openssl 制作证书和签名java方法

Win32OpenSSL_Light-0_9_8k.exe

 

1. 生成不含密码保护的私钥：
openssl genrsa -out private-rsa.key 1024

2. 生成证书
openssl req -new -x509 -key private-rsa.key -days 750 -out public-rsa.cer

3. 生成Keystore
3.1. 生成PKCS12 格式Keystore
openssl pkcs12 -export -name test-alias -in public-rsa.cer -inkey private-rsa.key -out 99bill-rsa.pfx

 

 

pfx格式证书转换为pem格式命令
openssl pkcs12 -in 99bill-rsa.pfx -passin pass:生成证书设置的密码 -nodes -out 99bill-rsa.pem

 

private-rsa.pfx

public-rsa.cer

 

附：签名方法

package com.verify.cert;

public class CertUtil {

/**
* 对字符串进行签名
*
* @param TobeSigned
* 需要进行签名的字符串
* @param KeyFile
* PFX证书文件路径
* @param PassWord
* 私钥保护密码
* @return 签名成功返回true(从LastResult属性获取结果)，失败返回false(从LastErrMsg属性获取失败原因)
*/
public static String SignMsg(final String TobeSigned, final String KeyFile, final String PassWord) throws Exception {
CryptNoRestrict cryptNoRestrict = new CryptNoRestrict();
cryptNoRestrict.SignMsg(TobeSigned, KeyFile, PassWord);
return cryptNoRestrict.lastSignMsg;
}

/**
* 验证签名
*
* @param TobeVerified
* 待验证签名的密文
* @param PlainText
* 待验证签名的明文
* @param CertFile
* 签名者公钥证书
* @return 验证成功返回true，失败返回false(从LastErrMsg属性获取失败原因)
*/
public static boolean VerifyMsg(String TobeVerified, String PlainText, String CertFile) throws Exception {
CryptNoRestrict cryptNoRestrict = new CryptNoRestrict();
return cryptNoRestrict.VerifyMsg(TobeVerified, PlainText, CertFile);
}

public static void main(String[] args) {
try {
String a = "100|123123122222222222222";
String b = SignMsg(a, "com/verify/cert/private-rsa.pfx", "123456");
System.err.println(b);
System.err.println(VerifyMsg(b, a, "com/verify/cert/public-rsa.cer"));

} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}

}

 

package com.verify.cert;

public interface CryptInf {
public boolean VerifyMsg(String TobeVerified, String PlainText, String CertFile) throws Exception;

public boolean SignMsg(String TobeSigned, String KeyFile, String PassWord) throws Exception;

public String getLastSignMsg();
}

 

/**
*
*/
package com.verify.cert;

import java.io.InputStream;
import java.security.KeyStore;
import java.security.Provider;
import java.security.Signature;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPublicKey;
import java.util.Enumeration;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

/**
* @author Administrator
*
*/
public class CryptNoRestrict implements CryptInf {
public static Provider provider = new BouncyCastleProvider();

/**
* 构造函数
*/
public CryptNoRestrict() {
}

public CryptNoRestrict(String encoding) {
this.encoding = encoding;
}

private String encoding = "GBK";

/**
* 取出上次调用加密、解密、签名函数成功后的输出结果
*/
protected String lastResult;

/**
* 返回上一次签名结果
*/
protected String lastSignMsg;

/**
* 对字符串进行签名
*
* @param TobeSigned
* 需要进行签名的字符串
* @param KeyFile
* PFX证书文件路径
* @param PassWord
* 私钥保护密码
* @return 签名成功返回true(从LastResult属性获取结果)，失败返回false(从LastErrMsg属性获取失败原因)
*/
public boolean SignMsg(final String TobeSigned, final String KeyFile, final String PassWord) throws Exception {

ClassLoader cl = CryptNoRestrict.class.getClassLoader();
InputStream fiKeyFile = cl.getResourceAsStream(KeyFile);
// 传入绝对路径
// FileInputStream fiKeyFile = null;
// fiKeyFile = new FileInputStream(KeyFile);

boolean result = false;
this.lastSignMsg = "";
KeyStore ks = KeyStore.getInstance("PKCS12");

try {
ks.load(fiKeyFile, PassWord.toCharArray());
} catch (Exception ex) {
if (fiKeyFile != null)
fiKeyFile.close();
throw ex;
}
Enumeration myEnum = ks.aliases();
String keyAlias = null;
RSAPrivateCrtKey prikey = null;
// keyAlias = (String) myEnum.nextElement();
/* IBM JDK必须使用While循环取最后一个别名，才能得到个人私钥别名 */
while (myEnum.hasMoreElements()) {
keyAlias = (String) myEnum.nextElement();
// System.out.println("keyAlias==" + keyAlias);
if (ks.isKeyEntry(keyAlias)) {
prikey = (RSAPrivateCrtKey) ks.getKey(keyAlias, PassWord.toCharArray());
break;
}
}
if (prikey == null) {
result = false;
throw new Exception("没有找到匹配私钥");
} else {
Signature sign = Signature.getInstance("SHA1withRSA");
sign.initSign(prikey);
sign.update(TobeSigned.getBytes(encoding));
byte signed[] = sign.sign();
byte sign_asc[] = new byte[signed.length * 2];
Hex2Ascii(signed.length, signed, sign_asc);
this.lastResult = new String(sign_asc);
this.lastSignMsg = this.lastResult;
result = true;
}
return result;
}

