在生成 X509 证书时得到“数据不是对象 ID（标签 = 49）”

Question

我正在尝试为我的密钥库生成我自己的 CSR，但它并不顺利，这个错误让我感到困惑。这是我的代码：

import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
import org.bouncycastle.pkcs.PKCS10CertificationRequestBuilder;
import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder;

public class CreateKeyTest {

    public static void main(String[] args) throws OperatorCreationException, IOException, GeneralSecurityException {
    KeyPairGenerator kpg;
    KeyPair kp;
    RSAPublicKey pubKey;
    RSAPrivateKey privKey;

    FileOutputStream out;
    KeyStore ks;
    FileInputStream in;
    FileInputStream bFis;

    try {
        ks = KeyStore.getInstance("JKS");

        kpg = KeyPairGenerator.getInstance("RSA");
        kpg.initialize(1024);
        kp = kpg.generateKeyPair();
        pubKey = (RSAPublicKey) kp.getPublic();
        privKey = (RSAPrivateKey) kp.getPrivate();

        // generate CSR
        ContentSigner sign = new JcaContentSignerBuilder("SHA1withRSA").build(privKey);

        X500NameBuilder nBuilder = new X500NameBuilder();
        nBuilder.addRDN(BCStyle.CN, "TestCSR");
        nBuilder.addRDN(BCStyle.C, "ER");
        nBuilder.addRDN(BCStyle.E, "test@test.com");
        X500Name name = nBuilder.build();

        PKCS10CertificationRequestBuilder cerReq = new JcaPKCS10CertificationRequestBuilder(name, pubKey);
        PKCS10CertificationRequest request = cerReq.build(sign);

        PEMWriter pWr = new PEMWriter(new FileWriter(new File("D:\\test.csr")));
        pWr.writeObject(request);
        pWr.flush();
        pWr.close();

        bFis = new FileInputStream("D:\\test.csr");
        BufferedInputStream ksbufin = new BufferedInputStream(bFis);
        X509Certificate certificate = (X509Certificate) CertificateFactory.getInstance("X.509")
                .generateCertificate(ksbufin);

        ks.setKeyEntry("RSA_key", kp.getPrivate(), "changeit".toCharArray(),
                new java.security.cert.Certificate[] { certificate });

        out = new FileOutputStream("key.store");
        ks.store(out, "changeit".toCharArray());

        System.out.println("New Keystore Generated");
        out.close();
    } catch (KeyStoreException | IOException | CertificateException | NoSuchAlgorithmException
            | OperatorCreationException e) {
        System.out.println(e.getMessage());
        e.printStackTrace();
    }
}
}

当我执行它时，它向我显示了异常：X509.ObjectIdentifier() -- data isn't an object ID (tag = 49)，并且可以回溯到generateCertificate(ksbufin)。但是我检查了test.cer，它确实有证书数据，那个异常消息让我很困惑，甚至不知道这是什么意思（object ID？tag = 49？我没有看到我在我的代码。）。

谁能帮我把这泥巴弄出来？

Answer 1

错误信息正确，test.csr不包含证书。您使用 PKCS10CertificationRequest 构建了它，因此它包含证书签名请求 (CSR)。

您已经生成了一个密钥对（私有和公共）以及一个 CSR。 CSR 是对证书颁发机构 (CA) 的证书请求。它包含证书的公钥和一些预期属性（CN、C、OU 等）。 CSR 使用私钥签名，并且必须发送给 CA。 CA 将提取公钥，生成证书并对其进行签名。见Certificate enrollment process

如果您想要证书，您需要获得 CA 签署的证书