从 .cer 证书导出证书链

Question

I have .cer certificate. When I'm opening it, it shows me certificate chain.

Using this code, I read the certificate to x509certificate file.

File certificateFile = new File("C:\\Users\\grish\\Desktop\\certificateForValidation.cer");
        InputStream inputStream = new FileInputStream(certificateFile);

        X509Certificate certificate = new X509CertImpl(inputStream);

I want to get certificate chain from that file ! (end-entity, CA, Root) How can I do that programmatically in java.

With C#, this is much more easy

X509Chain ch = new X509Chain();
ch.ChainPolicy.RevocationMode = X509RevocationMode.Online;
ch.Build (certificate);

And then I can get all certificates from ch.

Answer 1

First of all make sure you are using the java.security.cert package; see JDK 17 API doc for java.security.cert .

Avoid using javax.security.cert . The package is marked as deprecated an will be removed in future releases; see JDK 17 API doc for javax.security.cert .

The following code will return a collection of java.security.cert.X509Certificate objects. In the case of your example with the certificate of medium.com the list will contain three items; one for every certificate in the chain.

import java.io.FileInputStream;
import java.io.InputStream;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.List;

public static void main(String[] args) {
    try (InputStream inStream = new FileInputStream("C:\\Users\\grish\\Desktop\\Coding Space\\Certificates\\certificateForValidation.p7b")) {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        List<X509Certificate> certs = (List<X509Certificate>) cf.generateCertificates(inStream);
    } catch (Exception ex) {
        ex.printStackTrace();
    }
}

I tested it with a PEM formated chain but it should work with PCKS#7 (.p7b file extension) as well; see the documentation of the generateCertificates(InputStream inStream) method.

Find more information about x.509 encoding and conversion here