无法在java中读取用于验证的公钥答案

【问题标题】：Cannot read a public key for verification in java无法在java中读取用于验证的公钥
【发布时间】：2015-07-27 22:03:23
【问题描述】：

我需要能够读取客户提供给我的 pem 证书。出于测试目的，我创建了我期望的密钥：

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days -1 -nodes

然后我实现了一个阅读器：

public PublicKey getPublicKey()
        throws Exception {

    InputStream is = new ClassPathResource("cert.pem").getInputStream();
    byte[] keyBytes = ByteStreams.toByteArray(is);

    Base64.Decoder decoder = Base64.getDecoder();
    String bytesAsString = new String(keyBytes, StandardCharsets.UTF_8);
    System.out.println(bytesAsString);

    X509EncodedKeySpec spec =
            new X509EncodedKeySpec(keyBytes);
    KeyFactory kf = KeyFactory.getInstance("RSA");
    return kf.generatePublic(spec);
}

sysout 提供了密钥，它的格式似乎很好，长度也很合适。但是在最后一行我得到了异常：

java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: invalid key format
    at sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:205)
    at java.security.KeyFactory.generatePublic(KeyFactory.java:334)
    at a.c.a.vaultorchestrator.service.VerifySignatureServiceTest.getPublicKey(VerifySignatureServiceTest.java:77)
    at a.c.a.vaultorchestrator.service.VerifySignatureServiceTest.testVerifySignature(VerifySignatureServiceTest.java:31)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
    at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
    at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
    at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
    at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
    at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
    at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
    at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
    at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
    at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
    at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
    at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
    at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:74)
    at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:211)
    at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:67)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:134)
Caused by: java.security.InvalidKeyException: invalid key format
    at sun.security.x509.X509Key.decode(X509Key.java:387)
    at sun.security.x509.X509Key.decode(X509Key.java:403)
    at sun.security.rsa.RSAPublicKeyImpl.<init>(RSAPublicKeyImpl.java:84)
    at sun.security.rsa.RSAKeyFactory.generatePublic(RSAKeyFactory.java:298)
    at sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:201)
    ... 29 more

有人知道为什么这是一个无效的密钥吗？

【问题讨论】：

标签： java openssl rsa jce

【解决方案1】：

找到了解决办法。问题是它们的密钥需要转换为 der 格式才能被 java 读取。以下命令修复了该问题：

openssl rsa -in src/test/resources/key.pem -pubout -outform DER -out src/test/resources/cert.der

openssl pkcs8 -topk8 -inform PEM -outform DER -in key.pem -nocrypt -out key.der

完成这两个转换后，显然需要将上面代码中引用的公钥更改为“cert.der”，一切顺利。

【讨论】：