X509扩展

Question

如何在java中为x509证书设置扩展，使用赏金城堡API？

我成功地完成了这样的“基本约束”：

...
X509V3CertificateGenerator gen = new X509V3CertificateGenerator();
...
boolean crit;
boolean isCa;
gen.addExtension(X509Extensions.BasicConstraints, crit, new BasicConstraints(isCa));

但是，我不知道如何为IssuerAlternativeName或KeyUsage做同样的事情。

Answer 1

尝尝这个

 KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign
        | KeyUsage.digitalSignature | KeyUsage.keyEncipherment
        | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
 gen.addExtension(Extension.keyUsage, false, usage);


 GeneralNames issuerAltName = new GeneralNames(new GeneralName(new X509Name("CN=somedomain.tld")));
    gen.addExtension(X509Extensions.IssuerAlternativeName, false, issuerAltName);