将CertStore转换为X509Certificate[ ]数组JAVA

Question

我做了一个证书存储，并希望从这个类中的另一个函数中添加另一个证书。

用caCert和intermediateCert制作1类链

List<X509Certificate> certList = new ArrayList<X509Certificate>();
certList.add(0, interCert);
certList.add(1, caCert);
Store<X509Certificate> certs = new JcaCertStore(certList);
certStore = new JcaCertStoreBuilder().addCertificates(certs).build();

我想在第2类中添加一个新的生成用户证书：

certStore = new JcaCertStoreBuilder().addCertificate(certHolder).build();

要将新密钥保存到我的KeyStore，我需要一个证书(X509Certificate[])数组。如何将certStore文件转换为数组以使私钥条目工作？

PrivateKeyEntry privKeyEntry = new PrivateKeyEntry(pair.getPrivate(), chain);
store.setEntry(alias, privKeyEntry, new KeyStore.PasswordProtection(storePassword));

Answer 1

我使用的是BouncyCastle 1.56和JDK1.7。

我认为最简单的方法是从cert存储获取所有证书并将它们添加到数组中(而不是创建另一个cert存储和转换)。

要获取证书存储中的所有证书，可以执行以下操作：

// get all certificates in certStore
Collection<? extends Certificate> allCerts = certStore.getCertificates(null);

有些实现不接受null参数。在这种情况下，您必须创建这样一个选择器(使用java.security.cert.X509CertSelector类)：

Collection<? extends Certificate> allCerts = certStore.getCertificates(new X509CertSelector() {
    @Override
    public boolean match(Certificate cert) {
        // match all certificates (so it'll return all of them)
        return true;
    }
});

在此之后，allCerts将拥有certStore中的2个证书。

现在创建数组并添加所需的所有证书：

// create array
X509Certificate[] certificatesArray = new X509Certificate[3];

// add certificates in allCerts (the 2 that were in certStore)
int i = 0;
for (Certificate c : allCerts) {
    certificatesArray[i] = (X509Certificate) c;
    i++;
}

// add the new certificate (newCert being a X509Certificate)
certificatesArray[2] = newCert;

注：如果您的新证书类型是org.bouncycastle.cert.X509CertificateHolder，则可以使用org.bouncycastle.cert.jcajce.JcaX509CertificateConverter类将其转换为java.security.cert.X509Certificate：

X509CertificateHolder certHolder = ...;
X509Certificate cert = new JcaX509CertificateConverter().getCertificate(certHolder);

也可以用java.security.cert.CertificateFactory手动完成。

X509CertificateHolder certHolder = ...;
CertificateFactory f = CertificateFactory.getInstance("X509");
X509Certificate cert = (X509Certificate) f.generateCertificate(new ByteArrayInputStream(certHolder.getEncoded()));