X509 扩展

Question

如何在 java 中使用 bouncycastle API 为 x509 证书设置扩展？

我设法做到了这样的“基本约束”：

...
X509V3CertificateGenerator gen = new X509V3CertificateGenerator();
...
boolean crit;
boolean isCa;
gen.addExtension(X509Extensions.BasicConstraints, crit, new BasicConstraints(isCa));

但是，我不知道如何为 IssuerAlternativeName 或 KeyUsage 做同样的事情。

Answer 1

试试这个

 KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign
        | KeyUsage.digitalSignature | KeyUsage.keyEncipherment
        | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
 gen.addExtension(Extension.keyUsage, false, usage);


 GeneralNames issuerAltName = new GeneralNames(new GeneralName(new X509Name("CN=somedomain.tld")));
    gen.addExtension(X509Extensions.IssuerAlternativeName, false, issuerAltName);