java实现证书链和签名验证

public static boolean verify(X509Certificate X509certificateRoot,
Collection collectionX509CertificateChain,X509CRL X509crl,String stringTarget) {
//获取证书链长度
int nSize=collectionX509CertificateChain.size();
//将证书链转化为数组
X509Certificate[] arX509certificate=new X509Certificate[nSize];
collectionX509CertificateChain.toArray(arX509certificate);
//声明list，存储证书链中证书主体信息
ArrayList list=new ArrayList();
//沿证书链自上而下，验证证书的所有者是下一个证书的颁布者
Principal principalLast=null;
for(int i=0;i<nSize;i++){//遍历arX509certificate
X509Certificate x509Certificate=arX509certificate[i];
//获取发布者标识
Principal principalIssuer=x509Certificate.getIssuerDN();
//获取证书的主体标识
Principal principalSubject=x509Certificate.getSubjectDN();
//保存证书的序列号
list.add(x509Certificate.getSerialNumber());
if(principalLast!=null){
//验证证书的颁布者是上一个证书的所有者
if(principalIssuer.equals(principalLast)){
try{
//获取上个证书的公钥
PublicKey publickey=arX509certificate[i-1].getPublicKey();
//验证是否已使用与指定公钥相应的私钥签署了此证书
arX509certificate[i].verify(publickey);
}catch(Exception e){
return false;
}
}else{
return false;
}
}
principalLast=principalSubject;
}
//验证根证书是否在撤销列表中
try{
if(!X509crl.getIssuerDN().equals(X509certificateRoot.getSubjectDN()))return false;
X509crl.verify(X509certificateRoot.getPublicKey());
}catch(Exception e){
return false;
}
//在当前时间下，验证证书链中每个证书是否存在撤销列表中
if(X509crl!=null){
try{
//获取CRL中所有的项
Set setEntries=X509crl.getRevokedCertificates();
if(setEntries==null && setEntries.isEmpty()==false){
Iterator iterator=setEntries.iterator();
while(iterator.hasNext()){
X509CRLEntry X509crlentry=(X509CRLEntry)iterator.next();
if(list.contains(X509crlentry.getSerialNumber()))return false;
}
}
}catch(Exception e){
return false;
}
}
//证明证书链中的第一个证书由用户所信任的CA颁布
try{
PublicKey publickey=X509certificateRoot.getPublicKey();
arX509certificate[0].verify(publickey);
}catch(Exception e){
return false;
}
//证明证书链中的最后一个证书的所有者正是现在通信对象
Principal principalSubject=arX509certificate[nSize-1].getSubjectDN();
if(!stringTarget.equals(principalSubject.getName()))return false;
//验证证书链里每个证书是否在有效期里
Date date=new Date();
for(int i=0;i<nSize;i++){
try{
arX509certificate[i].checkValidity(date);
}catch(Exception e){
return false;
}
}
return true;
}
public static boolean verifySign(X509Certificate X509certificateCA,String sign,String original){
try{
//获得签名实例
Signature signature=Signature.getInstance(X509certificateCA.getSigAlgName());
//用证书公钥进行初始化
signature.initVerify(X509certificateCA.getPublicKey());
//更新源数据
signature.update(original.getBytes());
//验证数字签名
return signature.verify(sign.getBytes());
}catch(Exception e){
return false;
}
}

最后

以上就是耍酷学姐为你收集整理的java实现证书链和签名验证的全部内容，希望文章能够帮你解决java实现证书链和签名验证所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。