OK)) throw Pkcs11Exception.exceptionWithCode(rv);

    byte[] subjectValue =
            attributes[0].pValue.getByteArray(0, attributes[0].ulValueLen.intValue());
    mSubject = X500Name.getInstance(subjectValue);
    if (mSubject == null) throw new CertNotFoundException();

    byte[] keyValue = null;
    try {
        X509CertificateHolder certificateHolder = new X509CertificateHolder(
                attributes[1].pValue.getByteArray(0, attributes[1].ulValueLen.intValue()));
        SubjectPublicKeyInfo publicKeyInfo = certificateHolder.getSubjectPublicKeyInfo();
        keyValue = publicKeyInfo.parsePublicKey().getEncoded();
    } catch (IOException exception) {
        throw new CertParsingException();
    }

    if (keyValue == null) throw new KeyNotFoundException();

    // уберём заголовок ключа (первые 2 байта)
    keyValue = Arrays.copyOfRange(keyValue, 2, keyValue.length);
    CK_ATTRIBUTE[] template = (CK_ATTRIBUTE[]) (new CK_ATTRIBUTE()).toArray(2);

    final NativeLongByReference keyClass =
            new NativeLongByReference(Pkcs11Constants.CKO_PUBLIC_KEY);
    template[0].type = Pkcs11Constants.CKA_CLASS;
    template[0].pValue = keyClass.getPointer();
    template[0].ulValueLen = new NativeLong(NativeLong.SIZE);

    ByteBuffer valueBuffer = ByteBuffer.allocateDirect(keyValue.length);
    valueBuffer.put(keyValue);
    template[1].type = Pkcs11Constants.CKA_VALUE;
    template[1].pValue = Native.getDirectBufferPointer(valueBuffer);
    template[1].ulValueLen = new NativeLong(keyValue.length);

    NativeLong pubKeyHandle = findObject(pkcs11, session, template);
    if (pubKeyHandle == null) throw new KeyNotFoundException();

    CK_ATTRIBUTE[] idTemplate = (CK_ATTRIBUTE[]) (new CK_ATTRIBUTE()).toArray(1);
    idTemplate[0].type = Pkcs11Constants.CKA_ID;

    rv = pkcs11.C_GetAttributeValue(session, pubKeyHandle,
            idTemplate, new NativeLong(idTemplate.length));
    if (!rv.equals(Pkcs11Constants.CKR_OK)) throw Pkcs11Exception.exceptionWithCode(rv);

    idTemplate[0].pValue = new Memory(idTemplate[0].ulValueLen.intValue());

    rv = pkcs11.C_GetAttributeValue(session, pubKeyHandle,
            idTemplate, new NativeLong(idTemplate.length));
    if (!rv.equals(Pkcs11Constants.CKR_OK)) throw Pkcs11Exception.exceptionWithCode(rv);

    mKeyPairId = idTemplate[0].pValue.getByteArray(0, idTemplate[0].ulValueLen.intValue());
}