Google X509证书

Question

我想为存储在Google中的私钥生成一个X509证书。

使用Java密钥工具和本地Java“密钥存储库”，我将执行如下操作：

密钥工具-exportcert -alias sign1 -keystore signkeystore -storetype jks -storepass密码-file签名1证书

请参阅http://tutorials.jenkov.com/java-cryptography/keytool.html

使用OpenSSL，我会做这样的事情：

openssl genrsa -out private.key 1024 openssl req -new -x509 -key private.key -out publickey.cer -days 365 openssl pkcs12 -export -out public_privatekey.pfx -inkey private.key -in publickey.cer

请参阅X.509: Private / Public Key

生成证书似乎需要以某种方式访问“私钥”，直接类似于OpenSSL，也可能间接地类似于使用私有密钥存储库的密钥工具。

Gcloud文档似乎使用OpenSSL生成私钥。https://cloud.google.com/load-balancing/docs/ssl-certificates

如何在Google中获得私钥的X509证书。以前有人这样做过吗？

问候Suchak

Answer 1

我看了一下这个线程Creating an X509 Certificate in Java without BouncyCastle?。

然后，我做了以下两个创建一个GCloud X509证书

1. 在GCloud HSM中创建一个键(参见https://cloud.google.com/kms/docs/hsm)
2. 从GCloud下载公钥。
3. 使用下面的代码创建X509证书。
4. 在相同的情况下运行一些单元测试。

    /**
     * Create a self-signed X.509 based on a public key
     * @param googlePublicKey the Public key downloaded from Google Cloud HSM
     * @param dn        the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
     * @param days      how many days from now the Example is valid for
     * @param algorithm the signing algorithm, eg "SHA1withRSA"
     */
    public static X509Certificate generateRSACertificate(String googlePublicKey, String dn, int days, String algorithm)
            throws GeneralSecurityException, IOException {
        byte[] derKey = Base64.decodeBase64(googlePublicKey);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(derKey);
        PublicKey rsaKey = KeyFactory.getInstance("RSA").generatePublic(keySpec);
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        KeyPair keyPair = keyPairGenerator.generateKeyPair();
        PrivateKey privkey = keyPair.getPrivate();
        X509CertInfo info = new X509CertInfo();
        Date from = new Date();
        Date to = new Date(from.getTime() + days * 86400000l);
        CertificateValidity interval = new CertificateValidity(from, to);
        BigInteger sn = new BigInteger(64, new SecureRandom());
        X500Name owner = new X500Name(dn);

        info.set(X509CertInfo.VALIDITY, interval);
        info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn));
        info.set(X509CertInfo.SUBJECT, owner);
        info.set(X509CertInfo.ISSUER, owner);
        info.set(X509CertInfo.KEY, new CertificateX509Key(rsaKey));
        info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
        AlgorithmId algo = new AlgorithmId(AlgorithmId.md5WithRSAEncryption_oid);
        info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo));

        // Sign the cert to identify the algorithm that's used.
        X509CertImpl cert = new X509CertImpl(info);
        cert.sign(privkey, algorithm);

        // Update the algorith, and resign.
        algo = (AlgorithmId) cert.get(X509CertImpl.SIG_ALG);
        info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo);
        cert = new X509CertImpl(info);
        cert.sign(privkey, algorithm);
        return cert;
    }

所用进口品

import org.apache.commons.codec.binary.Base64;
import sun.security.x509.*;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.*;
import java.security.spec.X509EncodedKeySpec;
import java.util.Collection;
import java.util.Date;