0
$\begingroup$

i was requested to write a programmer that can generate A SHA2 certificate. So i wrote a tester class to try and mimic Keytool process of generating One (referencing base of this: url https://www.sslsupportdesk.com/java-keytool-commands/). And i'm facing problem with Getting Subjectdetails... how can get those values to be write on certificate...

 package test;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.Principal;
 import java.security.PrivateKey;
 import java.security.Security;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Scanner;

 import sun.security.tools.keytool.CertAndKeyGen;
 import sun.security.x509.BasicConstraintsExtension;
 import sun.security.x509.CertificateExtensions;
 import sun.security.x509.GeneralName;
 import sun.security.x509.X500Name;
  import sun.security.x509.X509CertImpl;
  import sun.security.x509.X509CertInfo;

public class TesterClass {

public static Scanner in = new Scanner(System.in);  
private static String CN;   
private static String OU;
private static String DP;
private static String PS ;
private static String CTY;
private static String countryCode;

public static void main (String []args) {
    try{

        System.out.println("............................Subject....................................................");
        String SubjectDetails = SubjectDetails("Localhost", "LIBS", "Marketing", "Weasten Cape", "Cape Town", "RSA").toString();
        System.out.println("Subject Details:   " + SubjectDetails);

                CertAndKeyGen keyGen = new CertAndKeyGen("RSA","SHA256withRSA", null);
                keyGen.generate(2048);
                PrivateKey rootPrivatekey = keyGen.getPrivateKey();


                X509Certificate  rootCertificate = keyGen.getSelfCertificate(new X500Name(SubjectDetails),  (long) 365 * 24 * 60 * 60);                 
                CertAndKeyGen intermediateKeyGen  = new CertAndKeyGen("RSA", "SHA256withRSA", null) ;
                intermediateKeyGen.generate(2048);
                PrivateKey middlePrivateKey = intermediateKeyGen.getPrivateKey();


                X509Certificate middleCertificate = intermediateKeyGen.getSelfCertificate(new X500Name(SubjectDetails),  (long) 365 * 24 * 60 * 60);

                CertAndKeyGen leafKeyGen  = new CertAndKeyGen("RSA", "SHA256withRSA", null) ;
                leafKeyGen.generate(2048);
                PrivateKey topPrivateKey = leafKeyGen.getPrivateKey();

                X509Certificate topCertificate = leafKeyGen.getSelfCertificate(new X500Name(SubjectDetails), (long) 365 * 24 * 60 * 60);

                rootCertificate =  createSignedCertificate(rootCertificate,rootCertificate,rootPrivatekey);
                middleCertificate = createSignedCertificate(middleCertificate,rootCertificate,rootPrivatekey);
                topCertificate = createSignedCertificate(topCertificate,middleCertificate,middlePrivateKey);

                X509Certificate [] chain = new X509Certificate[3];
                chain[0] = topCertificate;
                chain[1] = middleCertificate;
                chain[2] = rootCertificate;

                System.out.println("All Ceritifactes : "+ Arrays.toString(chain));


            } catch (Exception e) {
                System.out.println("Unable To generata certificate");
            }

}
private static String SubjectDetails( String CN, String OU, String DP, String PS ,String CTY,  String countryCode){ 
    return "CN :"+CN + " OU :" +OU + " DP :"+PS +" PS :" +PS +" CTY : "+ CTY + " CC : "+countryCode;
}
private static X509Certificate createSignedCertificate(X509Certificate cetrificate,X509Certificate issuerCertificate,PrivateKey issuerPrivateKey){
     try{
            Principal issuer = issuerCertificate.getSubjectDN();
            String issuerSigAlg = issuerCertificate.getSigAlgName();

            byte[] inCertBytes = cetrificate.getTBSCertificate();
            X509CertInfo info = new X509CertInfo(inCertBytes);
            info.set(X509CertInfo.ISSUER, (X500Name) issuer);

