Generate certificates, public and private keys with Java

java ssl openssl keytool
PeterMmm picture PeterMmm · May 29, 2009 · Viewed 40.9k times · Source

I'm looking for a java library or code to generate certificates, public and private keys on the fly without to use third party programs (such as openssl).

I think something that is doeing keytool+openssl but from Java code.

Consider a java servlet based web application secured with ssl and client authentification. I want the servlet container generate client certificates (eg. pkcs12 format) on request only with Java code.

Answer

Sekhar picture Sekhar · Feb 25, 2010

You can generate Certificate in java dynamically, by using a pair or keys. (Public Key, Private Keys). Get These keys as BigInteger format and checking the following code to generate certificate.

RSAPrivateKeySpec serPrivateSpec = new RSAPrivateKeySpec(
    new BigInteger(val of pub key), new BigInteger(val of pri key));
fact = KeyFactory.getInstance("RSA");
PrivateKey serverPrivateKey = fact.generatePrivate(serPrivateSpec);

RSAPublicKeySpec serPublicSpec = new RSAPublicKeySpec(
    new BigInteger(agentCL.getSerPubMod()), new BigInteger(agentCL.getSerPubExp()));
PublicKey serverPublicKey = fact.generatePublic(serPublicSpec);

keyStore = KeyStore.getInstance(IMXAgentCL.STORE_TYPE);
keyStore.load(null, SOMEPWD.toCharArray());

Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

X509Certificate[] serverChain = new X509Certificate[1];
X509V3CertificateGenerator serverCertGen = new X509V3CertificateGenerator();
X500Principal serverSubjectName = new X500Principal("CN=OrganizationName");
serverCertGen.setSerialNumber(new BigInteger("123456789"));
// X509Certificate caCert=null;
serverCertGen.setIssuerDN(somename);
serverCertGen.setNotBefore(new Date());
serverCertGen.setNotAfter(new Date());
serverCertGen.setSubjectDN(somename);
serverCertGen.setPublicKey(serverPublicKey);
serverCertGen.setSignatureAlgorithm("MD5WithRSA");
// certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,new
// AuthorityKeyIdentifierStructure(caCert));
serverCertGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
    new SubjectKeyIdentifierStructure(serverPublicKey));
serverChain[0] = serverCertGen.generateX509Certificate(serverPrivateKey, "BC"); // note: private key of CA

keyStore.setEntry("xyz",
    new KeyStore.PrivateKeyEntry(serverPrivateKey, serverChain),
    new KeyStore.PasswordProtection("".toCharArray()));

Hope this will help you.

Related questions

Change keystore password from no password to a non blank password

I have a jks keystore with no password. When I run the command keytool -list -keystore mykeystore.jks And it prompts me for the keystore password, I simply hit 'enter'. Please note that the keystore password IS NOT the default …

Read More
Generate private and public key file using keytool

I want to know if there is a way to create .key file for (public and private key) using keytool , I understand that we can generate a keystore using below command keytool -genkeypair -keysize 2048 -keyalg RSA -alias appalias -keystore D:\..\.. …

Read More
Will SSLContext.getInstance("TLS") supports TLS v1.1 and TLS v1.2 also?

In my java Code i am creating one instance of SSL Context using command SSLContext ctx = SSLContext.getInstance("TLS"); But in my tomcat server i am setting TLSv1.2 and i am getting handshake error. How we can support all the …

Read More