/**
* 验证签名
*
* @param TobeVerified
* 待验证签名的密文
* @param PlainText
* 待验证签名的明文
* @param CertFile
* 签名者公钥证书
* @return 验证成功返回true，失败返回false(从LastErrMsg属性获取失败原因)
*/
public boolean VerifyMsg(String TobeVerified, String PlainText, String CertFile) throws Exception {
boolean result = false;
ClassLoader cl = CryptNoRestrict.class.getClassLoader();
InputStream certfile = cl.getResourceAsStream(CertFile);
// 传入绝对路径
// FileInputStream certfile = null;
// certfile = new FileInputStream(CertFile);
CertificateFactory cf = CertificateFactory.getInstance("X.509");

X509Certificate x509cert = null;
try {
x509cert = (X509Certificate) cf.generateCertificate(certfile);
} catch (Exception ex) {
if (certfile != null)
certfile.close();
throw ex;
}

RSAPublicKey pubkey = (RSAPublicKey) x509cert.getPublicKey();
Signature verify = Signature.getInstance("SHA1withRSA");
verify.initVerify(pubkey);
byte signeddata[] = new byte[TobeVerified.length() / 2];
Ascii2Hex(TobeVerified.length(), TobeVerified.getBytes(encoding), signeddata);
verify.update(PlainText.getBytes(encoding));
if (verify.verify(signeddata)) {
result = true;
} else {
result = false;
// throw new Exception("验签失败");
}
return result;
}

/**
* 返回上次调用加密、解密、签名函数成功后的输出结果
*
* @return 返回上次调用加密、解密、签名函数成功后的输出结果
*/
public String getLastResult() {
return this.lastResult;
}

/**
* 返回上一次签名结果
*
* @return 签名结果
*/
public String getLastSignMsg() {
return this.lastSignMsg;
}

/**
* 将十六进制数据转换成ASCII字符串
*
* @param len
* 十六进制数据长度
* @param data_in
* 待转换的十六进制数据
* @param data_out
* 已转换的ASCII字符串
*/
private static void Hex2Ascii(int len, byte data_in[], byte data_out[]) {
byte temp1[] = new byte[1];
byte temp2[] = new byte[1];
for (int i = 0, j = 0; i < len; i++) {
temp1[0] = data_in[i];
temp1[0] = (byte) (temp1[0] >>> 4);
temp1[0] = (byte) (temp1[0] & 0x0f);
temp2[0] = data_in[i];
temp2[0] = (byte) (temp2[0] & 0x0f);
if (temp1[0] >= 0x00 && temp1[0] <= 0x09) {
(data_out[j]) = (byte) (temp1[0] + '0');
} else if (temp1[0] >= 0x0a && temp1[0] <= 0x0f) {
(data_out[j]) = (byte) (temp1[0] + 0x57);
}

if (temp2[0] >= 0x00 && temp2[0] <= 0x09) {
(data_out[j + 1]) = (byte) (temp2[0] + '0');
} else if (temp2[0] >= 0x0a && temp2[0] <= 0x0f) {
(data_out[j + 1]) = (byte) (temp2[0] + 0x57);
}
j += 2;
}
}

/**
* 将ASCII字符串转换成十六进制数据
*
* @param len
* ASCII字符串长度
* @param data_in
* 待转换的ASCII字符串
* @param data_out
* 已转换的十六进制数据
*/
private static void Ascii2Hex(int len, byte data_in[], byte data_out[]) {
byte temp1[] = new byte[1];
byte temp2[] = new byte[1];
for (int i = 0, j = 0; i < len; j++) {
temp1[0] = data_in[i];
temp2[0] = data_in[i + 1];
if (temp1[0] >= '0' && temp1[0] <= '9') {
temp1[0] -= '0';
temp1[0] = (byte) (temp1[0] << 4);

temp1[0] = (byte) (temp1[0] & 0xf0);

} else if (temp1[0] >= 'a' && temp1[0] <= 'f') {
temp1[0] -= 0x57;
temp1[0] = (byte) (temp1[0] << 4);
temp1[0] = (byte) (temp1[0] & 0xf0);
}

if (temp2[0] >= '0' && temp2[0] <= '9') {
temp2[0] -= '0';

temp2[0] = (byte) (temp2[0] & 0x0f);

} else if (temp2[0] >= 'a' && temp2[0] <= 'f') {
temp2[0] -= 0x57;

temp2[0] = (byte) (temp2[0] & 0x0f);
}
data_out[j] = (byte) (temp1[0] | temp2[0]);

i += 2;
}

}

protected String replaceAll(String strURL, String strAugs) {

// JDK1.3中String类没有replaceAll的方法
/** ********************************************************** */
int start = 0;
int end = 0;
String temp = new String();
while (start < strURL.length()) {
end = strURL.indexOf(" ", start);
if (end != -1) {
temp = temp.concat(strURL.substring(start, end).concat("%20"));
if ((start = end + 1) >= strURL.length()) {
strURL = temp;
break;
}

} else if (end == -1) {
if (start == 0)
break;
if (start < strURL.length()) {
temp = temp.concat(strURL.substring(start, strURL.length()));
strURL = temp;
break;
}
}

}

temp = "";
start = end = 0;

while (start < strAugs.length()) {
end = strAugs.indexOf(" ", start);
if (end != -1) {
temp = temp.concat(strAugs.substring(start, end).concat("%20"));
if ((start = end + 1) >= strAugs.length()) {
strAugs = temp;
break;
}

} else if (end == -1) {
if (start == 0)
break;
if (start < strAugs.length()) {
temp = temp.concat(strAugs.substring(start, strAugs.length()));
strAugs = temp;
break;
}
}

}

/** **************************************************************** */
return strAugs;
}
}