证书与 PKI#

import java.security.cert.X509Certificate;
import java.security.cert.CertificateFactory;
import java.util.Base64;
import java.io.FileInputStream;

public class CertificateStructure {
    
    public static void parseCertificate(String certPath) throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");
        
        try (FileInputStream fis = new FileInputStream(certPath)) {
            X509Certificate cert = (X509Certificate) factory.generateCertificate(fis);
            
            System.out.println("=== X.509 证书结构 ===");
            
            // 1. 版本 (Version)
            System.out.println("版本: V" + cert.getVersion());
            // V1: 0, V2: 1, V3: 2
            
            // 2. 序列号 (Serial Number)
            System.out.println("序列号: " + cert.getSerialNumber());
            // CA 分配的唯一编号
            
            // 3. 签名算法 (Signature Algorithm)
            System.out.println("签名算法: " + cert.getSigAlgName());
            // SHA256withRSA, SHA384withECDSA
            
            // 4. 签发者 (Issuer)
            System.out.println("签发者: " + cert.getIssuerX500Principal().getName());
            // 如: C=US, O=Let's Encrypt, CN=R3
            
            // 5. 有效期 (Validity)
            System.out.println("生效时间: " + cert.getNotBefore());
            System.out.println("过期时间: " + cert.getNotAfter());
            
            // 6. 主题 (Subject)
            System.out.println("主题: " + cert.getSubjectX500Principal().getName());
            // 如: CN=example.com, O=Example Inc, C=US
            
            // 7. 公钥信息 (Subject Public Key Info)
            System.out.println("公钥算法: " + cert.getPublicKey().getAlgorithm());
            System.out.println("公钥格式: " + cert.getPublicKey().getFormat());
            
            // 8. 扩展 (Extensions)
            System.out.println("扩展数量: " + cert.getCriticalExtensionOIDs().size());
        }
    }
}

import java.security.cert.X509Certificate;
import java.util.Set;
import java.util.Collections;

public class CertificateExtensions {
    
    /**
     * 常用证书扩展
     */
    public static void analyzeExtensions(X509Certificate cert) throws Exception {
        
        // 1. 主题备用名称 (Subject Alternative Name)
        // 允许多个域名对应同一证书
        Set<String> sans = cert.getSubjectAlternativeNames()
            .stream()
            .map(entry -> entry.get(1).toString())
            .collect(java.util.stream.Collectors.toSet());
        System.out.println("SAN: " + sans);
        // 用途: example.com, www.example.com, api.example.com
        
        // 2. 密钥用途 (Key Usage)
        // 定义证书公钥的用途
        System.out.println("Key Usage: " + cert.getKeyUsage());
        // 如: digitalSignature, keyEncipherment
        
        // 3. 扩展密钥用途 (Extended Key Usage)
        // 更细粒度的用途定义
        System.out.println("Extended Key Usage: " + cert.getExtendedKeyUsage());
        // 如: serverAuth (TLS 服务器), clientAuth (TLS 客户端)
        
        // 4. 基本约束 (Basic Constraints)
        // 标识是否为 CA 证书
        // pathLenConstraint 限制 CA 链的深度
        int pathLen = cert.getBasicConstraints();
        System.out.println("CA: " + (pathLen >= 0) + ", 路径长度: " + pathLen);
        
        // 5. 证书策略 (Certificate Policies)
        // 标识证书的验证级别和策略
        System.out.println("Certificate Policies: " + cert.getCertificatePolicies());
    }
}

import java.security.*;
import java.security.cert.*;
import java.util.*;

public class CertificateChainValidation {
    
    /**
     * 完整证书链验证
     */
    public static PKIXCertPathBuilderResult validateChain(
            X509Certificate endEntityCert,
            X509Certificate[] chain,
            TrustAnchor[] trustAnchors) throws Exception {
        
        // 1. 创建 CertStore（包含中间证书）
        List<Certificate> certList = new ArrayList<>();
        for (X509Certificate cert : chain) {
            certList.add(cert);
        }
        CertStore certStore = CertStore.getInstance("Collection",
            new CollectionCertStoreParameters(certList));
        
        // 2. 配置 PKIX 路径验证器
        CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
        PKIXRevocationChecker revocationChecker = 
            (PKIXRevocationChecker) builder.getRevocationChecker();
        
        // 3. 设置吊销检查选项
        revocationChecker.setOptions(Set.of(
            PKIXRevocationChecker.Option.PREFER_CRLS,  // 优先 CRL
            PKIXRevocationChecker.Option.SOFT_FAIL      // 离线时软失败
        ));
        
        // 4. 构建验证参数
        PKIXBuilderParameters params = new PKIXBuilderParameters(
            Set.of(trustAnchors.toArray(new TrustAnchor[0])),
            new X509CertSelector());
        params.addCertPathChecker(revocationChecker);
        params.addCertStore(certStore);
        params.setDate(new Date());
        
        // 5. 设置策略
        params.setPolicyQualifiersRejected(false);
        params.setAnyPolicyInhibited(false);
        
