com.github.spyhunter99.simplejks.CertGenBouncy.java Source code

Introduction

Here is the source code for com.github.spyhunter99.simplejks.CertGenBouncy.java

Source

/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */
package com.github.spyhunter99.simplejks;

import java.io.FileOutputStream;
import java.io.IOException;
import java.math.BigInteger;

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.Provider;
import java.security.cert.Certificate;
import java.security.Security;
import java.security.cert.CertificateException;
import java.util.Calendar;
import java.util.Date;
import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.X509Extension;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;

/**
 *
 * @author AO
 */
public class CertGenBouncy {

    public static void main(String[] args) throws Exception {
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
        keyGen.initialize(1024);
        KeyPair pair = keyGen.generateKeyPair();
        PrivateKey privKey = pair.getPrivate();

        String alias = "server";
        KeyStore keyStore = KeyStore.getInstance("JKS");
        keyStore.load(null, "pass".toCharArray());

        Certificate[] chain = new Certificate[1];
        chain[0] = selfSign(pair, "Dn=localhost,O=test");

        keyStore.setKeyEntry(alias, privKey, "keypass".toCharArray(), chain);

        keyStore.store(new FileOutputStream("keystore.jks"), "keypass".toCharArray());

        //ok now generate a server cert signed by the rootCA
        KeyStore trustStore = KeyStore.getInstance("JKS");
        trustStore.load(null, null);
        trustStore.setCertificateEntry(alias, chain[0]);
        trustStore.store(new FileOutputStream("truststore.jks"), "keypass".toCharArray());
    }

    public static java.security.cert.Certificate selfSign(KeyPair keyPair, String subjectDN)
            throws OperatorCreationException, CertificateException, IOException {
        Provider bcProvider = new BouncyCastleProvider();
        Security.addProvider(bcProvider);

        long now = System.currentTimeMillis();
        Date startDate = new Date(now);

        X500Name dnName = new X500Name(subjectDN);
        BigInteger certSerialNumber = new BigInteger(Long.toString(now)); // <-- Using the current timestamp as the certificate serial number

        Calendar calendar = Calendar.getInstance();
        calendar.setTime(startDate);
        calendar.add(Calendar.YEAR, 30); // <-- 1 Yr validity

        Date endDate = calendar.getTime();

        String signatureAlgorithm = "SHA256WithRSA"; // <-- Use appropriate signature algorithm based on your keyPair algorithm.

        ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithm).build(keyPair.getPrivate());

        JcaX509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(dnName, certSerialNumber,
                startDate, endDate, dnName, keyPair.getPublic());

        // Extensions --------------------------
        // Basic Constraints
        BasicConstraints basicConstraints = new BasicConstraints(true); // <-- true for CA, false for EndEntity

        certBuilder.addExtension(new ASN1ObjectIdentifier("2.5.29.19"), true, basicConstraints); // Basic Constraints is usually marked as critical.

        ASN1Encodable[] subjectAlternativeNames = new ASN1Encodable[] {
                new GeneralName(GeneralName.dNSName, "server"),
                new GeneralName(GeneralName.dNSName, "server.mydomain.com") };
        DERSequence subjectAlternativeNamesExtension = new DERSequence(subjectAlternativeNames);
        certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAlternativeNamesExtension);

        // -------------------------------------
        return new JcaX509CertificateConverter().setProvider(bcProvider)
                .getCertificate(certBuilder.build(contentSigner));
    }
}