            //No need to add the BasicContraint for leaf cert
            if(!cetrificate.getSubjectDN().getName().equals("CN=TOP")){
                CertificateExtensions exts=new CertificateExtensions();
                BasicConstraintsExtension bce = new BasicConstraintsExtension(true, -1);
                exts.set(BasicConstraintsExtension.NAME,new BasicConstraintsExtension(false, bce.getExtensionValue()));
                info.set(X509CertInfo.EXTENSIONS, exts);
            }

            X509CertImpl outCert = new X509CertImpl(info);
            outCert.sign(issuerPrivateKey, issuerSigAlg);

            return outCert;
        }catch(Exception ex){
            ex.printStackTrace();
        }
        return null;
}

}

result with out Subject Details All Ceritifactes : [[ [ Version: V3 Subject: CN=TOP Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

Key: Sun RSA public key, 2048 bits modulus: 23644366404290404551601092565975128506177001847891154074172141743606475634799434549264584225895312201467421294123283982954919814996062330336944856928299562295969912097644280844528647100573324610357340079466679456361130689816835854193624185509646676549941085842146932755460525399060506346574649566638160724653877981279688687214872609565619767600078830270479805069820418991656004905022482424926521296274446244095317024025805303769891023726868850935807029925585107204415341778771026974007724479482537301866496567382574858017743745498321040129863521209375370022680542085888914041857551085250851200473600717107939345352477 public exponent: 65537 Validity: [From: Tue Oct 10 13:43:48 CAT 2017, To: Wed Oct 10 13:43:48 CAT 2018] Issuer: CN=MIDDLE SerialNumber: [ 0aa3ef90]

] Algorithm: [SHA256withRSA] Signature: 0000: 02 38 44 B0 D0 61 C9 0F 67 AC 36 7D 8C 1D 32 39 .8D..a..g.6...29 0010: D9 0A 7C 94 38 87 63 C6 7A AB 31 60 55 AD 18 46 ....8.c.z.1`U..F 0020: 09 0D E8 BF 88 CC 24 AE 37 0C 79 E3 61 65 84 51 ......$.7.y.ae.Q 0030: FE 02 19 84 6A DF FC 12 8C B0 EE 2A 11 2D BD C7 ....j......*.-.. 0040: AE FA 2B 7A AB D3 0B C1 16 C2 44 CA C3 E5 52 55 ..+z......D...RU 0050: CA DF 18 C9 37 6F E8 49 45 83 09 4E C6 B1 C0 EC ....7o.IE..N.... 0060: 19 31 80 90 F3 62 7E CE 74 3B 17 63 48 96 CF 4A .1...b..t;.cH..J 0070: 8E 0C C6 F2 D9 36 D4 50 AA 73 1D 3C 1F 13 4F 3A .....6.P.s.<..O: 0080: 5E E7 AF 59 B8 6F B0 35 12 07 D5 32 94 33 EE D9 ^..Y.o.5...2.3.. 0090: 62 AA 86 F9 E5 A5 34 47 34 4B F3 37 82 CF CF F3 b.....4G4K.7.... 00A0: EC 8F 79 38 D3 E2 31 86 F1 6F 28 28 9C B6 28 3F ..y8..1..o((..(? 00B0: 3E C0 B8 56 A3 8D B5 1F 5A F9 BD BD 10 35 83 48 >..V....Z....5.H 00C0: E9 1D E6 9A 59 94 CD 3F 17 EA 2C B4 45 73 29 7C ....Y..?..,.Es). 00D0: 3B 15 BC 79 C1 02 F6 54 12 F0 EC 21 F3 C6 77 A3 ;..y...T...!..w. 00E0: 71 2F FF 5A 2C 25 DD 93 0E A4 BE 92 E7 51 6C 22 q/.Z,%.......Ql" 00F0: FB F0 1D C7 CB 5E 02 C2 35 E2 78 45 92 69 33 4F .....^..5.xE.i3O