        // 6. 验证路径
        return (PKIXCertPathBuilderResult) builder.build(params);
    }
    
    /**
     * 手动验证证书
     */
    public static ValidationResult manualValidation(
            X509Certificate cert,
            X509Certificate issuerCert) throws Exception {
        
        // 1. 检查时间有效性
        cert.checkValidity();
        
        // 2. 验证签名
        cert.verify(issuerCert.getPublicKey());
        
        // 3. 检查吊销状态
        RevocationStatus status = checkRevocation(cert);
        
        // 4. 验证基本约束
        if (cert.getBasicConstraints() == -1) {
            // 非 CA 证书不能签发其他证书
            System.out.println("警告: 非 CA 证书用于签发");
        }
        
        return new ValidationResult(cert, status);
    }
}

import java.security.cert.*;
import java.net.URL;
import java.util.*;

public class CrlValidation {
    
    /**
     * 下载并验证 CRL
     */
    public static Set<String> downloadCRL(String crlUrl) throws Exception {
        // 1. 下载 CRL
        URL url = new URL(crlUrl);
        try (java.security.cert.CertificateFactory cf = 
                CertificateFactory.getInstance("X.509")) {
            
            X509CRL crl = (X509CRL) cf.generateCRL(url.openStream());
            
            // 2. 验证 CRL 签名
            // 通常由签发该 CRL 的 CA 验证
            
            // 3. 提取吊销序列号
            Set<String> revokedSerials = new HashSet<>();
            for (X509CRLEntry entry : crl.getRevokedCertificateSamples()) {
                revokedSerials.add(entry.getSerialNumber().toString(16));
            }
            
            // 4. 检查 CRL 本身的有效期
            crl.checkValidity();
            
            return revokedSerials;
        }
    }
    
    /**
     * 检查证书是否被吊销
     */
    public static boolean isCertificateRevoked(
            X509Certificate cert,
            X509CRL crl) {
        
        X509CRLEntry entry = crl.getRevokedCertificate(cert.getSerialNumber());
        
        if (entry != null) {
            System.out.println("证书已吊销:");
            System.out.println("  序列号: " + entry.getSerialNumber());
            System.out.println("  吊销时间: " + entry.getRevocationDate());
            System.out.println("  原因: " + entry.getReasonCode());
            return true;
        }
        
        return false;
    }
}

import javax.net.ssl.*;
import java.security.cert.*;
import java.net.URL;
import java.io.*;

public class OcspStaplingConfig {
    
    /**
     * 在 Tomcat/Undertow 中启用 OCSP Stapling
     * 
     * 配置 SSLHostConfig:
     * <SSLHostConfig>
     *   <Certificate 
     *     certificateKeyFile="server.key"
     *     certificateFile="server.crt"
     *     certificateChainFile="chain.crt"
     *     type="RSA" />
     *   <OcspCacheSize>1000</OcspCacheSize>
     *   <OcspResponderURL>http://ocsp.example.com</OcspResponderURL>
     * </SSLHostConfig>
     */
    
    /**
     * 手动验证 OCSP Stapling 响应
     */
    public static byte[] getStapledOCSPResponse(SSLSession session) {
        for (Certificate cert : session.getPeerCertificates()) {
            if (cert instanceof X509Certificate) {
                // OCSP 响应附加在证书扩展中
                try {
                    byte[] ocspResponse = ((X509Certificate) cert)
                        .getExtensionValue("1.3.6.1.5.5.7.48.1.1")
                        .getEncoded();
                    return ocspResponse;
                } catch (Exception e) {
                    // 没有 stapled OCSP 响应
                }
            }
        }
        return null;
    }
}

import java.security.cert.*;
import java.util.*;

public class CertificateTransparency {
    
    /**
     * 检查证书是否有有效的 SCT
     */
    public static boolean hasValidSCT(X509Certificate cert) {
        try {
            // 尝试从 X.509 扩展获取 SCT
            byte[] sctExtension = cert.getExtensionValue("1.3.6.1.4.1.11129.2.4.2");
            if (sctExtension != null) {
                return true;
            }
            
            // SCT 也可以通过其他方式传输
            return false;
        } catch (Exception e) {
            return false;
        }
    }
    
    /**
     * 验证证书是否记录在 CT 日志中
     * 使用 Google 的 CT 公开 API
     */
    public static boolean isInCertificateTransparency(
            X509Certificate cert,
            List<String> acceptableLogs) throws Exception {
        
        String issuerName = cert.getIssuerX500Principal().getName();
        String subjectName = cert.getSubjectX500Principal().getName();
        String serialHex = cert.getSerialNumber().toString(16);
        
        // 使用 crt.sh 公开 API 查询
        String url = String.format(
            "https://crt.sh/?q=%s&output=json",
            URLEncoder.encode("DNSNAME=" + subjectName, "UTF-8")
        );
        
        // 实际实现需要解析 JSON 响应
        // 检查证书是否在已知日志中记录
        
        return true;
    }
}