import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
private X509Certificate generateVersion1(X500Name subject, X500Name issuer, Date validityStart, Date validityEnd, PublicKey publicKey,
		PrivateKey privateKey, SignatureType signatureType, BigInteger serialNumber) throws CryptoException {
	Date notBefore = validityStart == null ? new Date() : validityStart;
	Date notAfter = validityEnd == null ? new Date(notBefore.getTime() + TimeUnit.DAYS.toMillis(365)) : validityEnd;

	JcaX509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(issuer, serialNumber, notBefore,
			notAfter, subject, publicKey);

	try {
		ContentSigner certSigner = new JcaContentSignerBuilder(signatureType.jce()).setProvider("BC").build(
				privateKey);
		return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certBuilder.build(certSigner));
	} catch (CertificateException | IllegalStateException | OperatorCreationException ex) {
		throw new CryptoException(res.getString("CertificateGenFailed.exception.message"), ex);
	}
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
private static X509Certificate _createX509V1Certificate (final KeyPair aKeyPair) throws Exception
{
  // generate the certificate
  final PublicKey aPublicKey = aKeyPair.getPublic ();
  final PrivateKey aPrivateKey = aKeyPair.getPrivate ();
  final ContentSigner aContentSigner = new JcaContentSignerBuilder ("SHA256WithRSA").setProvider (BouncyCastleProvider.PROVIDER_NAME)
                                                                                    .build (aPrivateKey);

  final X509CertificateHolder aCertHolder = new JcaX509v1CertificateBuilder (new X500Principal ("CN=Test Certificate"),
                                                                             BigInteger.valueOf (System.currentTimeMillis ()),
                                                                             new Date (System.currentTimeMillis () -
                                                                                       50000),
                                                                             new Date (System.currentTimeMillis () +
                                                                                       50000),
                                                                             new X500Principal ("CN=Test Certificate"),
                                                                             aPublicKey).build (aContentSigner);
  // Convert to JCA X509Certificate
  return new JcaX509CertificateConverter ().getCertificate (aCertHolder);
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
/**
 * Create a new dummy certificate based on the passed key pair
 *
 * @param kp
 *        KeyPair to use. May not be <code>null</code>.
 * @return A {@link X509Certificate} for further usage
 */
@Nonnull
private X509Certificate _createCert (@Nonnull final KeyPair kp) throws Exception
{
  final PublicKey aPublicKey = kp.getPublic ();
  final PrivateKey aPrivateKey = kp.getPrivate ();
  final ContentSigner aContentSigner = new JcaContentSignerBuilder ("SHA1withRSA").setProvider (BouncyCastleProvider.PROVIDER_NAME)
                                                                                  .build (aPrivateKey);

  // Form yesterday
  final Date aStartDate = new Date (System.currentTimeMillis () - 24 * CGlobal.MILLISECONDS_PER_HOUR);
  // For one year from now
  final Date aEndDate = new Date (System.currentTimeMillis () + 365 * 24 * CGlobal.MILLISECONDS_PER_HOUR);

  final X509v1CertificateBuilder aCertBuilder = new JcaX509v1CertificateBuilder (new X500Principal ("CN=TestIssuer"),
                                                                                 BigInteger.ONE,
                                                                                 aStartDate,
                                                                                 aEndDate,
                                                                                 new X500Principal ("CN=TestSubject"),
                                                                                 aPublicKey);
  final X509CertificateHolder aCertHolder = aCertBuilder.build (aContentSigner);
  // Convert to JCA X509Certificate
  return new JcaX509CertificateConverter ().getCertificate (aCertHolder);
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
public static X509Certificate generateV1Certificate(final KeyPair keyPair,
                                                    final String subject,
                                                    final String issuer,
                                                    final int validityYears,
                                                    final String signatureAlgorithm) throws CertificateException, NoSuchAlgorithmException, NoSuchProviderException, SignatureException, InvalidKeyException, OperatorCreationException {
    final DateTime now = DateTime.now(DateTimeZone.UTC);
    final X509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(
            new X500Name(issuer),
            generateRandomBigInt(),
            now.minusDays(1).toDate(),
            now.plusYears(validityYears).toDate(),
            new X500Name(subject),
            keyPair.getPublic());
    final ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).setProvider("BC").build(keyPair.getPrivate());
    final X509CertificateHolder certHolder = certBuilder.build(signer);
    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
public static X509Certificate makeV1Certificate(KeyPair subKP, String _subDN, KeyPair issKP, String _issDN)
    throws GeneralSecurityException, IOException, OperatorCreationException
{