], [ [ Version: V3 Subject: CN=MIDDLE Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

Key: Sun RSA public key, 2048 bits modulus: 27555616714820657196805988212806486767575775346224413480896581484705473707509450343953445714071356271679109884264833516368758548352111249541205497423410102462058172616142996264898731339599156194080128849256871437929078805234255286029447072619916648084816342670000740978062892192037544521681346643337741243504115339147613404156968501513960590161584292792808354216856155683620114052384146188424396265163408556329521901880970814262936345294639669715499597706818337160007190031805274495044530282757342461349001497287852484934016603858941060540175157937058374362212142928435305708469189541787963970070180962448548213065031 public exponent: 65537 Validity: [From: Tue Oct 10 13:43:46 CAT 2017, To: Wed Oct 10 13:43:46 CAT 2018] Issuer: CN=To SerialNumber: [ 31d0643c]

Certificate Extensions: 1 [1]: ObjectId: 2.5.29.19 Criticality=false BasicConstraints:[ CA:true PathLen:2147483647 ]

] Algorithm: [SHA256withRSA] Signature: 0000: 52 18 9C 53 5D 0D 16 7A 57 CC C4 59 47 F0 59 3E R..S]..zW..YG.Y> 0010: CE C4 3D 49 99 45 66 DC AE EF CB A7 B8 2F 83 9B ..=I.Ef....../.. 0020: 0D A4 86 32 69 B2 E6 0F E0 B0 C6 DE C7 FE FF C1 ...2i........... 0030: B7 24 06 98 8C 42 5B 64 3A 7F FC 39 29 45 01 F3 .$...B[d:..9)E.. 0040: 8C 6C 0F D9 4E 17 63 4D C3 44 70 60 47 23 72 89 .l..N.cM.Dp`G#r. 0050: 92 15 7A 6B 87 E8 46 0C C5 8A A8 4E 28 2E BF 23 ..zk..F....N(..# 0060: CC 37 5A A8 77 A3 53 71 F7 4E 0D 0A 7C 74 11 C6 .7Z.w.Sq.N...t.. 0070: CC E4 97 64 CF 6F 39 67 FF EF C1 C9 95 43 CD 01 ...d.o9g.....C.. 0080: B8 29 56 87 FC 7A 8D 97 8D C8 F6 1D 1D A4 C3 73 .)V..z.........s 0090: 48 CB 1E CC 9A 32 14 31 AE 92 D3 0B 28 AA CF AF H....2.1....(... 00A0: 32 DE 3D AA 88 14 23 F4 3C 95 DF 66 59 6A AB B1 2.=...#.<..fYj.. 00B0: 16 FF 5F FB 0A EA 0A FD DD A2 17 94 4C 7C EC 34 ...........L..4 00C0: 16 B3 9D 55 DA 5B 76 18 9F 32 0D 5F 08 B2 92 98 ...U.[v..2..... 00D0: 5C 80 AF 31 7D 59 43 33 93 5D 26 BC 30 B7 2B 6D ..1.YC3.]&.0.+m 00E0: AE F8 A4 FE FF FA 00 55 5F DB A8 5B 8B 2B 29 3F .......U_..[.+)? 00F0: 20 A5 CE 4D 57 3E 9B 16 27 C4 8E 2F 70 CB C3 3F ..MW>..'../p..?

], [ [ Version: V3 Subject: CN=To Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

Key: Sun RSA public key, 2048 bits modulus: 25791830893490623935194823095027655022170115196763662994855537952333138156703157906943131298404761250956371501505530000663381260469332503567848296432223228494159655534891242240990341283871539882546362498965066811576988040963866672884863898979642226468151402477199491175039811269107851205553968354122690708455551391449785036002472164960243566113087796146670046372395290961119255416994093618640389231407933365976116378197830012098051781663158172633188487344924745961128399183865261792152320837638205289004595269891705144209953611352451725790009110244988866328188807749199681810585086726971124987950580787009181653121979 public exponent: 65537 Validity: [From: Tue Oct 10 13:43:44 CAT 2017, To: Wed Oct 10 13:43:44 CAT 2018] Issuer: CN=To SerialNumber: [ 6fb44289]

