使用Java签署CSR不会使用OpenSSL进行验证

我将CSR签名到一个中间证书，这两个证书都是使用OpenSSL生成的。签名代码使用Java Bouncy Castle API，代码成功生成证书。检查证书时，一切正常。发卡机构和其他数据在转储中正确显示

但是，当执行

openssl verify

命令时，它会失败：

0深度查找时出现错误20：无法获取本地颁发者证书

将OpenSSL生成的CSR签名到此同一中间证书将正确验证

使用Java代码检查时，验证成功：

cert.verify（cacert.getPublicKey（））

-----开始证书-----
MIIDEjCCArmgAwIBAgIFAJl/JBYWCGYIKOZJ0EAWIWDTETMBEGA1EDRMKMTUW
MZKXNZKXNDEVMBGA1EAWWMCGH5ENPSAXRLTAXMQ4WDAYDVQLDAVQAHL6EJED
MBsGA1UECgwUTWltb3NhIE5ldHdvcmtzLCBJbmMxCzAJBgNVBAgMAkNBMQswCQYD
VQGEWJVUZAEFW0xNZA4MZAWMDA4MZHAFW0YNZAZMZEWMDA4MZHAMIG8ME0WGWYD
VQKEXRNAW1VC2EGTMV0D39YA3SIELUYZEJMCEGA2UEAXMAMDEYMZCYO4DAW
MTAWMTA3QKM0RKREQUUMXEXABNGNVBAUTCWNZE1NDE4MJIXGJAYBGNVBCOTEIW
OMI1OMM20JBMOMQ7Ojnimrowgaydvqexeymdpintpjnjowzjpknjozeteambgg
A1UEKRMMJA5YJU6YZY6MGY6ZDY6M2MxDTALBGNVBAWTBDMZMZKWWtatBGCQHKJO
PQIBBGGQHKJOPQMBBWNCARUDHYLLBB94GLWSH8B01LVFKL7+6sCw7hZdiMy9JIF
YBNTjlygm1hWorkl6iTuezjdNfxMnFmMucSiJ4l2O4TMiHqmAwga1DewQf
MAMBAf8wHQYDVR0OBBYEFPjbF9wIOB3uq2C7Yf6l8iMSU7SDMIGlBgNVHSMEgZ0w
gZqAFAshdhvN+xIrKpHeFG4o/TrJt6i/OxykeJB4MQSWCQYDVQGEWJVuzelmakg
A1UECBMCQ0ExHTAbBgNVBAoTFE1pbW9zYSBOZXR3b3JrcywgSW5jMQ4wDAYDVQQL
EWVQAHL6EJEYMBYGA1UEAXMPAW50ZXJJZWRPYRXLMTMZMRMWEQYDVQNEWOXNDEY
OTU0NZK1GGQFOABWMGBMGA1udEQQMMAQICCSGAQQBGTJCMAOGCCQGSM49BAMCA0CA
MEQCIFK2FycAFextGiAQPozuT2LFR/AtPDHpGyXn6z3ccUCVAiBFkwn/YBVz5yof
r5YHxgoz0LIJ+XUQLACNTHJHshTDCA==
-----结束证书-----

}

你在比较苹果和橙子

• java.security.cert.Certificate.verify（）

  只需根据提供的公钥检查数字签名

• openssl x509 verify

  检查整个证书链，查找信任锚，并验证链中每个证书的数字签名和过期日期

---

您需要为

openssl

指定

-CAfile

或

-CApath

选项。请参阅。

在openssl中进行一些调试会话后，我发现颁发者名称不匹配。将此行替换为getEncoded。。。

X500Name issuer=newX500Name（cacert.getSubjectX500Principal（）.getName（））；
X500Name issuer=X500Name.getInstance（cacert.getSubjectX500Principal（）.getEncoded（））；

---

已签名证书现在正在使用openssl验证命令进行验证

在openssl验证中，我使用的是verify-CAfile intermediate.pem signed.pem，它有权访问根证书吗？是的，中间包是一个包含根的包。我可以使用OpenSSL对其他csr进行签名，并使用相同的捆绑包进行正确验证。在Java中签名时会有一些不同。我们在Java中这样做是因为我们使用的HSM不支持在OpenSSL中生成密钥对。您能给我们展示一下用于签署CSR的Java代码吗？我在原始帖子中添加了大部分Java签名代码。因为您自己解决了这个问题，请注意：您可以使用PEMWriter，而不是自己创建PEM块。严格来说，生成的PEM块是不正确的，因为换行符应该是

\r\n

而不仅仅是

\n

。您还可以在一行中输出base64数据，但单行有一个最大长度（不记得确切的值）@Lothar:original（PEM）RFC表示64，而base64的MIME RFC（但不是PEM本身）表示76。OpenSSL写入64，但在1.1.0版之前读取4到76的任意倍数；1.1.0版可以读取大约1k的数据。BC写64，但读Java BufferedReader能处理的任何东西（我相信2G）。

public static X509Certificate certFromFile(String path) {
    X509Certificate cert;
    try {
        CertificateFactory fact = CertificateFactory.getInstance("X.509");
        FileInputStream is = new FileInputStream(path);
        cert = (X509Certificate) fact.generateCertificate(is);
    } catch (CertificateException | FileNotFoundException e) {
        String error = e.getMessage();
        System.err.println(error);
        return null;
    }
    return cert;
}

public static String DumpCert(X509Certificate cert) {

    ByteArrayOutputStream out = new ByteArrayOutputStream();
    try {
        out.write("-----BEGIN CERTIFICATE-----\n".getBytes());
        out.write(Base64.encode(cert.getEncoded()));
        out.write("\n-----END CERTIFICATE-----\n".getBytes());
        out.close();
    } catch (IOException | CertificateEncodingException e) {
        System.out.println(e.getMessage());
    }

