查看本类的 API文档回源码主页即时通讯网 - 即时通讯开发者社区!
1   /*
2    * Copyright 2014 The Netty Project
3    *
4    * The Netty Project licenses this file to you under the Apache License,
5    * version 2.0 (the "License"); you may not use this file except in compliance
6    * with the License. You may obtain a copy of the License at:
7    *
8    *   http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13   * License for the specific language governing permissions and limitations
14   * under the License.
15   */
16  
17  package org.jboss.netty.handler.ssl.util;
18  
19  import sun.security.x509.AlgorithmId;
20  import sun.security.x509.CertificateAlgorithmId;
21  import sun.security.x509.CertificateIssuerName;
22  import sun.security.x509.CertificateSerialNumber;
23  import sun.security.x509.CertificateSubjectName;
24  import sun.security.x509.CertificateValidity;
25  import sun.security.x509.CertificateVersion;
26  import sun.security.x509.CertificateX509Key;
27  import sun.security.x509.X500Name;
28  import sun.security.x509.X509CertImpl;
29  import sun.security.x509.X509CertInfo;
30  
31  import java.math.BigInteger;
32  import java.security.KeyPair;
33  import java.security.PrivateKey;
34  import java.security.SecureRandom;
35  import java.security.cert.CertificateException;
36  
37  import static org.jboss.netty.handler.ssl.util.SelfSignedCertificate.*;
38  
39  /**
40   * Generates a self-signed certificate using {@code sun.security.x509} package provided by OpenJDK.
41   */
42  final class OpenJdkSelfSignedCertGenerator {
43  
44      static String[] generate(String fqdn, KeyPair keypair, SecureRandom random) throws Exception {
45          PrivateKey key = keypair.getPrivate();
46  
47          // Prepare the information required for generating an X.509 certificate.
48          X509CertInfo info = new X509CertInfo();
49          X500Name owner = new X500Name("CN=" + fqdn);
50          info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
51          info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(new BigInteger(64, random)));
52          try {
53              info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner));
54          } catch (CertificateException ignore) {
55              info.set(X509CertInfo.SUBJECT, owner);
56          }
57          try {
58              info.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner));
59          } catch (CertificateException ignore) {
60              info.set(X509CertInfo.ISSUER, owner);
61          }
62          info.set(X509CertInfo.VALIDITY, new CertificateValidity(NOT_BEFORE, NOT_AFTER));
63          info.set(X509CertInfo.KEY, new CertificateX509Key(keypair.getPublic()));
64          info.set(X509CertInfo.ALGORITHM_ID,
65                  new CertificateAlgorithmId(new AlgorithmId(AlgorithmId.sha1WithRSAEncryption_oid)));
66  
67          // Sign the cert to identify the algorithm that's used.
68          X509CertImpl cert = new X509CertImpl(info);
69          cert.sign(key, "SHA1withRSA");
70  
71          // Update the algorithm and sign again.
72          info.set(CertificateAlgorithmId.NAME + '.' + CertificateAlgorithmId.ALGORITHM, cert.get(X509CertImpl.SIG_ALG));
73          cert = new X509CertImpl(info);
74          cert.sign(key, "SHA1withRSA");
75          cert.verify(keypair.getPublic());
76  
77          return newSelfSignedCertificate(fqdn, key, cert);
78      }
79  
80      private OpenJdkSelfSignedCertGenerator() { }
81  }