如何使用 java 从现有密钥库生成 csr

Question

如何使用java代码从已有的keystore生成csr？

功能效果与（但不生成文件）相同

keytool -certreq -alias certificate_alias -keystore jssecacerts -storepass changeit -file client.csr

我刚刚发现“Generating a Certificate Signing Request using Java API”

但是我已经有X.509证书了，如何使用这个证书在java中生成csr？

KeyStore ts = KeyStore.getInstance("JKS");
FileInputStream is = new FileInputStream(trustStoreFileName);

ts.load(is, trustStorePassword.toCharArray());
is.close();
X509Certificate x509Cert = (X509Certificate)ts.getCertificate("certificate_alias");

如何使用以上信息生成 CSR？

我就解决了~

分享我的所有代码以从现有证书生成 csr。

KeyStore ks = KeyStore.getInstance("JKS");
FileInputStream is = new FileInputStream(trustStoreFileName);

ks.load(is, trustStorePassword.toCharArray());
is.close();

X509Certificate x509Cert = (X509Certificate)ks.getCertificate("certificate_alias");

X500Principal principal = x509Cert.getSubjectX500Principal();
X500Name x500Name = new X500Name( principal.getName() );

PublicKey publicKey = x509Cert.getPublicKey();
PrivateKey privateKey = (PrivateKey) ks.getKey("certificate_alias", trustStorePassword.toCharArray());

String sigAlg = x509Cert.getSigAlgName();
PKCS10 pkcs10 = new PKCS10(publicKey);
Signature signature = Signature.getInstance(sigAlg);
signature.initSign(privateKey);
pkcs10.encodeAndSign(new X500Signer(signature, x500Name));
ByteArrayOutputStream bs = new ByteArrayOutputStream();
PrintStream ps = new PrintStream(bs);
pkcs10.print(ps);
byte[] c = bs.toByteArray();
try {
    if (ps != null)
        ps.close();
    if (bs != null)
        bs.close();
} catch (Throwable th) {
}

Answer 1

您需要证书中的公钥和私钥来签署 CSR。 JKS 可以包含 x509 证书和密钥对。所以，确保你拥有它

PrivateKey privateKey = ts.getPrivateKey("certificate_alias");

签署 CSR 后，CA 将颁发新的 X509Certificate。但是通常不重用现有密钥（可能已被泄露）来颁发新证书。建议生成新的密钥对