Create x509 certificate that has a Root CA parent

Question

I have a Root CA certificate that has to sign a certificate that I am creating.

public static X509Certificate generateCertificate(final PublicKey publicKey, 
final PrivateKey privateKey,
                                                  final String signingAlgorithm, GeneralNames names)
    throws IOException, CertificateException, OperatorCreationException, NoSuchAlgorithmException
{
    final X500NameBuilder subject = new X500NameBuilder(RFC4519Style.INSTANCE);

    subject.addRDN(BCStyle.C, COUNTRY_NAME);
    subject.addRDN(BCStyle.ST, STATE_NAME);
    subject.addRDN(BCStyle.L, LOCALITY_NAME);
    subject.addRDN(BCStyle.O, ORGANIZATION_NAME);
    subject.addRDN(BCStyle.OU, ORGANIZATION_UNIT_NAME);
    subject.addRDN(BCStyle.E, EMAIL_ADDRESS);

    final X500NameBuilder issuer = new X500NameBuilder(RFC4519Style.INSTANCE);

    issuer.addRDN(BCStyle.C, COUNTRY_NAME);
    issuer.addRDN(BCStyle.ST, STATE_NAME);
    issuer.addRDN(BCStyle.L, LOCALITY_NAME);
    issuer.addRDN(BCStyle.O, ORGANIZATION_NAME);
    issuer.addRDN(BCStyle.OU, ISSUER);


    final BigInteger sn = new BigInteger(SERIAL_NUMBER_LENGTH, new SecureRandom());
    final Date validFrom = Calendar.getInstance().getTime();
    final Calendar c = Calendar.getInstance();
    c.add(Calendar.YEAR, YEARS_VALID);
    final Date validUntil = c.getTime();

    File file = new File("PATH TO ROOT CA");
    CertificateFactory fact = CertificateFactory.getInstance("X.509");
    FileInputStream in = new FileInputStream(file);
    X509Certificate cer = (X509Certificate) fact.generateCertificate(in);


    final JcaContentSignerBuilder builder = new JcaContentSignerBuilder(signingAlgorithm);
    ContentSigner signer = builder.build(privateKey);

    final X509v3CertificateBuilder certBuilder=new  JcaX509v3CertificateBuilder(cer, sn, validFrom, validUntil, subject.build(), publicKey);
    BasicConstraints constr = new BasicConstraints(false);
      KeyUsage usage = new KeyUsage(KeyUsage.digitalSignature | KeyUsage.nonRepudiation | KeyUsage.keyEncipherment);
    certBuilder.addExtension(Extension.keyUsage, false, usage);
    certBuilder.addExtension(Extension.subjectAlternativeName, false, names);
    certBuilder.addExtension(Extension.basicConstraints, false, constr);
   // certBuilder.addExtension(Extension.authorityKeyIdentifier, false,utiles.createAuthorityKeyIdentifier(cer));
     certBuilder.addExtension(Extension.subjectKeyIdentifier, false,
                         new SubjectKeyIdentifier(publicKey.getEncoded()));

   final byte[] certBytes = certBuilder.build(signer).getEncoded();
    final CertificateFactory certificateFactory = CertificateFactory.getInstance(CERTIFICATE_TYPE);
    return (X509Certificate) certificateFactory.generateCertificate(new ByteArrayInputStream(certBytes));

}

I have tried a number of things but I can't find exactly a solution. Also I don't understand what i have to set on Subject Key Identifier extension.

score 0 · Answer 1 · answered Nov 07 '17 at 10:10

It seems you're not getting the X.509 certificate generation process right:

You generate a Certificate Signing Request (CSR), which is basically your certificate's structure, not yet signed by a CA;
A Certificate Authority (in this case, your root CA) signs this CSR.

Have a look at Sign CSR using Bouncy Castle, which is probably what you're looking for.

Create x509 certificate that has a Root CA parent

1 Answers1