我正在尝试签署一些 X509 证书。我的根私钥是 ECDSA secp384r1。我正在使用充气城堡。似乎发生的情况是,在生成证书签名时,使用的 Signature 类无法理解我的 ECDSA 密钥。
生成的代码如下:
X509V3CertificateGenerator v3CertGen = new X509V3CertificateGenerator();
v3CertGen.setSerialNumber(BigInteger.valueOf(serialNumber));
v3CertGen.setIssuerDN(issuerPrincipal);
v3CertGen.setNotBefore(notBefore);
v3CertGen.setNotAfter(notAfter);
v3CertGen.setSubjectDN(subjectDN);
v3CertGen.setPublicKey(publicKey);
v3CertGen.setSignatureAlgorithm(CERT_SIGNATURE_ALGORITHM); // this is ECDSAWITHSHA1
X509Certificate cert = v3CertGen.generate(privateKey, BOUNCY_CASTLE_PROVIDER); // "BC"
输出是:
java.security.InvalidKeyException: can't identify DSA private key.
at org.bouncycastle.jce.provider.DSAUtil.generatePrivateKeyParameter(Unknown Source)
at org.bouncycastle.jce.provider.JDKDSASigner.engineInitSign(Unknown Source)
at java.security.Signature.initSign(Signature.java:480)
at org.bouncycastle.x509.X509Util.calculateSignature(Unknown Source)
at org.bouncycastle.x509.X509V3CertificateGenerator.generate(Unknown Source)
at org.bouncycastle.x509.X509V3CertificateGenerator.generate(Unknown Source)
at com.snip.utils.CertificateUtility.generateAndSignCertificate(CertificateUtility.java:147)
通过阅读 bouncycastle 源代码,我跟踪了这个问题并使用以下代码片段重现它:
Signature sig = Signature.getInstance(CERT_SIGNATURE_ALGORITHM, BOUNCY_CASTLE_PROVIDER);
System.out.println(sig.getAlgorithm());
System.out.println(sig.toString());
System.out.println(sig.getClass().getName());
try
{
sig.initSign(privateKey);
System.out.println(sig.toString());
} catch (Exception e) {
e.printStackTrace();
}
产生输出:
SHA1withECDSA
Signature object: SHA1withECDSA<not initialized>
org.bouncycastle.jce.provider.JDKDSASigner$ecDSA
java.security.InvalidKeyException: can't identify DSA private key.
at org.bouncycastle.jce.provider.DSAUtil.generatePrivateKeyParameter(Unknown Source)
at org.bouncycastle.jce.provider.JDKDSASigner.engineInitSign(Unknown Source)
at java.security.Signature.initSign(Signature.java:480)
at com.snip.utils.CertificateUtility.<init>(CertificateUtility.java:99)
问题是我在这一点上完全迷失了。我不知道如何让证书生成器给我一个签名证书。有谁知道我做错了什么?