如何解决Java验证证书与颁发者证书
假设我有一个根 CA -> 中间 CA -> 叶证书。我需要通过下面的代码狙击来验证叶子证书:
/**
* Attempts to build a certification chain for given certificate and to
* verify it. Relies on a set of root CA certificates (trust anchors) and a
* set of intermediate certificates (to be used as part of the chain).
*
* @param cert - certificate for validation
* @param trustAnchors - set of trust anchors
* @param intermediateCerts - set of intermediate certificates
* @param signDate the date when the signing took place
* @return the certification chain (if verification is successful)
* @throws GeneralSecurityException - if the verification is not successful
* (e.g. certification path cannot be built or some certificate in the chain
* is expired)
*/
private static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert,Set<TrustAnchor> trustAnchors,Set<X509Certificate> intermediateCerts,Date signDate) throws GeneralSecurityException {
X509CertSelector selector = new X509CertSelector();
selector.setCertificate(cert);
PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustAnchors,selector);
// Disable CRL checks (this is done manually as additional step)
pkixParams.setRevocationEnabled(false);
pkixParams.setPolicyQualifiersRejected(false);
pkixParams.setDate(signDate);
// Specify a list of intermediate certificates
CertStore intermediateCertStore = CertStore.getInstance("Collection",new CollectionCertStoreParameters(intermediateCerts));
pkixParams.addCertStore(intermediateCertStore);
// Build and verify the certification chain
CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
return (PKIXCertPathBuilderResult) builder.build(pkixParams);
}
我可以理解参数 trustAnchors 是我的根 CA,参数中间证书是我的中间 CA。但是由于某些原因,根 CA 是私有的(我的客户将其私下保存)并且不能作为 trustAnchors(意味着 trustAnchors 为空/空)传递在这里 => 发生异常。可以通过将中间 CA 作为 trustAnchors 传递(现在中间证书将为空)来修复它,我可以获得结果。但我不知道这种方式是否正确。有人能帮我解决这个问题吗?
解决方法
正如@Robert 所说,我通过“然后使用中间 CA 作为根 CA(trustAnchors)来解决。然后证书验证在中间证书处停止”。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。