Bouncy Castle：使用现有 CA 签署的证书

Question

我正在尝试创建一个证书 (A)，该证书为存储在 p12 密钥库中的其他证书 (B) 签名。此存储的证书 (B) 已添加到我本地计算机的受信任证书库中。

证书 A 用于使用 bouncy Castle 1.52 library 对 pdf 文档进行签名，但我在签名文档中获得的数字签名无效。

如果有人可以帮助我，我将解释所做的步骤。

首先，我从 p12 密钥库（B）创建一个 CSR：

    private static PKCS10CertificationRequest generateCSR() {

    PKCS10CertificationRequest csr = null;

    try {

        initCACert();

        PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(

                new X500Principal("CN=Requested Test Certificate"), CAcert.getPublicKey());

        JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder("SHA256withRSA");

        ContentSigner signer = csBuilder.build(CApk);

        csr = p10Builder.build(signer);

    } catch (Exception e) {

        log.error(e);

    }

    return csr;

}

然后，使用此 CSR 生成证书 (A)。

    private static Certificate signCSR() throws Exception { 

    PKCS10CertificationRequest csr = generateCSR();

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA256withRSA");

    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);

    X500Name issuer = X500Name.getInstance(CAcert.getSubjectX500Principal().getEncoded());

    BigInteger serial = new BigInteger(32, new SecureRandom());

    Calendar c = Calendar.getInstance();

    c.add(Calendar.SECOND, -1);

    Date from = c.getTime();

    c.add(Calendar.YEAR, 5);

    Date to = c.getTime();

    X509v1CertificateBuilder certBuilder = new X509v1CertificateBuilder(issuer, serial, from, to, csr.getSubject(),

            csr.getSubjectPublicKeyInfo());

    ContentSigner signer = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)

            .build(PrivateKeyFactory.createKey(CApk.getEncoded()));

    X509CertificateHolder holder = certBuilder.build(signer);

    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");

    InputStream in = new ByteArrayInputStream(holder.getEncoded());

    Certificate cert = certFactory.generateCertificate(in);

    return cert;

}

Answer 1

我已经确定了问题：我正在以相反的顺序构建证书链。我有这个订单： certificateHolder = new X509CertificateHolder( cert.getEncoded() ); certificateHolder = new X509CertificateHolder( CAcert.getEncoded() );正确的顺序是这样的：certificateHolder = new X509CertificateHolder( CAcert.getEncoded() );certificateHolder = new X509CertificateHolder( cert.getEncoded() );我希望有人能发现这些信息有用！