java 从 PKCS12（比如pfx格式）证书中提取私钥证书（PrivateKey）和受信任的公钥证书（X509Certificate）的序列号（SerialNumber）

Posted 2022-08-08 frankyou

 

import lombok.Cleanup;
import lombok.Getter;
import lombok.Setter;
import lombok.SneakyThrows;
import lombok.experimental.UtilityClass;

import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.Enumeration;

/**
 * An utility class for obtaining @link PrivateKey and the serial number of the trusted @link X509Certificate 
 * from keystore in PKCS12 format
 */
@Getter
@Setter
@UtilityClass
public class SignCertInfo 

  private static final SignCertInfo DEFAULT = new SignCertInfo();

  private String certId;
  private PrivateKey privateKey;

  public static SignCertInfo createNew(Configs configs) 
    return createNewFrom(getKeyStore(configs), configs);
  

  @SneakyThrows
  private static SignCertInfo createNewFrom(KeyStore store, Configs configs) 
    Enumeration<String> aliases = store.aliases();
    while (aliases.hasMoreElements()) 
      String alia = aliases.nextElement();
      if (isX509Cert(store, alia)) 
        newSignCertInfo(store, alia, configs);
      
    
    return DEFAULT;
  

  @SneakyThrows
  private static KeyStore getKeyStore(Configs configs) 
    @Cleanup FileInputStream stream = new FileInputStream(configs.getPfxPath());
    KeyStore store = KeyStore.getInstance(Pkcs12KeyStore.TYPE, Pkcs12KeyStore.PROVIDER);
    store.load(stream, configs.getPfxPasswd().toCharArray());
    return store;
  

  @SneakyThrows
  private static boolean isX509Cert(KeyStore store, String alia) 
    return CertificateType.X509.equalsIgnoreCase(store.getCertificate(alia).getType());
  

  @SneakyThrows
  private static SignCertInfo newSignCertInfo(KeyStore store, String alia, Configs configs) 
    SignCertInfo signCertInfo = new SignCertInfo();
    signCertInfo.setCertId(((X509Certificate) store.getCertificate(alia)).getSerialNumber().toString());
    signCertInfo.setPrivateKey((PrivateKey) store.getKey(alia, configs.getPfxPasswd().toCharArray()));
    return signCertInfo;
  

 

public interface Pkcs12KeyStore 

  String TYPE = "PKCS12";

  String PROVIDER = "SunJSSE";