import org.bouncycastle.openssl.jcajce.JcaPKCS8Generator; //导入依赖的package包/类
private void encryptedTestNew(PrivateKey key, ASN1ObjectIdentifier algorithm)
    throws NoSuchProviderException, NoSuchAlgorithmException, IOException, OperatorCreationException
{
    ByteArrayOutputStream bOut = new ByteArrayOutputStream();
    PEMWriter pWrt = new PEMWriter(new OutputStreamWriter(bOut), "BC");

    JceOpenSSLPKCS8EncryptorBuilder encryptorBuilder = new JceOpenSSLPKCS8EncryptorBuilder(algorithm);

    encryptorBuilder.setProvider("BC");
    encryptorBuilder.setPasssword("hello".toCharArray());

    PKCS8Generator pkcs8 = new JcaPKCS8Generator(key, encryptorBuilder.build());

    pWrt.writeObject(pkcs8);

    pWrt.close();

    PEMReader pRd = new PEMReader(new InputStreamReader(new ByteArrayInputStream(bOut.toByteArray())), new PasswordFinder()
    {
        public char[] getPassword()
        {
            return "hello".toCharArray();
        }
    });

    PrivateKey rdKey = (PrivateKey)pRd.readObject();

    assertEquals(key, rdKey);
}
 

import org.bouncycastle.openssl.jcajce.JcaPKCS8Generator; //导入依赖的package包/类
public void testPKCS8PlainNew()
    throws Exception
{
    KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");

    kpGen.initialize(1024);

    PrivateKey key = kpGen.generateKeyPair().getPrivate();
    ByteArrayOutputStream bOut = new ByteArrayOutputStream();
    PEMWriter pWrt = new PEMWriter(new OutputStreamWriter(bOut));
    PKCS8Generator pkcs8 = new JcaPKCS8Generator(key, null);

    pWrt.writeObject(pkcs8);

    pWrt.close();

    PEMReader pRd = new PEMReader(new InputStreamReader(new ByteArrayInputStream(bOut.toByteArray())), new PasswordFinder()
    {
        public char[] getPassword()
        {
            return "hello".toCharArray();
        }
    });

    PrivateKey rdKey = (PrivateKey)pRd.readObject();

    assertEquals(key, rdKey);
}
 

import org.bouncycastle.openssl.jcajce.JcaPKCS8Generator; //导入依赖的package包/类
/**
 * Test to show that tripple des PKCS8 private key pem created with ForgeJS
 * can be decrypted with BC. 
 * 
 * @throws Exception 
 */
@Test
public void decryptForgePkcs8PrivateKeyPem_PBEWithSHA1AndDESede() throws Exception {
    // http://bouncy-castle.1462172.n4.nabble.com/Help-with-EncryptedPrivateKeyInfo-td1468363.html
    // https://community.oracle.com/thread/1530354?start=0&tstart=0
    Security.addProvider(new BouncyCastleProvider());

    //PEMParser keyPemParser = new PEMParser(new StringReader(getPkcs8ForgePriKeyPem_PBEWithMD5AndDES()));
    //String passwd = "1234567890";
    PEMParser keyPemParser = new PEMParser(new StringReader(getPkcs8ForgePriKeyPem_EncryptedWithPBEWithSHA1AndDESede()));
    String passwd = "password";
    PemObject keyObj = keyPemParser.readPemObject();
    byte[] keyBytes = keyObj.getContent();

    EncryptedPrivateKeyInfo encryptPKInfo = new EncryptedPrivateKeyInfo(keyBytes);
    // 1.2.840.113549.1.5.13 == PBEWithMD5AndDES
    // 1.2.840.113549.1.12.1.3 == PBEWithSHA1AndDESede
    String algName = encryptPKInfo.getAlgName();
    String algId = encryptPKInfo.getAlgParameters().getAlgorithm();
    assertEquals("PBEWithSHA1AndDESede", algName);
    assertEquals("1.2.840.113549.1.12.1.3", algId);
    assertEquals("1.2.840.113549.1.12.1.3", PKCS8Generator.PBE_SHA1_3DES.getId());

    // Decrypt private key 
    Cipher cipher = Cipher.getInstance(algName);
    PBEKeySpec pbeKeySpec = new PBEKeySpec(passwd.toCharArray());
    SecretKeyFactory secFac = SecretKeyFactory.getInstance(algName);
    Key pbeKey = secFac.generateSecret(pbeKeySpec);
    AlgorithmParameters algParams = encryptPKInfo.getAlgParameters();
    cipher.init(Cipher.DECRYPT_MODE, pbeKey, algParams);
    KeySpec pkcs8KeySpec = encryptPKInfo.getKeySpec(cipher);
    KeyFactory kf = KeyFactory.getInstance("RSA");
    PrivateKey priKeyDecryptedBC = kf.generatePrivate(pkcs8KeySpec);

