CA 证书签发与管理#

import java.security.*;
import java.security.spec.*;
import java.time.*;
import java.util.*;

public class CertificateTemplateBuilder {
    
    /**
     * 服务器证书扩展配置
     */
    public static List<Extension> buildServerCertExtensions(
            String domain, List<String> alternativeNames) throws Exception {
        
        List<Extension> extensions = new ArrayList<>();
        
        // 1. 密钥用途
        extensions.add(new Extension(
            "2.5.29.15",
            true,  // critical
            encodeKeyUsage(
                KeyUsage.digitalSignature | 
                KeyUsage.keyEncipherment
            )
        ));
        
        // 2. 扩展密钥用途
        extensions.add(new Extension(
            "2.5.29.37",
            true,
            encodeExtendedKeyUsage(
                ExtendedKeyUsage.serverAuth,
                ExtendedKeyUsage.clientAuth
            )
        ));
        
        // 3. 备用名称
        extensions.add(new Extension(
            "2.5.29.17",
            false,  // not critical
            encodeSubjectAltName(domain, alternativeNames)
        ));
        
        // 4. 基本约束
        extensions.add(new Extension(
            "2.5.29.19",
            true,
            encodeBasicConstraints(false, -1)  // 不是 CA
        ));
        
        return extensions;
    }
    
    private static byte[] encodeKeyUsage(int usage) {
        // DER 编码的密钥用途
        return new byte[] {
            0x03, 0x02, 0x07, 
            (byte)((usage >> 24) & 0xFF),
            (byte)((usage >> 16) & 0xFF),
            (byte)((usage >> 8) & 0xFF),
            (byte)(usage & 0xFF)
        };
    }
}

@Service
@Slf4j
public class CertificateLifecycleManager {
    
    @Autowired
    private CertificateRepository certificateRepository;
    
    @Autowired
    private AlertService alertService;
    
    /**
     * 证书状态枚举
     */
    public enum CertificateStatus {
        ISSUED,        // 已签发
        ACTIVE,       // 激活使用中
        EXPIRING_SOON, // 即将过期（30 天内）
        EXPIRED,       // 已过期
        REVOKED,       // 已吊销
        RETIRED        // 已退役
    }
    
    /**
     * 证书签发
     */
    @Transactional
    public CertificateIssueResult issueCertificate(CertificateRequest request) {
        
        // 1. 验证请求
        validateRequest(request);
        
        // 2. 生成密钥对（使用 HSM 或 KMS）
        KeyPair keyPair = generateKeyPair(request.getKeyAlgorithm());
        
        // 3. 生成 CSR
        PKCS10CertificationRequest csr = generateCSR(keyPair, request);
        
        // 4. 验证 CSR
        verifyCSR(csr, request);
        
        // 5. 签发证书
        X509Certificate certificate = signCertificate(csr, request);
        
        // 6. 存储证书和私钥
        String encryptedPrivateKey = encryptPrivateKey(
            keyPair.getPrivate(), request.getEncryptionKey());
        
        Certificate cert = Certificate.builder()
            .serialNumber(certificate.getSerialNumber().toString())
            .subject(certificate.getSubjectX500Principal().getName())
            .issuer(certificate.getIssuerX500Principal().getName())
            .notBefore(certificate.getNotBefore().toInstant())
            .notAfter(certificate.getNotAfter().toInstant())
            .status(CertificateStatus.ACTIVE)
            .publicKey(certificate.getPublicKey().getEncoded())
            .encryptedPrivateKey(encryptedPrivateKey)
            .build();
        
        certificateRepository.save(cert);
        
        // 7. 安排过期检查任务
        scheduleExpirationCheck(cert);
        
        return new CertificateIssueResult(certificate, keyPair);
    }
    
    /**
     * 证书吊销
     */
    @Transactional
    public void revokeCertificate(String serialNumber, RevocationReason reason) {
        
        Certificate cert = certificateRepository.findBySerialNumber(serialNumber)
            .orElseThrow(() -> new CertificateNotFoundException(serialNumber));
        
        // 1. 更新状态
        cert.setStatus(CertificateStatus.REVOKED);
        cert.setRevocationDate(Instant.now());
        cert.setRevocationReason(reason);
        
        // 2. 生成新的 CRL
        generateCRL();
        
        // 3. 发送告警
        alertService.sendSecurityAlert(
            SecurityAlertType.CERTIFICATE_REVOKED,
            cert.getSubject(),
            reason.name()
        );
        
        // 4. 触发证书替换流程
        if (reason == RevocationReason.KEY_COMPROMISE) {
            notifyRelatedCertificates(cert);
        }
        
        certificateRepository.save(cert);
    }
    
    /**
     * 证书轮转
     */
    @Transactional
    public CertificateRotationResult rotateCertificate(String serialNumber) {
        
