存储 X509AttributeCertificateHolder 对象，尤其是 attrCert 本地并打开它

Question

有一个选项可以将 X509Certificate 本地存储到 Bouncy Castle API 中的 class JcaPEMWriter。存储 X509Certificate 后，我可以使用以下命令用 openssl 打开它：

openssl x509 -in certificate.pem -text

我有以下代码：

X509AttributeCertificateHolder att = acBuilder.build(new JcaContentSignerBuilder("SHA1WithRSA").setProvider("BC").build(caprivkey));

现在我想将 attrCert（属性证书）存储在本地，它包含在 att 变量中。我怎样才能做到这一点？以及如何打开 attrCert，是否可以使用 openssl 或任何其他工具打开它？

Answer 1

要将您的属性证书保存在 PEM 文件中，您也可以使用 JcaPEMWriter：

// save the Attribute Certificate to attcert.pem file
JcaPEMWriter writer = new JcaPEMWriter(new FileWriter("attcert.pem"));
writer.writeObject(att);
writer.close();

该文件将包含 base64 内容，如下所示：

-----BEGIN ATTRIBUTE CERTIFICATE-----
MIIBvzCCASgCAQEwZ6BlMGCkXjBcMQswCQYDVQQGEwJBVTEoMCYGA1UECgwfVGhl
IExlZ2lvbiBvZiB0aGUgQm91bmN5IENhc3RsZTEjMCEGA1UECwwaQm91bmN5IFBy
aW1hcnkgQ2VydGlmaWNhdGUCAQKgYjBgpF4wXDELMAkGA1UEBhMCQVUxKDAmBgNV
BAoMH1RoZSBMZWdpb24gb2YgdGhlIEJvdW5jeSBDYXN0bGUxIzAhBgNVBAsMGkJv
dW5jeSBQcmltYXJ5IENlcnRpZmljYXRlMA0GCSqGSIb3DQEBBQUAAgF7MCIYDzIw
MTcwNzA2MTE1MDExWhgPMjAxNzA3MDYxMTUxNTFaMCAwHgYDVQRIMRcwFaEThhFp
ZDovL0RBVTEyMzQ1Njc4OTANBgkqhkiG9w0BAQUFAAOBgQBy3epbynwILi/H0DkQ
UXDgIWXXN5oRQem9DJ2AhYl6JHeKOk3ML87axq+ukWYjZoo3eP2rIxuDU6jWRak1
+n92KLsc/zSFaAdxxYjXQbjTpqEafvEea4QPd4PfPHA9nd4QNKox4H1lNhDeyqtP
B4iU+bkA1bKDo4dnhXVtJaAlkg==
-----END ATTRIBUTE CERTIFICATE-----

遗憾的是，openssl中似乎没有具体命令来检查属性证书（检查this discussion and this message with no replies - there's an extended version of openssl似乎支持它，虽然我没有测试过）。

但是您可以使用 asn1parse 选项检查 ASN.1 结构：

openssl asn1parse -dump -i -in attcert.pem

输出将是 ASN.1 结构，如下所示：

    0:d=0  hl=4 l= 447 cons: SEQUENCE          
    4:d=1  hl=4 l= 296 cons:  SEQUENCE          
    8:d=2  hl=2 l=   1 prim:   INTEGER           :01
   11:d=2  hl=2 l= 103 cons:   SEQUENCE          
   13:d=3  hl=2 l= 101 cons:    cont [ 0 ]        
   15:d=4  hl=2 l=  96 cons:     SEQUENCE          
   17:d=5  hl=2 l=  94 cons:      cont [ 4 ]        
   19:d=6  hl=2 l=  92 cons:       SEQUENCE          
   21:d=7  hl=2 l=  11 cons:        SET               
   23:d=8  hl=2 l=   9 cons:         SEQUENCE          
   25:d=9  hl=2 l=   3 prim:          OBJECT            :countryName
   30:d=9  hl=2 l=   2 prim:          PRINTABLESTRING   :AU
   34:d=7  hl=2 l=  40 cons:        SET               
   36:d=8  hl=2 l=  38 cons:         SEQUENCE          
   38:d=9  hl=2 l=   3 prim:          OBJECT            :organizationName
   43:d=9  hl=2 l=  31 prim:          UTF8STRING        :The Legion of the Bouncy Castle
... and so on

或者您可以使用 Bouncy Castle 读取文件：

import org.bouncycastle.cert.X509AttributeCertificateHolder;
import org.bouncycastle.util.encoders.Base64;

String pem = // read contents from PEM file
// Convert to AC object
byte[] data = Base64.decode(pem.getBytes());
X509AttributeCertificateHolder holder = new X509AttributeCertificateHolder(data);

存储 X509AttributeCertificateHolder 对象，尤其是 attrCert 本地并打开它

Store X509AttributeCertificateHolder object, especially attrCert local and open it

java

openssl

bouncycastle

attributecertificate