    PublicKey  subPub  = subKP.getPublic();
    PrivateKey issPriv = issKP.getPrivate();
    PublicKey  issPub  = issKP.getPublic();

    X509v1CertificateBuilder v1CertGen = new JcaX509v1CertificateBuilder(
        new X500Name(_issDN),
        allocateSerialNumber(),
        new Date(System.currentTimeMillis()),
        new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 100)),
        new X500Name(_subDN),
        subPub);

    JcaContentSignerBuilder contentSignerBuilder = makeContentSignerBuilder(issPub);

    X509Certificate _cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(v1CertGen.build(contentSignerBuilder.build(issPriv)));

    _cert.checkValidity(new Date());
    _cert.verify(issPub);

    return _cert;
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
/**
 * Renew a self-signed X509 Version 1 certificate.
 * 
 * @return The renewed certificate
 * @param oldCert old certificate
 * @param iValidity Validity period of certificate in days to add to the old cert's expiry date, or current time if
 *            the certificate has expired
 * @param publicKey Public part of key pair
 * @param privateKey Private part of key pair
 * @throws CryptoException If there was a problem generating the certificate
 */
public static X509Certificate renewCert(X509Certificate oldCert, int iValidity, PublicKey publicKey,
    PrivateKey privateKey)
        throws CryptoException
{
	BigInteger serial = generateX509SerialNumber();

	// Valid before and after dates now to iValidity days in the future from now or existing expiry date
	Date notBefore = new Date();
	Date oldExpiry = oldCert.getNotAfter();
	if (oldExpiry == null || oldExpiry.before(notBefore))
	{
		oldExpiry = notBefore;
	}
	Date notAfter = new Date(oldExpiry.getTime() + ((long) iValidity * 24 * 60 * 60 * 1000));

	// TODO: verify/force self-signedness

	JcaX509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(oldCert.getIssuerX500Principal(),
	    serial, notBefore, notAfter, oldCert.getSubjectX500Principal(), publicKey);

	try
	{
		ContentSigner signer = new JcaContentSignerBuilder(oldCert.getSigAlgName()).build(privateKey);
		X509CertificateHolder certHolder = certBuilder.build(signer);

		return new JcaX509CertificateConverter().getCertificate(certHolder);
	}
	catch (CertificateException | OperatorCreationException ex)
	{
		throw new CryptoException(RB.getString("CertificateGenFailed.exception.message"), ex);
	}
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
public static X509Certificate generateCertificate(KeyPair keyPair) {
	try {
		ContentSigner sigGen = new JcaContentSignerBuilder(AuthenticationUtils.ALGORITHM)
				.build(keyPair.getPrivate());
		Date startDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
		Date endDate = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);
		X509v1CertificateBuilder v1CertGen = new JcaX509v1CertificateBuilder(new X500Principal("CN=User"),
				BigInteger.ONE, startDate, endDate, new X500Principal("CN=User"), keyPair.getPublic());
		X509CertificateHolder certHolder = v1CertGen.build(sigGen);
		return new JcaX509CertificateConverter().getCertificate(certHolder);
	} catch (OperatorCreationException | CertificateException ex) {
		throw new RuntimeException(ex);
	}
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
public X509v1CertificateBuilder x509v1CertificateBuilder() {
    return new JcaX509v1CertificateBuilder(
            issuerPrincipal,
            serialNumber,
            Date.from(notBefore),
            Date.from(notAfter),
            subjectPrincipal,
            subjectPublicKey
    );
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
/**
 * we generate the CA's certificate
 */
public static X509Certificate createMasterCert(
    PublicKey pubKey,
    PrivateKey privKey)
    throws Exception
{
    //
    // signers name
    //
    String issuer = "C=AU, O=The Legion of the Bouncy Castle, OU=Bouncy Primary Certificate";

