import org.spongycastle.asn1.x509.BasicConstraints; //导入依赖的package包/类
public static X509Certificate generateCertificate(KeyPair pair)
        throws InvalidKeyException, NoSuchProviderException, SignatureException
{
    // generate the certificate
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
    certGen.setIssuerDN(new X500Principal("CN=Restcomm Android SDK"));
    certGen.setNotBefore(new Date(System.currentTimeMillis() - 50000));
    // TODO: using 1 day for now, need to increase that
    certGen.setNotAfter(new Date(System.currentTimeMillis() + 86400000));
    certGen.setSubjectDN(new X500Principal("CN=Restcomm Android SDK"));
    certGen.setPublicKey(pair.getPublic());
    certGen.setSignatureAlgorithm("SHA1withECDSA");

    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(false));
    certGen.addExtension(X509Extensions.KeyUsage, true, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
    certGen.addExtension(X509Extensions.ExtendedKeyUsage, true, new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
    certGen.addExtension(X509Extensions.SubjectAlternativeName, false, new GeneralNames(new GeneralName(GeneralName.rfc822Name, "[email protected]")));

    // provider is Bouncy Castle
    return certGen.generateX509Certificate(pair.getPrivate(), "BC");
}
 

import org.spongycastle.asn1.x509.BasicConstraints; //导入依赖的package包/类
/**
 * Create the certificate signing request (CSR) from private and public keys
 *
 * @param keyPair the KeyPair with private and public keys
 * @return PKCS10CertificationRequest with the certificate signing request
 *         (CSR) data
 * @throws IOException
 * @throws OperatorCreationException
 */
public static PKCS10CertificationRequest generateCSR(KeyPair keyPair) throws IOException,
        OperatorCreationException {
    String principal = "CN=AWS IoT Certificate" + ", O=Amazon";
    AsymmetricKeyParameter privateKey = PrivateKeyFactory.createKey(keyPair.getPrivate()
            .getEncoded());
    AlgorithmIdentifier signatureAlgorithm = new DefaultSignatureAlgorithmIdentifierFinder()
            .find("SHA1WITHRSA");
    AlgorithmIdentifier digestAlgorithm = new DefaultDigestAlgorithmIdentifierFinder()
            .find("SHA-1");
    ContentSigner signer = new BcRSAContentSignerBuilder(signatureAlgorithm, digestAlgorithm)
            .build(privateKey);

    PKCS10CertificationRequestBuilder csrBuilder = new JcaPKCS10CertificationRequestBuilder(
            new X500Name(principal), keyPair.getPublic());
    ExtensionsGenerator extensionsGenerator = new ExtensionsGenerator();
    extensionsGenerator.addExtension(Extension.basicConstraints, true, new BasicConstraints(
            true));
    csrBuilder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest,
            extensionsGenerator.generate());
    PKCS10CertificationRequest csr = csrBuilder.build(signer);

    return csr;
}
 

import org.spongycastle.asn1.x509.BasicConstraints; //导入依赖的package包/类
public static X509Certificate generateRootCertificate(KeyPair keys, String CN) 
		throws NoSuchAlgorithmException, OperatorCreationException, CertificateException, 
		KeyStoreException, UnrecoverableKeyException, IOException, 
		InvalidKeyException, NoSuchPaddingException, InvalidParameterSpecException, 
		InvalidKeySpecException, InvalidAlgorithmParameterException, IllegalBlockSizeException, 
		BadPaddingException {

	X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);

	builder.addRDN(BCStyle.CN, CN);

	// We want this root certificate to be valid for one year 
	Calendar calendar = Calendar.getInstance();
	calendar.add( Calendar.YEAR, 1 );

	ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider(BC).build(keys.getPrivate());
	X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(
			builder.build(), 
			new BigInteger(80, new Random()), 
			new Date(System.currentTimeMillis() - 50000),
			calendar.getTime(),
			builder.build(),
			keys.getPublic());

	// Those are the extensions needed for a CA certificate
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.19"), true, new BasicConstraints(true));
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.15"), true, new X509KeyUsage(X509KeyUsage.digitalSignature));
	certGen.addExtension(new ASN1ObjectIdentifier("2.5.29.37"), true, new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));

	X509CertificateHolder certificateHolder = certGen.build(sigGen);

	X509Certificate certificate = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certificateHolder);

	return certificate;

}