        Certificate oldCert = certificateRepository.findBySerialNumber(serialNumber)
            .orElseThrow(() -> new CertificateNotFoundException(serialNumber));
        
        // 1. 签发新证书
        CertificateRequest newRequest = CertificateRequest.builder()
            .subject(oldCert.getSubject())
            .domain(oldCert.getDomain())
            .validityDays(365)
            .keyAlgorithm(oldCert.getKeyAlgorithm())
            .build();
        
        CertificateIssueResult newCertResult = issueCertificate(newRequest);
        
        // 2. 部署新证书
        deployCertificate(newCertResult.getCertificate(), oldCert.getServiceId());
        
        // 3. 保留旧证书（用于回滚）
        oldCert.setStatus(CertificateStatus.RETIRED);
        oldCert.setReplacementSerialNumber(
            newCertResult.getCertificate().getSerialNumber().toString());
        oldCert.setRetirementDate(Instant.now());
        
        // 4. 启动观察期
        startObservationPeriod(oldCert, newCertResult.getCertificate());
        
        return new CertificateRotationResult(oldCert, newCertResult.getCertificate());
    }
}

import org.shredzone.acme4j.*;
import org.shredzone.acme4j.enums.*;
import org.shredzone.acme4j.util.*;
import java.security.*;

public class AcmeCertificateClient {
    
    private static final String ACME_SERVER = "https://acme-v02.api.letsencrypt.org/directory";
    
    /**
     * 创建 ACME 账户
     */
    public Session createAccount(String email) throws Exception {
        // 创建账户密钥对
        KeyPair accountKeyPair = generateKeyPair("EC", "secp256r1");
        
        // 创建会话
        Session session = new Session(ACME_SERVER, accountKeyPair);
        
        // 注册账户
        Account account = session.login(
            URI.create("mailto:" + email), 
            new AccountBuilder()
                .addEmail(email)
                .agreeToTermsOfService()
                .useKeyPair(accountKeyPair)
                .create(session)
        );
        
        return session;
    }
    
    /**
     * 申请证书（HTTP-01 验证）
     */
    public CertificateRequestResult requestCertificateHttp(
            Session session, 
            List<String> domains) throws Exception {
        
        // 1. 创建订单
        Order order = session.account()
            .newOrder()
            .domains(domains.toArray(new String[0]))
            .create();
        
        // 2. 获取授权
        for (Authorization auth : order.getAuthorizations()) {
            if (auth.getStatus() == Authorization.Status.PENDING) {
                Http01Authorization httpAuth = auth.http01();
                
                // 生成挑战 token 和 key authorization
                String token = httpAuth.getToken();
                String keyAuth = httpAuth.getKeyAuthorization();
                
                // 将 token 保存到 Web 服务器
                saveHttpChallenge(token, keyAuth);
                
                // 触发 ACME 服务器验证
                httpAuth.trigger();
                
                // 等待验证完成
                httpAuth.loopUntilValid();
                
                // 删除 challenge 文件
                deleteHttpChallenge(token);
            }
        }
        
        // 3. 生成证书密钥对
        KeyPair certKeyPair = generateKeyPair("EC", "secp256r1");
        
        // 4. 创建 CSR
        CSRBuilder csrb = new CSRBuilder();
        csrb.addDomain(domains.get(0));
        domains.subList(1, domains.size()).forEach(csrb::addDomain);
        csrb.sign(certKeyPair);
        
        // 5. 请求签发
        order.execute(csrb.getCSR());
        
        // 6. 下载证书
        Certificate cert = order.getCertificate();
        
        return new CertificateRequestResult(cert, certKeyPair);
    }
    
    /**
     * 申请证书（DNS-01 验证）
     */
    public CertificateRequestResult requestCertificateDns(
            Session session,
            List<String> domains) throws Exception {
        
        // 类似 HTTP 验证，但使用 DNS TXT 记录
        // DNS 验证的好处是可以申请通配符证书
        
        Order order = session.account()
            .newOrder()
            .domains(domains.toArray(new String[0]))
            .create();
        
        for (Authorization auth : order.getAuthorizations()) {
            if (auth.getStatus() == Authorization.Status.PENDING) {
                Dns01Authorization dnsAuth = auth.dns01();
                
                String token = dnsAuth.getToken();
                String keyAuth = dnsAuth.getKeyAuthorization();
                
                // 添加 DNS TXT 记录
                addDnsTxtRecord("_acme-challenge." + auth.getDomain(), keyAuth);
                
                dnsAuth.trigger();
                dnsAuth.loopUntilValid();
                
                removeDnsTxtRecord("_acme-challenge." + auth.getDomain());
            }
        }
        
        // 后续步骤同上...
        return null;
    }
}