Bouncy Castle：使用现有 CA 签署的证书

Question

我正在尝试创建一个证书 (A)，该证书为存储在 p12 密钥库中的其他证书 (B) 签名。此存储的证书 (B) 已添加到我本地计算机的受信任证书库中。证书 A 用于使用 bouncy Castle 1.52 library 对 pdf 文档进行签名，但我在签名文档中获得的数字签名无效。如果有人可以帮助我，我将解释所做的步骤。首先，我从 p12 密钥库（B）创建一个 CSR：    private static PKCS10CertificationRequest generateCSR() {    PKCS10CertificationRequest csr = null;    try {        initCACert();        PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(                new X500Principal("CN=Requested Test Certificate"), CAcert.getPublicKey());        JcaContentSignerBuilder csBuilder = new JcaContentSignerBuilder("SHA256withRSA");        ContentSigner signer = csBuilder.build(CApk);        csr = p10Builder.build(signer);    } catch (Exception e) {        log.error(e);    }    return csr;}然后，使用此 CSR 生成证书 (A)。    private static Certificate signCSR() throws Exception {     PKCS10CertificationRequest csr = generateCSR();    AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA256withRSA");    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);    X500Name issuer = X500Name.getInstance(CAcert.getSubjectX500Principal().getEncoded());    BigInteger serial = new BigInteger(32, new SecureRandom());    Calendar c = Calendar.getInstance();    c.add(Calendar.SECOND, -1);    Date from = c.getTime();    c.add(Calendar.YEAR, 5);    Date to = c.getTime();    X509v1CertificateBuilder certBuilder = new X509v1CertificateBuilder(issuer, serial, from, to, csr.getSubject(),            csr.getSubjectPublicKeyInfo());    ContentSigner signer = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)            .build(PrivateKeyFactory.createKey(CApk.getEncoded()));    X509CertificateHolder holder = certBuilder.build(signer);    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");    InputStream in = new ByteArrayInputStream(holder.getEncoded());    Certificate cert = certFactory.generateCertificate(in);    return cert;}

Answer 1

我已经确定了问题：我正在以相反的顺序构建证书链。

我有这个订单：

 certificateHolder = new X509CertificateHolder( cert.getEncoded() );

 certificateHolder = new X509CertificateHolder( CAcert.getEncoded() );

正确的顺序是这样的：

certificateHolder = new X509CertificateHolder( CAcert.getEncoded() );

certificateHolder = new X509CertificateHolder( cert.getEncoded() );

我希望有人能发现这些信息有用！