未从 AndroidKeystore 获取证书链

Question

我正在尝试使用来自 https://developer.android.com/training/articles/security-key-attestation.html 的指南验证硬件支持的密钥。

在AndroidKeystore中正确生成了密钥（ECDSA），KeyInfo为模拟器提供了正确的信息：

Starting check for secure element
Generated an ECDSA key with 256 bits
Keyname: d512e563-92ea-4bfa-9e35-3043e5c55ae0
Key Imported?: Generated
Keysize: 256
UserAuth Required?: true
**In Secure HW?: false**
Finished check for secure element

当我尝试获取证书链时，我得到了这个：

  Found required key: d512e563-92ea-4bfa-9e35-3043e5c55ae0
    Number of certificates in chain: 1
    SubjectDN: CN=fake
    Serial Number: 1
    Issuer: CN=fake
    Valid from: Wed Dec 31 16:00:00 PST 1969
    Valid Until: Tue Dec 31 16:00:00 PST 2047

    -----BEGIN CERTIFICATE-----
    MIHFMIGxoAMCAQICAQEwCgYIKoZIzj0EAwIwDzENMAsGA1UEAxMEZmFrZTAeFw03
    MDAxMDEwMDAwMDBaFw00ODAxMDEwMDAwMDBaMA8xDTALBgNVBAMTBGZha2UwWTAT
    BgcqhkjOPQIBBggqhkjOPQMBBwNCAATZ/2iTrpOa35IAnhCiNU+UTfPukTMgvvdO
    gJyjQyDcu4+KjuJdesiqnw8bT1kmh4KO085Ri3ZFYKSloSU6GT1oMAoGCCqGSM49
    BAMCAwMAMAA=
    -----END CERTIFICATE-----

但是，对于具有安全元件的真实手机，我得到了这个：

Starting check for secure element
Generated an ECDSA key with 256 bits
Keyname: f416a3b1-a8a7-4aeb-b1d4-14a5cf459506
Key Imported?: Generated
Keysize: 256
UserAuth Required?: true
**In Secure HW?: true**
Finished check for secure element

当我尝试获取证书链时，我得到了这个：

Found required key: f416a3b1-a8a7-4aeb-b1d4-14a5cf459506
Number of certificates in chain: 1
SubjectDN: CN=fake
Serial Number: 1
Issuer: CN=fake
Valid from: Wed Dec 31 16:00:00 PST 1969
Valid Until: Tue Dec 31 16:00:00 PST 2047

-----BEGIN CERTIFICATE-----
MIHFMIGxoAMCAQICAQEwCgYIKoZIzj0EAwIwDzENMAsGA1UEAxMEZmFrZTAeFw03
MDAxMDEwMDAwMDBaFw00ODAxMDEwMDAwMDBaMA8xDTALBgNVBAMTBGZha2UwWTAT
BgcqhkjOPQIBBggqhkjOPQMBBwNCAAQAwtqkhgodfwFGEOyEKEJSP2u+hdpLlZ1B
OIGFUeiZ0dZOHLvg6D4ivJ/j7xe0AvNp+TdnOdTtx7zKSAnfxD6bMAoGCCqGSM49
BAMCAwMAMAA=
-----END CERTIFICATE-----

无论我使用什么模拟器或真手机设备，我似乎都无法获得实际的证书链。

github 上的证书链验证示例假设您已经正确获取了链并正在使用这些证书进行验证；但我没有看到任何关于正确获取链必须具有哪些代码的示例。这是我的代码中的内容：

try {
            keystore = KeyStore.getInstance(KEYSTORE_PROVIDER);
            keystore.load(null);
            Enumeration<String> keys = keystore.aliases();
            sb = new StringBuilder("Certificate chain of key in AndroidKeystore:\n\n");
            while (keys.hasMoreElements()) {
                String s = keys.nextElement();
                Log.i("info", "KeyAlias: " + s);
                KeyStore.Entry entry = keystore.getEntry(keyalias, null);
                if (entry != null) {
                    Log.i("info", "Found required key: " + keyalias);
                    certchain = ((KeyStore.PrivateKeyEntry) entry).getCertificateChain();
                    Log.i("info", "Number of certificates in chain: " + certchain.length);
                    return sb.append(getCertChain(certchain)).toString();
                }
            }
            Log.w("error", "Key not found: " + keyalias);
            sb.append(getResources().getString(R.string.key_not_found));
        } catch (KeyStoreException | NoSuchAlgorithmException | IOException | UnrecoverableEntryException | CertificateException e) {
            e.printStackTrace();
        }
        return sb.toString();

（请原谅格式错误）。

所有设备都运行 API 24 或更高版本。在尝试获取实际的证书链以进行证明时，我缺少什么？ TIA。

Answer 1

当您创建密钥对时，是否调用了 setAttestationChallenge()？如果没有，它只会生成您的自签名证书。