Форум программистов [Powered by Invision Power Board]

Код

import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PublicKey;
import java.security.Security;
import java.security.Signature;
import java.security.cert.X509Certificate;
import java.util.Date;
import org.bouncycastle.asn1.x509.X509Name;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.x509.X509V3CertificateGenerator;


public class CertificatesExample {
    
    public final static String signatureAlgorithm = "SHA1withRSA";
    public final static long validPeriod = 1000*60*60*24*10;
    
    private KeyPair rootKeyPair;
    private X509Certificate rootCertificate;
    
    private BigInteger snCounter;
    
    /** Creates a new instance of Certificates */
    public CertificatesExample()
    throws Exception {
        
        snCounter = new BigInteger("0");
        
        
        Security.addProvider(new BouncyCastleProvider());
        
        // generate and save root KeyPair
        KeyPairGenerator kpGenerator = KeyPairGenerator.getInstance("RSA");
        rootKeyPair = kpGenerator.generateKeyPair();
        
        X509Name rootDN = new X509Name("CN=ROOT CA C=KZ O=HomeCA");
        
        
        // create selfsigned root certificate
        X509V3CertificateGenerator certGenerator =
                new X509V3CertificateGenerator();
        certGenerator.setIssuerDN(rootDN);
        certGenerator.setSubjectDN(rootDN);
        certGenerator.setSignatureAlgorithm(signatureAlgorithm);
        certGenerator.setSerialNumber(getNextSerialNumber());
        certGenerator.setNotBefore(new Date(System.currentTimeMillis()));
        certGenerator.setNotAfter(
                new Date(System.currentTimeMillis() + validPeriod));
        certGenerator.setPublicKey(rootKeyPair.getPublic());
        
        rootCertificate = certGenerator.generate(rootKeyPair.getPrivate());
        
    }
    
    public X509Certificate getRootCertificate() {
        return rootCertificate;
    }
    
    public X509Certificate generateCertificate(PublicKey pubKey, String name)
    throws Exception {
        
        X509V3CertificateGenerator certGenerator = 
                new X509V3CertificateGenerator();

        certGenerator.setIssuerDN(rootCertificate.getSubjectX500Principal());
        certGenerator.setSubjectDN(new X509Name(name));
        certGenerator.setSignatureAlgorithm(signatureAlgorithm);
        certGenerator.setSerialNumber(getNextSerialNumber());
        certGenerator.setNotBefore(new Date(System.currentTimeMillis()));
        certGenerator.setNotAfter(
                new Date(System.currentTimeMillis() + validPeriod));
        certGenerator.setPublicKey(pubKey);
        
        
        X509Certificate resCert = 
                certGenerator.generate(rootKeyPair.getPrivate());
        
        
        return resCert;
    }
    
    private synchronized BigInteger getNextSerialNumber() {
        snCounter = snCounter.add(new BigInteger("1"));
        return snCounter;
    }
    
    public static void main(String args[])
    throws Exception {
        
        CertificatesExample examp = new CertificatesExample();
        System.out.println(examp.getRootCertificate());
        
        // generate antoher key pair
        KeyPairGenerator kpGenerator = KeyPairGenerator.getInstance("RSA");
        KeyPair keyPair = kpGenerator.generateKeyPair();
        
        // generate certificate, with root issuer
        X509Certificate myCert = examp.generateCertificate(
                keyPair.getPublic(), "CN=Alexandr");
        System.out.println(myCert);
        
        // sign data
        byte dataToSign[] = "data to sign".getBytes();
        
        Signature signature = Signature.getInstance("SHA1withRSA");
        signature.initSign(keyPair.getPrivate());
        signature.update(dataToSign);
        byte sign[] = signature.sign();
        
        // verify signature
        signature.initVerify(myCert);
        signature.update(dataToSign);
        boolean isSignValid = signature.verify(sign);
        
        if (isSignValid) {
            System.out.println("OK");
        } else {
            System.out.println("FAIL");
        }

    }
    
}