Java 如何使用文件系统中的.cer文件验证时间戳令牌?
TimeStampToken类(bctsp-jdk16-1.46.jar)中有两个验证方法,其中一个已弃用 不推荐使用的方法使用X509Certificate作为参数,这很容易创建Java 如何使用文件系统中的.cer文件验证时间戳令牌?,java,validation,bouncycastle,timestamping,Java,Validation,Bouncycastle,Timestamping,TimeStampToken类(bctsp-jdk16-1.46.jar)中有两个验证方法,其中一个已弃用 不推荐使用的方法使用X509Certificate作为参数,这很容易创建 InputStream inPFX = getClass().getClassLoader().getResourceAsStream("tsp.cer"); CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC"); X509Cert
InputStream inPFX = getClass().getClassLoader().getResourceAsStream("tsp.cer");
CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
X509Certificate cert = (X509Certificate) cf.generateCertificate(inPFX);
// The validate method just takes the X509Certificate object
token.validate(cert, "BC");
新方法使用SignerInformationVerifier对象。我找到了一种创建SignerInformationVerifier的方法(不确定是否正确),但我仍然需要一个X509CertificateHolder对象
- 如何从文件系统(*.cer文件)上的文件创建X509CertificateHolder
- 这是创建SignerInformationVerifier以验证TimeStampToken的正确方法吗
TimeStampToken token = new TimeStampToken(new CMSSignedData(response));
X509CertificateHolder x = // HOW TODO THIS?
// create the SignerInformationVerifier object
DigestAlgorithmIdentifierFinder daif = new DefaultDigestAlgorithmIdentifierFinder();
DigestCalculatorProvider dcp = new BcDigestCalculatorProvider();
SignerInformationVerifier siv = new BcRSASignerInfoVerifierBuilder(daif, dcp).build(x509ch);
// use the new validate method
token.validate(siv);
试试这个
TimeStampToken token = new TimeStampToken(new CMSSignedData(response));
InputStream in = new FileInputStream("tsp.cer");
CertificateFactory factory = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) factory.generateCertificate(in);
//RSA Signature processing with BC
X509CertificateHolder holder = new X509CertificateHolder(cert.getEncoded());
SignerInformationVerifier siv = new BcRSASignerInfoVerifierBuilder(new DefaultDigestAlgorithmIdentifierFinder(), new BcDigestCalculatorProvider()).build(holder);
//Signature processing with JCA and other provider
//X509CertificateHolder holderJca = new JcaX509CertificateHolder(cert);
//SignerInformationVerifier sivJca = new JcaSimpleSignerInfoVerifierBuilder().setProvider("anotherprovider").build(holderJca);
token.validate(siv);
查看文档的验证签名信息对象部分,了解有关使用BC API进行签名验证的更多信息
您正在以正确的方式创建签名信息验证程序,您可以在示例代码中找到另一种为基于JCA/JCE提供程序的解决方案创建签名信息验证程序的方法