1
2
3
4
5 package gboat2.base.bridge.util.security;
6
7 import java.io.FileInputStream;
8 import java.io.FileNotFoundException;
9 import java.security.KeyStore;
10 import java.security.KeyStoreException;
11 import java.security.PrivateKey;
12 import java.security.PublicKey;
13 import java.security.cert.Certificate;
14 import java.security.cert.CertificateFactory;
15 import java.security.cert.X509Certificate;
16 import java.util.Date;
17
18 import org.apache.commons.io.IOUtils;
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125 public class CertificateUtil {
126 public static final String PKCS12 = "PKCS12";
127
128
129 public static final String KEY_STORE = "JKS";
130
131 public static final String X509 = "X.509";
132
133
134
135
136
137
138
139 public static KeyStore getKeyStore(String keyStorePath, String password) {
140 FileInputStream in = null;
141 try {
142 in = new FileInputStream(keyStorePath);
143 KeyStore keyStore = KeyStore.getInstance(KEY_STORE);
144 keyStore.load(in, password.toCharArray());
145 return keyStore;
146 } catch (FileNotFoundException e) {
147 throw new GboatSecurityException("密钥库文件 [" + keyStorePath + "] 不存在", e);
148 } catch (Exception e) {
149 throw new GboatSecurityException("加载密钥库失败：keyStorePath=" + keyStorePath + ", password=" + password, e);
150 } finally {
151 IOUtils.closeQuietly(in);
152 }
153 }
154
155
156
157
158
159
160
161
162 public static PrivateKey getPrivateKey(String keyStorePath, String alias, String password) {
163 KeyStore keyStore = getKeyStore(keyStorePath, password);
164 try {
165 return (PrivateKey) keyStore.getKey(alias, password.toCharArray());
166 } catch (Exception e) {
167 throw new GboatSecurityException("从密钥库中读取私钥信息失败：keyStorePath=" + keyStorePath + ", password=" + password + ", alias=" + alias, e);
168 }
169 }
170
171
172
173
174
175
176
177 public static PublicKey getPublicKey(String certificatePath) {
178 Certificate certificate = getCertificate(certificatePath);
179 return certificate.getPublicKey();
180 }
181
182
183
184
185
186
187
188 public static Certificate getCertificate(String certificatePath) {
189 FileInputStream in = null;
190 try {
191 CertificateFactory certificateFactory = CertificateFactory.getInstance(X509);
192 in = new FileInputStream(certificatePath);
193 return certificateFactory.generateCertificate(in);
194 } catch (FileNotFoundException e) {
195 throw new GboatSecurityException("证书文件 [" + certificatePath + "] 不存在", e);
196 } catch (Exception e) {
197 throw new GboatSecurityException("加载证书 [" + certificatePath + "] 失败", e);
198 } finally {
199 IOUtils.closeQuietly(in);
200 }
201 }
202
203
204
205
206
207
208
209
210
211 public static Certificate getCertificate(String keyStorePath, String alias, String password) {
212 KeyStore keyStore = getKeyStore(keyStorePath, password);
213 try {
214 return keyStore.getCertificate(alias);
215 } catch (KeyStoreException e) {
216 throw new GboatSecurityException("根据密钥库加载证书失败：keyStorePath=" + keyStorePath + ", password=" + password + ", alias=" + alias, e);
217 }
218 }
219
220
221
222
223
224
225
226 public static boolean verifyCertificate(String certificatePath) {
227 return verifyCertificate(certificatePath, new Date());
228 }
229
230
231
232
233
234
235
236
237 public static boolean verifyCertificate(String certificatePath, Date date) {
238 Certificate certificate = getCertificate(certificatePath);
239 if(!(certificate instanceof X509Certificate))
240 throw new GboatSecurityException("证书 [" + certificatePath + "] 的类型不是 X.509，暂不支持对其进行有效性校验。");
241
242 return verifyCertificate((X509Certificate)certificate, date);
243 }
244
245
246
247
248
249
250
251 public static boolean verifyCertificate(X509Certificate certificate) {
252 return verifyCertificate(certificate, new Date());
253 }
254
255
256
257
258
259
260
261
262 public static boolean verifyCertificate(X509Certificate certificate, Date date) {
263 try {
264 certificate.checkValidity(date);
265 return true;
266 } catch (Exception e) {
267 return false;
268 }
269 }
270
271
272
273
274
275
276
277
278
279 public static boolean verifyCertificate(String keyStorePath, String alias, String password) {
280 return verifyCertificate(new Date(), keyStorePath, alias, password);
281 }
282
283
284
285
286
287
288
289
290
291 public static boolean verifyCertificate(Date date, String keyStorePath, String alias, String password) {
292 Certificate certificate = getCertificate(keyStorePath, alias, password);
293 if(!(certificate instanceof X509Certificate))
294 throw new GboatSecurityException("密钥库对应 [" + keyStorePath + "] 的证书类型不是 X.509，暂不支持对其进行有效性校验。");
295
296 return verifyCertificate((X509Certificate)certificate, date);
297 }
298
299
300
301
302
303
304
305
306
307 public static String getSigAlgName(String keyStorePath, String alias, String password) {
308
309 Certificate certificate = getCertificate(keyStorePath, alias, password);
310 if(!(certificate instanceof X509Certificate))
311 throw new GboatSecurityException("密钥库对应 [" + keyStorePath + "] 的证书类型不是 X.509，无法读取该密钥库对应的签名算法。");
312
313 return ((X509Certificate) certificate).getSigAlgName();
314 }
315
316 }