嗨,我刚刚从符合 xmldsig w3c 建议的 xml 构建了 org.apache.xml.security.signature.XMLSignature,我可以看到 xml 包含
中的所有证书链<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
元素,但使用 XMLSignature API 我可以看到我只能访问用户证书和颁发者证书,但不能访问完整的链,是否有一种直接的方法可以通过 xmlsec API 完成此操作?
最佳答案
我找到了一个解决方案,不是最干净的,但它有效:
XMLSignature signature = new XMLSignature(sigElement,
null);
KeyInfo keyInfo = signature.getKeyInfo();
NodeList x509Certificates = keyInfo.getElement().getElementsByTagNameNS("http://www.w3.org/2000/09/xmldsig#", "X509Certificate");
ArrayList<X509Certificate> allCertificates = new ArrayList<X509Certificate>();
for (int i = 0; i < x509Certificates.getLength(); i++) {
Node x509CertificateElement = x509Certificates.item(i);
byte[] decodedX509Certificate = Base64.decode(x509CertificateElement.getTextContent());
X509Certificate x509Certificate = (X509Certificate) CertificateFactory.getInstance("X509").generateCertificate(new ByteArrayInputStream(decodedX509Certificate));
allCertificates.add(x509Certificate);
}
// now you have all certificates in allCertificates
关于java - 如何从 XMLSignature 获取证书链(根证书和中间证书),我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/5996031/