Certificate Extensions: 1 [1]: ObjectId: 2.5.29.19 Criticality=false BasicConstraints:[ CA:true PathLen:2147483647 ]

] Algorithm: [SHA256withRSA] Signature: 0000: 08 46 92 41 A0 56 1D 70 D6 69 F1 5D 10 BC 73 1A .F.A.V.p.i.]..s. 0010: D5 2A 78 5C 27 2F 7A 80 25 38 BE 27 65 EA 61 EB .x\'/z.%8.'e.a. 0020: BA F3 42 0B FC 0A 34 A5 EA 41 26 88 F1 2B 5F E6 ..B...4..A&..+_. 0030: 94 D5 CA 85 6E 4E 27 25 7D 36 E7 B7 44 80 E1 6D ....nN'%.6..D..m 0040: 8E 29 5C 91 BD DB 60 C3 88 6D 5C 4D AB 38 C6 B0 .).....m\M.8.. 0050: 85 DC 42 7C 6F D3 88 3D F7 F8 50 02 EB 8E 81 0D ..B.o..=..P..... 0060: 60 17 7F 97 66 17 B5 F3 3F F3 6E 6E C2 B9 53 4C...f...?.nn..SL 0070: 1A CE 18 A2 B7 AB 9D 74 A7 30 B3 1E FD B1 6B 7C .......t.0....k. 0080: F9 7C CF A9 E5 F9 A8 06 11 6B 05 8F A1 C0 F3 7F .........k...... 0090: 3F DB 8A F8 98 50 6B F8 5D B9 68 66 45 04 A7 58 ?....Pk.].hfE..X 00A0: 4B CD CF 9E 91 E6 2D AD AE 06 39 89 DC 53 74 69 K.....-...9..Sti 00B0: FE 84 3E E4 F9 EE C3 F5 9B 5D 2A B1 26 61 3C DC ..>......].&a<. 00C0: 7F EC 0F 69 06 54 E5 04 F9 8C 11 4C 1F 68 7E D1 ...i.T.....L.h.. 00D0: 30 06 E8 2E 0D 50 F1 3F DC A1 F6 85 2C E4 03 E6 0....P.?....,... 00E0: BF C7 0B F1 95 D6 05 B5 ED 5E 93 5B BB F1 C9 C0 .........^.[.... 00F0: 2A AE 3A 41 F1 0A E1 5F 3A 59 60 53 5E E6 62 CF *.:A..._:Y`S^.b.

]]

$\endgroup$

closed as off-topic by tylo, e-sushi Oct 10 '17 at 17:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead." – tylo, e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

0
$\begingroup$

So - first - very nice job posting runnable code :)

Second - you should see your exception:

} catch (Exception e) {
     System.out.println("Unable To generata certificate");
     e.printStackTrace(System.out);
}

you will get

Unable To generata certificate
java.io.IOException: Incorrect AVA format
at sun.security.x509.AVA.readChar(AVA.java:555)

and when I see what attributes you're trying to set:

private static String SubjectDetails( String CN, String OU, String DP, String PS ,String CTY,  String countryCode){ 
  return "CN :"+CN + " OU :" +OU + " DP :"+PS +" PS :" +PS +" CTY : "+ CTY + " CC : "+countryCode;
}

please see what attributes can be use for valid subject https://stackoverflow.com/questions/6464129/certificate-subject-x-509

the subject must be in format like:

CN=some name, OU=org unit, O=organization, C=HU

And the last

you can set the subject the same way as you've set the issuer

info.set(X509CertInfo.ISSUER, (X500Name) issuer);
info.set(X509CertInfo.SUBJECT, new X500Name("CN=TEST"));
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.