Java BC1.47：需要从 CMSSignedData 对象中提取签名者的 X509CertificateObject答案

【问题标题】：Java BC1.47: Need to extract signer's X509CertificateObject from a CMSSignedData objectJava BC1.47：需要从 CMSSignedData 对象中提取签名者的 X509CertificateObject
【发布时间】：2012-11-28 12:03:50
【问题描述】：

我正在尝试使用 java Bouncy Castle 1.47 从 CMSSignedData 对象中提取签名者的 X509CertificateObject。到目前为止，我只能提取一个 org.bouncycastle.asn1.x509.Certificate 对象。如何从中获得 X509CertificateObject？非常感谢！

public static X509CertificateObject extractSignersCert(CMSSignedData cmsSignedData)
    throws Exception
{
    SignerInformationStore signerInfoStore;
    SignerInformation signerInfo;
    Store certStore;
    Collection certCollection;
    X509CertificateHolder x509CertHolder;
    X509Certificate cert;
    X509CertificateObject certObj;
    JcaX509CertificateConverter certConverter;

    signerInfoStore = cmsSignedData.getSignerInfos();
    signerInfo = (SignerInformation) signerInfoStore.getSigners().iterator().next();

    certStore = cmsSignedData.getCertificates();
    certCollection = certStore.getMatches(signerInfo.getSID());
    x509CertHolder = (X509CertificateHolder) certCollection.iterator().next();

    certConverter = new JcaX509CertificateConverter();
    certConverter.setProvider("BC");

    cert = certConverter.getCertificate(x509CertHolder);
    certObj = (X509CertificateObject) cert;

    return certObj;
}

【问题讨论】：

试试X509CertificateObject class's constructor 它应该接受一个X509CertificateStructure 对象（根据您的代码示例），您的cert 变量会保留。
这也是我最初的想法。不幸的是，这实际上似乎是不可行的。更改了演示代码。查看类关系，您会发现 cert 不是，或者至少不再是 X509CertificateStructure 的子类。
我检查了this Bouncy Castle Maven artifact 附加的sources.jar 和javadoc.jar。对我来说，似乎定义了构造函数。我还没有运行您的代码，但可以检查并发布您使用的 exact Bouncy Castle 版本吗？
我正在使用来自bouncycastle.org/latest_releases.html 的最新BC Jars，即bcprov-jdk15on-147.jar，我的JDK 是1.7
Class X509CertificateObject 在 BC 1.47 中定义了一个构造函数 X509CertificateObject(X509CertificateStructure c)。（不幸的是）org.bouncycastle.asn1.x509.Certificate 只有 org.bouncycastle.asn1.ASN1Object 作为与 X509CertificateStructure 的共同祖先

标签： java x509certificate bouncycastle pkcs#7

【解决方案1】：

终于找到了基于这个post的解决方案。诀窍是使用 JcaX509CertificateConverter() 并使用您可以从 CMSSignedData 轻松获得的 X509CertificateHolder 来提供它。工作得很好。

【讨论】：

【解决方案2】：

你可以使用这个方法。

/**
 * Get all x509 certificates from p7s File(.p7s or .p7b) Base64 format
 * @param p7sFileName
 * @return list of x509 certificates
 */
public static ArrayList<X509Certificate> getCertificates(final String p7sFileName){

    final ArrayList<X509Certificate> certListResult = new ArrayList<X509Certificate>();

    try {

        BufferedReader br = new BufferedReader(new FileReader(p7sFileName));
        StringBuilder str = new StringBuilder();
        br.readLine();
        while(br.ready()){

            String s = br.readLine();
            if(s.startsWith("-----END PKCS7-----"))
                break;
            else str.append(s);

        }

        byte[] data = Base64.decode(str.toString().getBytes());

        CMSSignedData s = new CMSSignedData(data);
        Store   certStore = s.getCertificates();

        JcaX509CertificateConverter converter = new JcaX509CertificateConverter();

        @SuppressWarnings("unchecked")
        ArrayList<X509CertificateHolder> certificateHolders = (ArrayList<X509CertificateHolder>)certStore.getMatches(null); 

        for(X509CertificateHolder holder: certificateHolders){

                X509Certificate cert = converter.getCertificate(holder);
                certListResult.add(cert);

            }

    } catch (FileNotFoundException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (CMSException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (IOException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (CertificateException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

    return certListResult;

}

【讨论】：