    //
    // subjects name - the same as we are self signed.
    //
    String subject = "C=AU, O=The Legion of the Bouncy Castle, OU=Bouncy Primary Certificate";

    //
    // create the certificate - version 1
    //
    X509v1CertificateBuilder v1CertBuilder = new JcaX509v1CertificateBuilder(
        new X500Name(issuer),
        BigInteger.valueOf(1),
        new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
        new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 30)),
        new X500Name(subject),
        pubKey);

    X509CertificateHolder cert = v1CertBuilder.build(new JcaContentSignerBuilder("SHA1withRSA").setProvider(BC).build(privKey));

    return new JcaX509CertificateConverter().setProvider(BC).getCertificate(cert);
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
/**
 * Generate a self-signed X509 Version 1 certificate for the supplied key pair and signature algorithm.
 * 
 * @return The generated certificate
 * @param sCommonName Common name certificate attribute
 * @param sOrganisationUnit Organization Unit certificate attribute
 * @param sOrganisation Organization certificate attribute
 * @param sLocality Locality certificate
 * @param sState State certificate attribute
 * @param sEmailAddress Email Address certificate attribute
 * @param sCountryCode Country Code certificate attribute
 * @param iValidity Validity period of certificate in days
 * @param publicKey Public part of key pair
 * @param privateKey Private part of key pair
 * @param signatureType Signature Type
 * @throws CryptoException If there was a problem generating the certificate
 */
public static X509Certificate generateCert(String sCommonName, String sOrganisationUnit, String sOrganisation,
    String sLocality, String sState, String sCountryCode, String sEmailAddress, int iValidity, PublicKey publicKey,
    PrivateKey privateKey, SignatureType signatureType)
        throws CryptoException
{
	X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
	if (sEmailAddress != null)
	{
		nameBuilder.addRDN(BCStyle.E, sEmailAddress);
	}
	if (sCountryCode != null)
	{
		nameBuilder.addRDN(BCStyle.C, sCountryCode);
	}
	if (sState != null)
	{
		nameBuilder.addRDN(BCStyle.ST, sState);
	}
	if (sLocality != null)
	{
		nameBuilder.addRDN(BCStyle.L, sLocality);
	}
	if (sOrganisation != null)
	{
		nameBuilder.addRDN(BCStyle.O, sOrganisation);
	}
	if (sOrganisationUnit != null)
	{
		nameBuilder.addRDN(BCStyle.OU, sOrganisationUnit);
	}
	if (sCommonName != null)
	{
		nameBuilder.addRDN(BCStyle.CN, sCommonName);
	}

	BigInteger serial = generateX509SerialNumber();

	Date notBefore = new Date(System.currentTimeMillis());
	Date notAfter = new Date(notBefore.getTime() + ((long) iValidity * 24 * 60 * 60 * 1000));

	JcaX509v1CertificateBuilder certBuilder = new JcaX509v1CertificateBuilder(nameBuilder.build(), serial,
	    notBefore, notAfter, nameBuilder.build(), publicKey);

	try
	{
		ContentSigner signer = new JcaContentSignerBuilder(signatureType.name()).build(privateKey);
		X509CertificateHolder certHolder = certBuilder.build(signer);

		return new JcaX509CertificateConverter().getCertificate(certHolder);
	}
	catch (CertificateException | OperatorCreationException ex)
	{
		throw new CryptoException(RB.getString("CertificateGenFailed.exception.message"), ex);
	}
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
static KeyStore genCAKeyStore(String nodeName)
{
    try
    {
        KeyFactory fact = KeyFactory.getInstance("ECDSA", "BC");

        EllipticCurve curve = new EllipticCurve(
            new ECFieldFp(new BigInteger("883423532389192164791648750360308885314476597252960362792450860609699839")), // q
            new BigInteger("7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc", 16), // a
            new BigInteger("6b016c3bdcf18941d0d654921475ca71a9db2fb27d1d37796185c2942c0a", 16)); // b