    String certpem = null;
    try {
        certpem = new String(out.toByteArray(), "ISO-8859-1");
    } catch (UnsupportedEncodingException e) {
        System.out.println(e.getMessage());
    }
    return certpem;
}

public static ContentSigner createSigner(PrivateKey privateKey) {
    try {
        ContentSigner sig = new JcaContentSignerBuilder("SHA256withECDSA").build(privateKey);
        return sig;
    } catch (Exception e) {
        throw new RuntimeException("Could not create content signer.", e);
    }
}

public static String signCSR(PKCS10CertificationRequest csr, GeneralName san, int validity,
                             X509Certificate cacert, KeyStore keystore, String alias) throws Exception {

    Date from = new Date();
    Date to = new Date(System.currentTimeMillis() + (validity * 86400000L));

    PrivateKey cakey = null;
    try {
        cakey = (PrivateKey) keystore.getKey(alias, null);
    } catch (Exception e) {
        System.out.println(e.getMessage());
    }

    GeneralNames subjectAltNames = new GeneralNames(san);

    org.bouncycastle.asn1.x500.X500Name csrSubject = csr.getSubject();
    X500Name issuer = new X500Name(cacert.getSubjectX500Principal().getName());
    X500Name caName = X500Name.getInstance(PrincipalUtil.getIssuerX509Principal(cacert).getEncoded());

    GeneralNames gn = new GeneralNames(new GeneralName(caName));

    BigInteger serial = new BigInteger(32, new SecureRandom());

    SubjectPublicKeyInfo keyinfo = csr.getSubjectPublicKeyInfo();

    DigestCalculator digCalc = new BcDigestCalculatorProvider().get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
    X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);

    X509v3CertificateBuilder certgen = new X509v3CertificateBuilder(issuer, serial, from, to, csrSubject, keyinfo);
    BigInteger serialcert = cacert.getSerialNumber();
    Boolean buildCACert = true;

    PublicKey caKey = cacert.getPublicKey();
    SubjectPublicKeyInfo keyinfoCA = SubjectPublicKeyInfo.getInstance(caKey.getEncoded());

    AuthorityKeyIdentifier akiMain = x509ExtensionUtils.createAuthorityKeyIdentifier(keyinfoCA);
    AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(akiMain.getKeyIdentifier(), gn, serialcert);

    certgen.addExtension(Extension.basicConstraints, false, new BasicConstraints(buildCACert));
    certgen.addExtension(Extension.subjectKeyIdentifier, false, x509ExtensionUtils.createSubjectKeyIdentifier(keyinfo));
    certgen.addExtension(Extension.authorityKeyIdentifier, false, aki);
    certgen.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);

    ContentSigner signer = createSigner(cakey);
    X509CertificateHolder holder = certgen.build(signer);

    X509Certificate cert = null;
    try {
        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
        InputStream in = new ByteArrayInputStream(holder.getEncoded());
        cert = (X509Certificate) certFactory.generateCertificate(in);
    } catch (CertificateException | IOException e) {
        System.out.println(e.getMessage());
    }

    return DumpCert(cert);
}

public static GeneralName getSubjectAlternativeName(PKCS10CertificationRequest csr) {
    org.bouncycastle.asn1.pkcs.Attribute[] certAttributes = csr.getAttributes();
    for (org.bouncycastle.asn1.pkcs.Attribute attribute : certAttributes) {
        if (attribute.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
            Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0));
            GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
            GeneralName name = gns.getNames()[0];
            return name;
        }
    }
    return null;
}

public static String PrepAndSignCSR(String raw_csr, String certPath, String keystore) {

    KeyStore ks = null;
    Object parsedObject = null;
    String alias = "alias";
    String s = null;
    X509Certificate caCert = null;

    StringReader sr = new StringReader(raw_csr);
    PEMParser pemParser = new PEMParser(sr);

    try {
        parsedObject = pemParser.readObject();
        System.out.println("PemParser returned : " + parsedObject);
    } catch (IOException e) {
        String error = e.getMessage();
        System.err.println(error);
    }

    PKCS10CertificationRequest CSR = (PKCS10CertificationRequest) parsedObject;
    caCert = certFromFile(certPath);

    try {
        ks = KeyStore.getInstance("ncipher.sworld", "nCipherKM");
        FileInputStream in = new FileInputStream(keystore);
        ks.load(in, null);
    } catch (KeyStoreException |
            NoSuchAlgorithmException |
            CertificateException |
            IOException |
            NoSuchProviderException e) {
        System.err.println(e.getMessage());
    }

    GeneralName san = getSubjectAlternativeName(CSR);
    try {
        String cert = signCSR(CSR, san, 3500, caCert, ks, alias);
        return cert;
    } catch (Exception e) {
        String error = e.getMessage();
        System.err.println(error);
    }
    return null;
}

public static void main(String[] args) {

    .
    .
    .
    String fini = PrepAndSignCSR(csr, caCertPath, keystore);
    System.out.println(fini);

}