java - 使用自签名证书生成签名
问题描述
我有以下示例代码,用于使用自签名证书生成签名
public static String generateSignature(String data) throws Exception {
System.out.println("@@inside generateSignature: " + data);
String signature;
String jksFilepath = "E:\\test.jks";
try {
// Adding Security Provider for PKCS 12
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
// Setting password for the e-Token
// logging into token
ks = KeyStore.getInstance("jks");
FileInputStream fileInputStream = new FileInputStream(jksFilepath);
// Loading Keystore
// System.out.println("loading keystore");
ks.load(fileInputStream, JKSPassword);
Enumeration<String> e = ks.aliases();
while (e.hasMoreElements()) {
alias = e.nextElement();
// System.out.println("Alias of the e-Token : "+ alias);
UserCert = (X509Certificate) ks.getCertificate(alias);
UserCertPubKey = (PublicKey) ks.getCertificate(alias).getPublicKey();
// System.out.println("loading Private key");
UserCertPrivKey = (PrivateKey) ks.getKey(alias, JKSPassword);
}
// Method Call to generate Signature
signature = MakeSignature(data);
return signature;
} catch (Exception e) {
e.printStackTrace();
System.out.println("generateSignature" + e.getCause());
throw new Exception();
}
}
private static String MakeSignature(String data) {
System.out.println("@@inside MakeSignature...");
try {
PrivateKey privateKey = (PrivateKey) ks.getKey(alias, JKSPassword);
myPubCert = (X509Certificate) ks.getCertificate(alias);
Store certs = new JcaCertStore(Arrays.asList(myPubCert));
CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
generator.addSignerInfoGenerator(new JcaSimpleSignerInfoGeneratorBuilder().setProvider("BC").build("SHA256withRSA", privateKey, myPubCert));
generator.addCertificates(certs);
CMSTypedData data1 = new CMSProcessableByteArray(data.getBytes());
CMSSignedData signed = generator.generate(data1, true);
BASE64Encoder encoder = new BASE64Encoder();
String signedContent = encoder.encode((byte[]) signed.getSignedContent().getContent());
String envelopedData = encoder.encode(signed.getEncoded());
return envelopedData;
} catch (Exception e) {
e.printStackTrace();
System.out.println("MakeSignature ==" + e.getCause());
return "";
}
}
还有一些相关的功能,但为了简要说明,我没有添加它。
现在我想用 PHP 做同样的事情。
JKS不适用于 PHP 作为其 Java 的密钥库。
我尝试了具有不同加密方法集的open_ssl函数。但是我没有得到与通过这个java代码得到的相同的预期结果(“不同”是关于生成签名的比特率和长度)。
有人可以帮我在 PHP 中实现相同的签名生成吗?
解决方案
我觉得PHP官方文档说的很清楚了:http: //php.net/manual/en/function.openssl-csr-new.php
Example #1 创建自签名证书
<?php
$dn = array(
"countryName" => "GB",
"stateOrProvinceName" => "Somerset",
"localityName" => "Glastonbury",
"organizationName" => "The Brain Room Limited",
"organizationalUnitName" => "PHP Documentation Team",
"commonName" => "Wez Furlong",
"emailAddress" => "wez@example.com"
);
// Generate a new private (and public) key pair
$privkey = openssl_pkey_new(array(
"private_key_bits" => 2048,
"private_key_type" => OPENSSL_KEYTYPE_RSA,
));
// Generate a certificate signing request
$csr = openssl_csr_new($dn, $privkey, array('digest_alg' => 'sha256'));
// Generate a self-signed cert, valid for 365 days
$x509 = openssl_csr_sign($csr, null, $privkey, $days=365, array('digest_alg' => 'sha256'));
// Save your private key, CSR and self-signed cert for later use
openssl_csr_export($csr, $csrout) and var_dump($csrout);
openssl_x509_export($x509, $certout) and var_dump($certout);
openssl_pkey_export($privkey, $pkeyout, "mypassword") and var_dump($pkeyout);
// Show any errors that occurred here
while (($e = openssl_error_string()) !== false) {
echo $e . "\n";
}
然后可以调用openssl_sign
: http: //php.net/manual/en/function.openssl-sign.php,使用生成的私钥进行签名。
如果您想在 PHP 代码中使用 Java(JKS) 的密钥,您应该先导出密钥,然后使用 PHP 函数加载密钥。
推荐阅读
- scala - 使用 scala.sys.process 和 ByteArrayOutputStream 截断输出
- java - 您的 SQL 语法有错误 - hibernate 和 mysql
- sql - 如何正确构建触发器和 FK 级联更新共存?
- c# - EF CORE 2.1 HasConversion 在日期时间类型的所有属性上
- php - 雄辩的关系返回不能转换为字符串
- c# - 为什么ContinueWith返回任务
> - html - css中移动视图中的填充
- php - 如何使用 Doctrine2 将实体的克隆保存为更新
- c++ - OpenCV 编辑单波段并重新合并
- java - 我如何使用 Lambda 在列表列表中收集属性值?