루트 CA 부모가있는 x509 인증서를 만듭니다.

Question

내가 만드는 인증서에 서명해야하는 루트 CA 인증서가 있습니다.

public static X509Certificate generateCertificate(final PublicKey publicKey, 
final PrivateKey privateKey, 
                final String signingAlgorithm, GeneralNames names) 
    throws IOException, CertificateException, OperatorCreationException, NoSuchAlgorithmException 
{ 
    final X500NameBuilder subject = new X500NameBuilder(RFC4519Style.INSTANCE); 

    subject.addRDN(BCStyle.C, COUNTRY_NAME); 
    subject.addRDN(BCStyle.ST, STATE_NAME); 
    subject.addRDN(BCStyle.L, LOCALITY_NAME); 
    subject.addRDN(BCStyle.O, ORGANIZATION_NAME); 
    subject.addRDN(BCStyle.OU, ORGANIZATION_UNIT_NAME); 
    subject.addRDN(BCStyle.E, EMAIL_ADDRESS); 

    final X500NameBuilder issuer = new X500NameBuilder(RFC4519Style.INSTANCE); 

    issuer.addRDN(BCStyle.C, COUNTRY_NAME); 
    issuer.addRDN(BCStyle.ST, STATE_NAME); 
    issuer.addRDN(BCStyle.L, LOCALITY_NAME); 
    issuer.addRDN(BCStyle.O, ORGANIZATION_NAME); 
    issuer.addRDN(BCStyle.OU, ISSUER); 


    final BigInteger sn = new BigInteger(SERIAL_NUMBER_LENGTH, new SecureRandom()); 
    final Date validFrom = Calendar.getInstance().getTime(); 
    final Calendar c = Calendar.getInstance(); 
    c.add(Calendar.YEAR, YEARS_VALID); 
    final Date validUntil = c.getTime(); 

    File file = new File("PATH TO ROOT CA"); 
    CertificateFactory fact = CertificateFactory.getInstance("X.509"); 
    FileInputStream in = new FileInputStream(file); 
    X509Certificate cer = (X509Certificate) fact.generateCertificate(in); 


    final JcaContentSignerBuilder builder = new JcaContentSignerBuilder(signingAlgorithm); 
    ContentSigner signer = builder.build(privateKey); 

    final X509v3CertificateBuilder certBuilder=new JcaX509v3CertificateBuilder(cer, sn, validFrom, validUntil, subject.build(), publicKey); 
    BasicConstraints constr = new BasicConstraints(false); 
     KeyUsage usage = new KeyUsage(KeyUsage.digitalSignature | KeyUsage.nonRepudiation | KeyUsage.keyEncipherment); 
    certBuilder.addExtension(Extension.keyUsage, false, usage); 
    certBuilder.addExtension(Extension.subjectAlternativeName, false, names); 
    certBuilder.addExtension(Extension.basicConstraints, false, constr); 
    // certBuilder.addExtension(Extension.authorityKeyIdentifier, false,utiles.createAuthorityKeyIdentifier(cer)); 
    certBuilder.addExtension(Extension.subjectKeyIdentifier, false, 
         new SubjectKeyIdentifier(publicKey.getEncoded())); 

    final byte[] certBytes = certBuilder.build(signer).getEncoded(); 
    final CertificateFactory certificateFactory = CertificateFactory.getInstance(CERTIFICATE_TYPE); 
    return (X509Certificate) certificateFactory.generateCertificate(new ByteArrayInputStream(certBytes)); 

} 

나는 여러 가지 시도를했지만 정확히 해결책을 찾을 수 없습니다. 또한 Subject Key Identifier 확장에 설정해야 할 내용을 이해하지 못합니다.

Answer 1

당신이 X.509 인증서 생성 과정 오른쪽 못하고있는 것 같다 당신은 기본적으로 아직 CA에 의해 서명하지 인증서의 구조이며, 인증서 서명 요청 (CSR)을 생성

1. 을;
2. 인증 기관 (이 경우 루트 CA)이이 CSR에 서명합니다.

아마도 당신이 찾고있는 것입니다 Sign CSR using Bouncy Castle 좀 봐.