Google Cloud HSM 的 X509 證書

Question

我想為存儲在 Google Cloud HSM 中的私鑰生成 X509 證書。

使用 Java Key 工具和本地 Java“密鑰庫”我會做這樣的事情：

keytool -exportcert -alias sign1 -keystore signkeystore -storetype jks -storepass password -file sign1.certificate

見http://tutorials.jenkov.com/java-cryptography/keytool.html

使用 OpenSSL 我會做這樣的事情：

openssl genrsa -out private.key 1024

openssl req -new -x509 -key private.key -out publickey.cer -days 365

openssl pkcs12 -export -out public_privatekey.pfx -inkey private.key -in publickey.cer

參見X.509：私鑰/公鑰

看起來，生成證書需要訪問“私鑰” ，以某種方式直接像 OpenSSL 或間接像使用私鑰庫的keytool 。

Gcloud 文檔似乎使用 OpenSSL 來生成私鑰。 https://cloud.google.com/load-balancing/docs/ssl-certificates

如何在 Google Cloud HSM 中獲取私鑰的 X509 證書。 以前有人這樣做過嗎？

問候蘇查

Answer 1

我看過這個線程在沒有 BouncyCastle 的情況下在 Java 中創建 X509 證書？ .

然后我做了以下兩個創建GCloud X509證書

1. 在 GCloud HSM 中創建密鑰（請參閱https://cloud.google.com/kms/docs/hsm ）
2. 從 GCloud 下載公鑰。
3. 使用以下代碼創建 X509 證書。
4. 運行一些單元測試。

    /**
     * Create a self-signed X.509 based on a public key
     * @param googlePublicKey the Public key downloaded from Google Cloud HSM
     * @param dn        the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
     * @param days      how many days from now the Example is valid for
     * @param algorithm the signing algorithm, eg "SHA1withRSA"
     */
    public static X509Certificate generateRSACertificate(String googlePublicKey, String dn, int days, String algorithm)
            throws GeneralSecurityException, IOException {
        byte[] derKey = Base64.decodeBase64(googlePublicKey);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(derKey);
        PublicKey rsaKey = KeyFactory.getInstance("RSA").generatePublic(keySpec);
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        KeyPair keyPair = keyPairGenerator.generateKeyPair();
        PrivateKey privkey = keyPair.getPrivate();
        X509CertInfo info = new X509CertInfo();
        Date from = new Date();
        Date to = new Date(from.getTime() + days * 86400000l);
        CertificateValidity interval = new CertificateValidity(from, to);
        BigInteger sn = new BigInteger(64, new SecureRandom());
        X500Name owner = new X500Name(dn);

        info.set(X509CertInfo.VALIDITY, interval);
        info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn));
        info.set(X509CertInfo.SUBJECT, owner);
        info.set(X509CertInfo.ISSUER, owner);
        info.set(X509CertInfo.KEY, new CertificateX509Key(rsaKey));
        info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));
        AlgorithmId algo = new AlgorithmId(AlgorithmId.md5WithRSAEncryption_oid);
        info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo));

        // Sign the cert to identify the algorithm that's used.
        X509CertImpl cert = new X509CertImpl(info);
        cert.sign(privkey, algorithm);

        // Update the algorith, and resign.
        algo = (AlgorithmId) cert.get(X509CertImpl.SIG_ALG);
        info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo);
        cert = new X509CertImpl(info);
        cert.sign(privkey, algorithm);
        return cert;
    }

使用的進口是

import org.apache.commons.codec.binary.Base64;
import sun.security.x509.*;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.*;
import java.security.spec.X509EncodedKeySpec;
import java.util.Collection;
import java.util.Date;