        ECParameterSpec spec = new ECParameterSpec(
            curve,
            ECPointUtil.decodePoint(curve, Hex.decode("020ffa963cdca8816ccc33b8642bedf905c3d358573d3f27fbbd3b3cb9aaaf")), // G
            new BigInteger("883423532389192164791648750360308884807550341691627752275345424702807307"), // n
            1); // h


        ECPrivateKeySpec priKeySpec = new ECPrivateKeySpec(
            new BigInteger("876300101507107567501066130761671078357010671067781776716671676178726717"), // d
            spec);

        ECPublicKeySpec pubKeySpec = new ECPublicKeySpec(
            ECPointUtil.decodePoint(curve, Hex.decode("025b6dc53bc61a2548ffb0f671472de6c9521a9d2d2534e65abfcbd5fe0c70")), // Q
            spec);

        PrivateKey sigKey = fact.generatePrivate(priKeySpec);
        PublicKey pubKey = fact.generatePublic(pubKeySpec);

        KeyStore ks = KeyStore.getInstance("PKCS12", "BC");

        ks.load(null, null);

        X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);

        builder.addRDN(BCStyle.C, "AU");
        builder.addRDN(BCStyle.O, "Crypto Workshop Pty Ltd");
        builder.addRDN(BCStyle.OU, "Ximix Node Test CA");
        builder.addRDN(BCStyle.L, "Melbourne");
        builder.addRDN(BCStyle.ST, "Victoria");
        builder.addRDN(BCStyle.CN, nodeName);

        Date startDate = new Date(System.currentTimeMillis() - 50000);

        ContentSigner sigGen = new JcaContentSignerBuilder("SHA256withECDSA").setProvider("BC").build(sigKey);
        X509v1CertificateBuilder certGen1 = new JcaX509v1CertificateBuilder(builder.build(), BigInteger.valueOf(1), startDate, new Date(System.currentTimeMillis() + YEAR), builder.build(), pubKey);

        X509Certificate cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certGen1.build(sigGen));

        ks.setKeyEntry("nodeCA", sigKey, new char[0], new Certificate[]{cert});

        return ks;
    }
    catch (Exception e)
    {
        throw new IllegalStateException("unable to set up test CA", e);
    }
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
@Test
public void test() throws Exception {
    final File keystore = new File("target/keystore");

    {   // generate keystore/trustore
        if (keystore.exists()) {
            Files.delete(keystore);
        }

        keystore.getParentFile().mkdirs();
        try (final FileOutputStream fos = new FileOutputStream(keystore)) {
            final KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance("RSA");
            keyGenerator.initialize(1024);

            final KeyPair pair = keyGenerator.generateKeyPair();

            final boolean addBc = Security.getProvider("BC") == null;
            if (addBc) {
                Security.addProvider(new BouncyCastleProvider());
            }
            try {

                final X509v1CertificateBuilder x509v1CertificateBuilder = new JcaX509v1CertificateBuilder(
                        new X500Name("cn=serveralias"),
                        BigInteger.valueOf(1),
                        new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(1)),
                        new Date(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(1)),
                        new X500Name("cn=serveralias"),
                        pair.getPublic());

                final X509CertificateHolder certHldr = x509v1CertificateBuilder
                        .build(new JcaContentSignerBuilder("SHA1WithRSA")
                                .setProvider("BC").build(pair.getPrivate()));

                final X509Certificate cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHldr);

                final KeyStore ks = KeyStore.getInstance("JKS");
                ks.load(null, "changeit".toCharArray());
                ks.setKeyEntry("serveralias", pair.getPrivate(), "changeit".toCharArray(), new Certificate[]{cert});
                ks.store(fos, "changeit".toCharArray());
            } finally {
                if (addBc) {
                    Security.removeProvider("BC");
                }
            }
        } catch (final Exception e) {
            Assert.fail(e.getMessage());
        }
    }

    final Configuration configuration = new Configuration();
    configuration.setSsl(true);
    configuration.setKeystoreFile(keystore.getAbsolutePath());
    configuration.setKeystorePass("changeit");
    configuration.setKeyAlias("serveralias");

    final Container container = new Container();
    container.setup(configuration);
    container.start();
    try {
        assertEquals(8443, ManagementFactory.getPlatformMBeanServer().getAttribute(new ObjectName("Tomcat:type=ProtocolHandler,port=8443"), "port"));
    } finally {
        container.stop();
    }

