仍然是密码学的菜鸟,我每天都会偶然发现一些简单的事情。而今天只是其中之一。
我想用 bouncy caSTLe 库在 java 中验证 smime 消息,我想我差不多想通了,但此时的问题是 PKIXparameters 对象的构建。 比方说,我有一个具有以下结构的终端实体 x509 证书:
root certificate
+->intermediate certificate
+->end-entity certificate
为了验证消息,我需要先建立一个信任链,但我不知道如何从终端实体中提取根证书和中间证书。
我尝试使用终端实体作为根,但它没有用:
InputStream isCert = GetFISCertificate();
List list = new ArrayList();
X509Certificate rootCert = (X509Certificate) certificateFactory.generateCertificate(isCert);
list.add(rootCert);
CollectionCertStoreParameters params = new CollectionCertStoreParameters(list);
CertStore store = CertStore.getInstance("Collection", params, BC);
//create cert path
List certChain = new ArrayList();
certChain.add(rootCert);
CertPath certPath = certificateFactory.generateCertPath(certChain);
Set trust = Collections.singleton(new TrustAnchor(rootCert, null));
//validation
CertPathValidator certPathValidator = CertPathValidator.getInstance("PKIX", BC);
PKIXParameters pKIXParameters = new PKIXParameters(trust);
pKIXParameters.addCertStore(store);
pKIXParameters.setDate(new Date());
try {
CertPathValidatorResult result = certPathValidator.validate(certPath, pKIXParameters);
System.out.println("certificate path validated");
} catch (CertPathValidatorException e) {
System.out.println("validation failed on certificate number " + e.getIndex() + ", details: " + e.getMessage());
}
得到这个异常:
validation failed on certificate number -1, details: Trust anchor for certification path not found.
顺便说一句,我能否只使用最终实体证书来验证消息,就好像它是自签名证书一样?
最佳答案
本次测试我使用了 BouncyCaSTLe 1.56。
从最终实体获取颁发者证书的一种方法是查找 Authority Information Access extension .
此扩展可能存在(它不是强制性的)并且可能包含获取颁发者证书的URL(颁发者是证书“上面”是当前的,所以终端实体的发行者是中间体,中间体的发行者是根。
您可以使用 BouncyCaSTLe 获取此扩展值:
import java.security.cert.X509Certificate;
import org.bouncycastle.asn1.x509.AccessDescription;
import org.bouncycastle.asn1.x509.AuthorityInformationAccess;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.X509ObjectIdentifiers;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.x509.extension.X509ExtensionUtil;
X509Certificate cert = // end entity certificate
// get Authority Information Access extension (will be null if extension is not present)
byte[] extVal = cert.getExtensionValue(Extension.authorityInfoAccess.getId());
AuthorityInformationAccess aia = AuthorityInformationAccess.getInstance(X509ExtensionUtil.fromExtensionValue(extVal));
// check if there is a URL to issuer's certificate
AccessDescription[] descriptions = aia.getAccessDescriptions();
for (AccessDescription ad : descriptions) {
// check if it's a URL to issuer's certificate
if (ad.getAccessMethod().equals(X509ObjectIdentifiers.id_ad_caIssuers)) {
GeneralName location = ad.getAccessLocation();
if (location.getTagNo() == GeneralName.uniformResourceIdentifier) {
String issuerUrl = location.getName().toString();
// http URL to issuer (test in your browser to see if it's a valid certificate)
// you can use java.net.URL.openStream() to create a InputStream and create
// the certificate with your CertificateFactory
URL url = new URL(issuerUrl);
X509Certificate issuer = (X509Certificate) certificateFactory.generateCertificate(url.openStream());
}
}
}
因此您可以将此代码与最终实体证书一起使用以获得中间体。然后您再次将它与中间体一起使用以获得根。
然后您将 root 添加到您的 TrustAnchor
并且验证应该有效。
注意:但正如我所说,此扩展不是强制性的,可能不会存在。在这种情况下,getExtensionValue
将返回 null
,我知道的唯一选择是在 google 中搜索证书并下载它们(这些证书链通常是公开的而不是很难找到)
关于java - 从终端实体获取根证书和中间证书,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/43885980/