Generate certificate in Java -- Self signed certificate

最新推荐文章于 2024-09-24 18:55:02 发布

转载最新推荐文章于 2024-09-24 18:55:02 发布 · 765 阅读

java 专栏收录该内容

70 篇文章

订阅专栏

本文将演示如何在Java中程序化地生成SSL证书。证书用于验证服务器的身份，确保客户端信任服务器的真实性。所有互联网上的HTTPS通信都需要服务器提供由受信CA签名的证书。通过使用openssl、Java keytool等工具或自定义代码，可以完成证书生成流程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

This is the first post in this series which I will show you how to generate SSL certificate in Java programmatically. Certificates are frequently used in SSL communication which requires the authentication of server to client. This is to make the client to trust that the server is actually the one it claims. Certificates are really important on the Internet. All HTTPS communications on the Internet need the server side to present their certificates signed by trusted CAs.

The basic flow of a request generation is that we first use some tool to generate the certificate request, this certificate request will be sent to the trusted CAs to sign, after signing the certificate, this certificate will be sent to the requester. The requester may install the certificate on their server thereafter.

There are lots of libraries you can use to complete these steps. For example openssl, Java keytool, iKeyman. Also in Java, you can write the code yourself to generate the certificate.

If you are using keytool, then below command can help you create a private key and its associated self signed certificate.

 
        keytool -genkeypair -
        alias 
         rsakey -keyalg rsa -storepass passphrase -keystore mytestkeys.jks -storetype JKS -dname 
        "CN=ROOT"

In this post, we will first show the easiest way to create a usable certificate-- self signed certificate. A self signed certificate is that the issuer of the certificate is the subject of the certificate, i.e, you sign your own certificate with your own private key.

In Java, there is a class named CertAndKeyGen which can be used to generate keys and certificates. Generate a pair of keys, and provide access to them. This class is provided primarily for ease of use. This provides some simple certificate management functionality. Specifically, it allows you to create self-signed X.509 certificates as well as PKCS 10 based certificate signing requests.

Below is the code snippet to generate a self signed certificate:

 
        import 
         java.security.cert.X509Certificate;
       
        import 
         sun.security.tools.keytool.CertAndKeyGen;
       
        import 
         sun.security.x509.X500Name;
       
        public 
         class 
         SelfSignedCertificateGeneration {
       
        public 
         static 
         void 
         main(String[] args){
       
        try
        {
       
        CertAndKeyGen keyGen=
        new 
         CertAndKeyGen(
        "RSA"
        ,
        "SHA1WithRSA"
        ,
        null
        );
       
        keyGen.generate(
        1024
        );
       
        //Generate self signed certificate
       
        X509Certificate[] chain=
        new 
         X509Certificate[
        1
        ];
       
        chain[
        0
        ]=keyGen.getSelfCertificate(
        new 
         X500Name(
        "CN=ROOT"
        ), (
        long
        )
        365
        *
        24
        *
        3600
        );
       
        System.out.println(
        "Certificate : "
        +chain[
        0
        ].toString());
       
        }
        catch
        (Exception ex){
       
        ex.printStackTrace();
       
        }
       
        }
       
        }

Let's have a look at what the certificate data is :

 
        Certificate : [
       
        [
       
        Version: V3
       
        Subject: CN=ROOT
       
        Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
       
        Key:  Sun RSA public key, 1024 bits
       
        modulus: 114391309107542773913020327258312183039826043488144930936432429784366769808118582358673188617553493179715429490538390339548553158770231498533107085203543482991384318715251748594629731873902297622858400215317090155179482056595085606008433735465924998820797111761561551868239613864908732016915661242341876829949
       
        public exponent: 65537
       
        Validity: [From: Wed Jul 30 21:06:29 SGT 2014,
       
        To: Thu Jul 30 21:06:29 SGT 2015]
       
        Issuer: CN=ROOT
       
        SerialNumber: [    0b000b59]
       
        ]
       
        Algorithm: [SHA1withRSA]
       
        Signature:
       
        0000: 94 F9 DD 3D 95 4F BC 63   A6 A3 09 9E 63 EF CA 91  ...=.O.c....c...
       
        0010: 97 55 C1 9E B2 12 52 13   7A 7B 73 B1 B8 ED A8 EF  .U....R.z.s.....
       
        0020: F5 1C EB 27 71 F2 60 22   BC E9 0B 01 1D 70 C1 5E  ...'q.`".....p.^
       
        0030: D6 D1 E8 AB 4D 2C CC F6   70 2B 7A D4 37 95 7A CC  ....M,..p+z.7.z.
       
        0040: E2 A1 FE F9 3F 11 18 FD   36 CB 22 62 FB 5A E2 5D  ....?...6."b.Z.]
       
        0050: E6 6C BF 61 C7 1F 03 BA   FE B5 85 47 DD 7F C0 CB  .l.a.......G....
       
        0060: F3 F1 A0 79 35 0F 2A F7   79 0E 1E 79 A1 11 2E 44  ...y5.*.y..y...D
       
        0070: 85 10 F2 B3 9F 07 F0 24   D3 1A AC 28 0C CE 4B 04  .......$...(..K.
       
        ]