    // Compare decrypted private key with a version that was decrypted using 
    // openssl and assert that they are the same. 
    JcaPKCS8Generator pkcs8GeneratorNoEnc = new JcaPKCS8Generator(priKeyDecryptedBC, null);
    PemObject pkcs8PemDecryptedBC = pkcs8GeneratorNoEnc.generate();
    StringWriter writer3 = new StringWriter();
    PEMWriter pemWrite3 = new PEMWriter(writer3);
    pemWrite3.writeObject(pkcs8PemDecryptedBC);
    pemWrite3.close();
    String pkcs8StrDecryptedBC = writer3.toString().trim().replaceAll("\\r\\n", "\n");;
    String pkcs8StrDecryptedOpenSSL = getPkcs8ForgePriKeyPem_DecryptedWithOpenSSL().trim().replaceAll("\\r\\n", "\n");; 
    //System.out.println("["+pkcs8StrNoEncBC+"]");
    //System.out.println("["+pkcs8StrNoEncOpenssL+"]");
    assertTrue(pkcs8StrDecryptedBC.equals(pkcs8StrDecryptedOpenSSL));  
}
 

import org.bouncycastle.openssl.jcajce.JcaPKCS8Generator; //导入依赖的package包/类
/**
     * Get the PKCS#10 PEM string and encrypted PKCS#8 PEM string. 
     * @param subject
     * @param email Added as a Subject Alt Name extension if not null 
     * @param pw
     * @return First element contains the PKCS#10 PEM, second element contains the private key. 
     * @throws IOException
     * @throws NoSuchAlgorithmException
     * @throws NoSuchProviderException
     * @throws OperatorCreationException
     * @throws PKCSException 
     */
    public String[] getPkcs10_Pkcs8_AsPemStrings(X500Name subject, String email, String pw)
            throws IOException, NoSuchAlgorithmException,
            NoSuchProviderException, OperatorCreationException, PKCSException {
        // Create a PKCS10 cert signing request 
        KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA", "BC");
        kpg.initialize(2048);
        KeyPair kp = kpg.genKeyPair();
        PrivateKey priKey = kp.getPrivate();

//        X500NameBuilder x500NameBld = new X500NameBuilder(BCStyle.INSTANCE);
//        x500NameBld.addRDN(BCStyle.C, csrRequestValidationConfigParams.getCountryOID());
//        x500NameBld.addRDN(BCStyle.O, csrRequestValidationConfigParams.getOrgNameOID());
//        x500NameBld.addRDN(BCStyle.OU, ou);
//        x500NameBld.addRDN(BCStyle.L, loc);
//        x500NameBld.addRDN(BCStyle.CN, cn);
//        X500Name subject = x500NameBld.build();
        PKCS10CertificationRequestBuilder requestBuilder
                = new JcaPKCS10CertificationRequestBuilder(subject, kp.getPublic());

        ExtensionsGenerator extGen = new ExtensionsGenerator();
        if(email != null){
           extGen.addExtension(Extension.subjectAlternativeName, false,
                new GeneralNames(new GeneralName(GeneralName.rfc822Name, email)));
        }

        requestBuilder.addAttribute(
                PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate());

        String sigName = "SHA1withRSA";
        PKCS10CertificationRequest req1 = requestBuilder.build(
                new JcaContentSignerBuilder(sigName).setProvider("BC").build(kp.getPrivate()));

        if (req1.isSignatureValid(new JcaContentVerifierProviderBuilder().setProvider("BC").build(kp.getPublic()))) {
            //log.info(sigName + ": PKCS#10 request verified.");
        } else {
            //log.error(sigName + ": Failed verify check.");
            throw new RuntimeException(sigName + ": Failed verify check.");
        }

        StringWriter writer = new StringWriter();
        PEMWriter pemWrite = new PEMWriter(writer);
        pemWrite.writeObject(req1);
        pemWrite.close();
        String csr = writer.toString();

        JceOpenSSLPKCS8EncryptorBuilder encryptorBuilder
                = new JceOpenSSLPKCS8EncryptorBuilder(PKCS8Generator.PBE_SHA1_3DES);

        SecureRandom random = new SecureRandom();
        encryptorBuilder.setRandom(random);
        encryptorBuilder.setPasssword(pw.toCharArray());
        OutputEncryptor oe = encryptorBuilder.build();
        JcaPKCS8Generator pkcs8GeneratorEnc = new JcaPKCS8Generator(priKey, oe);

        // Output encrypted private key pkcs8 PEM string (todo use later api) 
        PemObject pkcs8PemEnc = pkcs8GeneratorEnc.generate();
        StringWriter writer2 = new StringWriter();
        PEMWriter pemWrite2 = new PEMWriter(writer2);
        pemWrite2.writeObject(pkcs8PemEnc);
        pemWrite2.close();
        String pkcs8StrEnc = writer2.toString();

        String[] pems = new String[2];
        pems[0] = csr;
        pems[1] = pkcs8StrEnc;
        return pems;
    }