针对Java的RSA密钥转换 - 需要澄清吗？

Question

我读了一些关于将密钥从PEM转换为DER的已知问题,以便Java可以读取它们,我跑了这篇文章.当跟进时,这工作正常 - 生成的RSA密钥对openssl,密钥加载正常,用公钥加密的内容用私钥成功解码.

现在,这是不清楚的部分.
不久前,我使用Easy-RSA实用程序生成PKI,同时设置OpenVPN服务器.在这里,创建了一个自签名证书.输出文件包括:

server.csr ------ //证书请求
server.key ------ //私钥
server.crt ------- //自签名证书/公钥/无论这是什么..？

Just for the reference, easy-RSA is documented (on the bottom of the page are the scripts explained, and we can see openssl commands actually used in the process).

So, I tried the above logic on these files, using server.key as my private key file, and server.crt as my public key file, both previously transformed to Java-readable DER format:

openssl pkcs8 -topk8 -inform PEM -outform DER -in server.key -out server_private_key.der -nocrypt openssl x509 -inform PEM -outform DER -text -in server.crt -out server.der

私钥,不是那么奇怪,工作正常,即它已成功加载到Java中.
公钥(再次,可能不是那么奇怪)不会加载,但我不知道原因,因为我并不熟悉所有这些东西.我的猜测是,这与签署的证书有关,我想知道在这些情况下如何处理这个问题.我得到以下异常:

java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException:IOException: ObjectIdentifier() -- data isn't an object ID (tag = -96)
  at sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:188)
  at java.security.KeyFactory.generatePublic(KeyFactory.java:304)
  at aes.utils.KeyReaderUtil.getPublicKeyFromFile(KeyReaderUtil.java:57)
  at aes.utils.Main.main(Main.java:69)
Caused by: java.security.InvalidKeyException: IOException: ObjectIdentifier() -- data
isn't an object ID (tag = -96)
  at sun.security.x509.X509Key.decode(X509Key.java:380)
  at sun.security.x509.X509Key.decode(X509Key.java:386)
  at sun.security.rsa.RSAPublicKeyImpl.<init>(RSAPublicKeyImpl.java:66)
  at sun.security.rsa.RSAKeyFactory.generatePublic(RSAKeyFactory.java:281)
  at sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:184)
  ... 3 more

此外,当我从现有server.key私钥文件"导出" 公钥时,如下所示(如上文所述):

openssl rsa -in server.key -pubout -outform DER -out server_public_key.der

一切正常.

所以,我的问题是:什么是正确的方法,为什么server.crt不加载公钥？

Answer 1

您链接的文章中的Java代码需要一个公钥文件,而不是X509证书,这是您在server.crt中所拥有的.

X509证书包含公钥以及通过签名绑定到该密钥的身份信息.

从Java的X509Certificate文档中,您可以找到以下代码:

 InputStream inStream = null;
 try {
     inStream = new FileInputStream("fileName-of-cert");
     CertificateFactory cf = CertificateFactory.getInstance("X.509");
     X509Certificate cert = (X509Certificate)cf.generateCertificate(inStream);
 } finally {
     if (inStream != null) {
         inStream.close();
     }
 }

一旦你有了一个X509证书对象,就可以像这样轻松获取PublicKey:

PublicKey myPubKey = cert.getPublicKey();