    // ensure it is not always started
    configuration.setSsl(false);
    container.setup(configuration);
    container.start();
    try {
        assertFalse(ManagementFactory.getPlatformMBeanServer().isRegistered(new ObjectName("Tomcat:type=ProtocolHandler,port=8443")));
    } finally {
        container.close();
    }

}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
private File createKeyStore() throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
    dropKeyStore();
    File keyStore = new File(STORE_PATH);

    keyStore.getParentFile().mkdirs();
    try (final FileOutputStream fos = new FileOutputStream(keyStore)) {
        final KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance("RSA");
        keyGenerator.initialize(1024);

        final KeyPair pair = keyGenerator.generateKeyPair();

        final boolean addBc = Security.getProvider("BC") == null;
        if (addBc) {
            Security.addProvider(new BouncyCastleProvider());
        }
        try {

            final X509v1CertificateBuilder x509v1CertificateBuilder = new JcaX509v1CertificateBuilder(
                    new X500Name("cn=" + SERVER),
                    BigInteger.valueOf(1),
                    new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(1)),
                    new Date(System.currentTimeMillis() + TimeUnit.DAYS.toMillis(1)),
                    new X500Name("cn=" + SERVER),
                    pair.getPublic());

            final X509CertificateHolder certHldr = x509v1CertificateBuilder
                    .build(new JcaContentSignerBuilder("SHA1WithRSA")
                            .setProvider("BC").build(pair.getPrivate()));

            final X509Certificate cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHldr);

            final KeyStore ks = KeyStore.getInstance("JKS");
            ks.load(null, STORE_PWD.toCharArray());
            ks.setKeyEntry(SERVER, pair.getPrivate(), STORE_PWD.toCharArray(), new Certificate[]{cert});
            ks.store(fos, STORE_PWD.toCharArray());
        } finally {
            if (addBc) {
                Security.removeProvider("BC");
            }
        }
    } catch (final Exception e) {
        Assert.fail(e.getMessage());
    }
    return keyStore;
}
 

import org.bouncycastle.cert.jcajce.JcaX509v1CertificateBuilder; //导入依赖的package包/类
public static void main(String[] args)
    throws Exception
{
    if (args.length != 2)
    {
        System.err.println("Usage: GenTrustAnchorKeyStore keyStoreName keyStorePassword");
        System.exit(1);
    }

    Security.addProvider(new BouncyCastleProvider());

    KeyPairGenerator kpGen = KeyPairGenerator.getInstance("ECDSA", "BC");

    kpGen.initialize(new ECNamedCurveGenParameterSpec("secp256r1"));

    KeyPair kp = kpGen.generateKeyPair();

    X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);

    builder.addRDN(BCStyle.C, "AU");
    builder.addRDN(BCStyle.O, "Crypto Workshop Pty Ltd");
    builder.addRDN(BCStyle.OU, "Ximix Node Test CA");
    builder.addRDN(BCStyle.L, "Melbourne");
    builder.addRDN(BCStyle.ST, "Victoria");
    builder.addRDN(BCStyle.CN, "Trust Anchor");

    Date startDate = new Date(System.currentTimeMillis() - 50000);

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA256withECDSA").setProvider("BC").build(kp.getPrivate());
    X509v1CertificateBuilder certGen1 = new JcaX509v1CertificateBuilder(builder.build(), BigInteger.valueOf(1), startDate, new Date(System.currentTimeMillis() + 2 * YEAR),builder.build(), kp.getPublic());

    X509Certificate cert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certGen1.build(sigGen));

    KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");

    keyStore.load(null, null);

    keyStore.setKeyEntry("trust", kp.getPrivate(), null, new Certificate[] { cert });

    keyStore.store(new FileOutputStream(args[0] + ".p12"), args[1].toCharArray());

    PEMWriter pWrt = new PEMWriter(new FileWriter(args[0] + ".pem"));

    pWrt.writeObject(cert);

    pWrt.close();
}