Sign CSR using Bouncy Castle

by

Ok … I was looking to do the same stuff and for the life of me I couldn’t figure out how. The APIs all talk about generating the key pairs and then generating the cert but not how to sign a CSR. Somehow, quite by chance – here’s what I found.

Since PKCS10 represents the format of the request (of the CSR), you first need to put your CSR into a PKCS10Holder. Then, you pass it to a CertificateBuilder (since CertificateGenerator is deprecated). The way you pass it is to call getSubject on the holder.

Here’s the code (Java, please adapt as you need):

public static X509Certificate sign(PKCS10CertificationRequest inputCSR, PrivateKey caPrivate, KeyPair pair)
        throws InvalidKeyException, NoSuchAlgorithmException,
        NoSuchProviderException, SignatureException, IOException,
        OperatorCreationException, CertificateException {   

    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder()
            .find("SHA1withRSA");
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder()
            .find(sigAlgId);

    AsymmetricKeyParameter foo = PrivateKeyFactory.createKey(caPrivate
            .getEncoded());
    SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(pair
            .getPublic().getEncoded());

    PKCS10CertificationRequestHolder pk10Holder = new PKCS10CertificationRequestHolder(inputCSR);
    //in newer version of BC such as 1.51, this is 
    //PKCS10CertificationRequest pk10Holder = new PKCS10CertificationRequest(inputCSR);

    X509v3CertificateBuilder myCertificateGenerator = new X509v3CertificateBuilder(
            new X500Name("CN=issuer"), new BigInteger("1"), new Date(
                    System.currentTimeMillis()), new Date(
                    System.currentTimeMillis() + 30 * 365 * 24 * 60 * 60
                            * 1000), pk10Holder.getSubject(), keyInfo);

    ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(foo);        

    X509CertificateHolder holder = myCertificateGenerator.build(sigGen);
    X509CertificateStructure eeX509CertificateStructure = holder.toASN1Structure(); 
    //in newer version of BC such as 1.51, this is 
    //org.spongycastle.asn1.x509.Certificate eeX509CertificateStructure = holder.toASN1Structure(); 

    CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");

    // Read Certificate
    InputStream is1 = new ByteArrayInputStream(eeX509CertificateStructure.getEncoded());
    X509Certificate theCert = (X509Certificate) cf.generateCertificate(is1);
    is1.close();
    return theCert;
    //return null;
}

As you can see, I’ve generated the request outside this method, but passed it in. Then, I have the PKCS10CertificationRequestHolder to accept this as a constructor arg.

Next, in the X509v3CertificateBuilder arguments, you’ll see the pk10Holder.getSubject – this is apparently all you need? If something is missing, please let me know too!!! It worked for me. The cert I generated correctly had the DN info I needed.

Wikipedia has a killer section on PKCS – http://en.wikipedia.org/wiki/PKCS

More Related Contents:

  1. Scala Iterable[(String, Long)] to SortedMap[String,Long] or TreeMap[String, Long] sorted in decreasing order of value [closed]
  2. Add JAR files to a Spark job – spark-submit
  3. Does the JVM prevent tail call optimizations?
  4. Spark: How to map Python with Scala or Java User Defined Functions?
  5. Spark read file from S3 using sc.textFile (“s3n://…)
  6. Split list into multiple lists with fixed number of elements in java 8
  7. What are the best use cases for Akka framework [closed]
  8. Hash String via SHA-256 in Java
  9. Spark Strutured Streaming automatically converts timestamp to local time
  10. How can I update a broadcast variable in spark streaming?
  11. JavaFX entirely customized windows?
  12. scp transfer via java
  13. Matrix Multiplication in Apache Spark [closed]
  14. How to include the Spongy Castle JAR in Android?
  15. Equivalent of Scala dropWhile
  16. What’s the Scala way to implement a retry-able call like this one?
  17. Generating X509 Certificate using Bouncy Castle Java
  18. How do I resolve “WILL_NOT_PERFORM” MS AD reply when trying to change password in scala w/ the unboundid LDAP SDK?
  19. Get a PrivateKey from a RSA .pem file [duplicate]
  20. Why does “split” on an empty string return a non-empty array?
  21. Wrong version of keystore on android call
  22. Is gzip format supported in Spark?
  23. Change output filename prefix for DataFrame.write()
  24. How can I force Spark to execute code?
  25. How to save models from ML Pipeline to S3 or HDFS?
  26. Difference between SparkContext, JavaSparkContext, SQLContext, and SparkSession?
  27. Accessing scala.None from Java
  28. Getting GPG Decryption To Work In Java (Bouncy Castle)
  29. TLS 1.2 + Java 1.6 + BouncyCastle
  30. In Scala, how can I subclass a Java class with multiple constructors?

Leave a Comment