使用KeyStore将椭圆曲线证书和私钥导入JavaKeystorejava.security.

Question

我目前正在从事一个项目，涉及从Vault获取PEM或DER格式的椭圆曲线证书/私钥包，并需要将其导入Java密钥库。我可以找到大量关于使用keytools执行此操作的信息，但无法找到有关如何成功将DER编码字符串转换为Private ateKeyEntry以将其插入密钥库的信息。

下面是我的非工作代码certificate、key和issuingCa都是PEM或DER编码的字符串（我可以指定我想从颁发者那里获得的格式，并传递我可以使用的格式）

private KeyStore packKeystore(String certificate, String key, String issuingCa, String name) throws KeyStoreException, CertificateException, NoSuchAlgorithmException, IOException {
    // Create the keystore 
    KeyStore retVal = KeyStore.getInstance(KeyStore.getDefaultType());
    retVal.load(null, sslKeystorePassword.toCharArray());
    var cf = CertificateFactory.getInstance("X.509", BouncyCastleProvider.PROVIDER_NAME);
    var cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(certificate.getBytes()));
    retVal.setCertificateEntry(name, cert);
    Certificate issuer = null;
    if (issuingCa != null) {
      issuer = cf.generateCertificate(new ByteArrayInputStream(issuingCa.getBytes(StandardCharsets.UTF_8)));
    }
    if (key != null) {
      var certs = new HashSet<Certificate>();
      certs.add(issuer);
      certs.add(cert);
      PrivateKeyEntry pk = /// How do I create this from what I have???? 
     
      retVal.setKeyEntry( pk, certs.toArray());
    }

    return retVal;
  }

经过一些实验和研究，我了解到Private ateKey类不喜欢私钥看起来像----BEGIN EC PRIVATE KEY-----的“旧”PEM格式。

我最终能够从这样的密钥对解析PrivateKey对象：

   var parsedKey = new org.bouncycastle.openssl.PEMParser(new StringReader(key)).readObject();
      var pair = new org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter().getKeyPair((org.bouncycastle.openssl.PEMKeyPair) parsedKey);
      retVal.setKeyEntry(name, pair.getPrivate(), "".toCharArray(), certArray);

从那里我得到了一个关于证书算法与私钥算法不匹配的setKeyEntry错误。经检查，证书对象似乎表示algo为EC，PK对象表示algo为ECDSA。




Answer 1

我最终以这种方式解决了它。请注意，密钥必须是base64编码的DER格式：

 private PrivateKey convertECPrivateKeyString(String key) {
   ...
    byte[] keyBytes = null;
    if (key != null) {
      keyBytes = Base64.getDecoder().decode(key);
    }
    try (var asnStream = new ASN1InputStream(keyBytes)) {
      var primitive = asnStream.readObject();
      asnStream.close();

      if (primitive instanceof ASN1Sequence) {
        var sequence = (ASN1Sequence) primitive;
        var pKey = org.bouncycastle.asn1.sec.ECPrivateKey.getInstance(sequence);
        var pkInfo = new PrivateKeyInfo(new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, pKey.getParameters()), pKey);
        return new JcaPEMKeyConverter().getPrivateKey(pkInfo);
      }
    } 
...
  }