我具有以下示例代码，这些代码是使用自签名证书生成签名的
public static String generateSignature(String data) throws Exception {
System.out.println("@@inside generateSignature: " + data);
String signature;
String jksFilepath = "E:\\test.jks";
try {
// Adding Security Provider for PKCS 12
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
// Setting password for the e-Token
// logging into token
ks = KeyStore.getInstance("jks");
FileInputStream fileInputStream = new FileInputStream(jksFilepath);
// Loading Keystore
// System.out.println("loading keystore");
ks.load(fileInputStream, JKSPassword);
Enumeration<String> e = ks.aliases();
while (e.hasMoreElements()) {
alias = e.nextElement();
// System.out.println("Alias of the e-Token : "+ alias);
UserCert = (X509Certificate) ks.getCertificate(alias);
UserCertPubKey = (PublicKey) ks.getCertificate(alias).getPublicKey();
// System.out.println("loading Private key");
UserCertPrivKey = (PrivateKey) ks.getKey(alias, JKSPassword);
}
// Method Call to generate Signature
signature = MakeSignature(data);
return signature;
} catch (Exception e) {
e.printStackTrace();
System.out.println("generateSignature" + e.getCause());
throw new Exception();
}
}
private static String MakeSignature(String data) {
System.out.println("@@inside MakeSignature...");
try {
PrivateKey privateKey = (PrivateKey) ks.getKey(alias, JKSPassword);
myPubCert = (X509Certificate) ks.getCertificate(alias);
Store certs = new JcaCertStore(Arrays.asList(myPubCert));
CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
generator.addSignerInfoGenerator(new JcaSimpleSignerInfoGeneratorBuilder().setProvider("BC").build("SHA256withRSA", privateKey, myPubCert));
generator.addCertificates(certs);
CMSTypedData data1 = new CMSProcessableByteArray(data.getBytes());
CMSSignedData signed = generator.generate(data1, true);
BASE64Encoder encoder = new BASE64Encoder();
String signedContent = encoder.encode((byte[]) signed.getSignedContent().getContent());
String envelopedData = encoder.encode(signed.getEncoded());
return envelopedData;
} catch (Exception e) {
e.printStackTrace();
System.out.println("MakeSignature ==" + e.getCause());
return "";
}
}
也有一些相关的功能，但是为了简短起见，我没有添加它。
现在，我想使用PHP进行完全相同的操作。
JKS 不能在PHP上用作Java的密钥库。
我尝试了使用不同的加密方法集的 open_ssl 函数。但是我没有得到与通过此Java代码获得的预期结果相同的预期结果（“不相同”是关于所生成签名的比特率和长度）。
请问有人可以帮助我在PHP中实现相同的签名生成吗？
答案 0 :(得分：5)
我认为PHP官方文档非常清楚：http://php.net/manual/en/function.openssl-csr-new.php
示例1创建自签名证书
<?php
$dn = array(
"countryName" => "GB",
"stateOrProvinceName" => "Somerset",
"localityName" => "Glastonbury",
"organizationName" => "The Brain Room Limited",
"organizationalUnitName" => "PHP Documentation Team",
"commonName" => "Wez Furlong",
"emailAddress" => "wez@example.com"
);
// Generate a new private (and public) key pair
$privkey = openssl_pkey_new(array(
"private_key_bits" => 2048,
"private_key_type" => OPENSSL_KEYTYPE_RSA,
));
// Generate a certificate signing request
$csr = openssl_csr_new($dn, $privkey, array('digest_alg' => 'sha256'));
// Generate a self-signed cert, valid for 365 days
$x509 = openssl_csr_sign($csr, null, $privkey, $days=365, array('digest_alg' => 'sha256'));
// Save your private key, CSR and self-signed cert for later use
openssl_csr_export($csr, $csrout) and var_dump($csrout);
openssl_x509_export($x509, $certout) and var_dump($certout);
openssl_pkey_export($privkey, $pkeyout, "mypassword") and var_dump($pkeyout);
// Show any errors that occurred here
while (($e = openssl_error_string()) !== false) {
echo $e . "\n";
}
然后您可以调用openssl_sign：http://php.net/manual/en/function.openssl-sign.php，使用生成的私钥进行签名。
如果要在PHP代码中使用Java（JKS）的密钥，则应首先导出密钥，然后使用PHP函数加载密钥。
答案 1 :(得分：2)
以下代码Java和PHP从PKCS12密钥库（keystore.pfx）获取私钥，并对data.txt文件的内容进行签名。使用相同的密钥库和数据，两个实现都返回完全相同的输出：
我仅使用普通Java（没有bouncycastle），因为java.security类可以很好地处理PKCS12输入：
public static void main(String[] args) throws Exception {
String keyStoreFile = "keystore.pfx";
char[] password = "password".toCharArray();
String dataFile = "data.txt";
PrivateKey priv = loadPrivateKey(keyStoreFile, password);
byte[] signature = signData(priv, dataFile);
System.out.println(Base64.getEncoder().encodeToString(signature));
}
private static byte[] signData(PrivateKey priv, String dataFile) throws Exception {
Signature dsa = Signature.getInstance("SHA256withRSA");
dsa.initSign(priv);
try (FileInputStream fis = new FileInputStream(dataFile);
BufferedInputStream bufin = new BufferedInputStream(fis);) {
byte[] buffer = new byte[1024];
int len;
while ((len = bufin.read(buffer)) >= 0) {
dsa.update(buffer, 0, len);
}
bufin.close();
byte[] realSig = dsa.sign();
return realSig;
}
}
private static PrivateKey loadPrivateKey(String keyStoreFile, char[] password) throws Exception {
try (FileInputStream fin = new FileInputStream(keyStoreFile)) {
KeyStore ks = KeyStore.getInstance("PKCS12", "SunJSSE");
ks.load(fin, password);
PrivateKey priv = (PrivateKey) ks.getKey("1", password);
return priv;
}
}
和PHP版本：
<?php
//data you want to sign
$data = file_get_contents("data.txt");
$cert_store = file_get_contents("keystore.pfx");
openssl_pkcs12_read($cert_store, $cert_info, "password");
//create signature
openssl_sign($data, $signature, $cert_info['pkey'], OPENSSL_ALGO_SHA256);
//finally encode
$r = base64_encode($signature);
print $r;
?>
我使用OpenSSL生成了PKCS12 keystore.pfx文件：
# generate new RSA private key
openssl genrsa -out private.pem 1024
# CSR and signed certificate are needed to export as PKCS12 store
openssl req -new -key private.pem -out certificate.csr
openssl x509 -req -days 365 -in certificate.csr -signkey private.pem -out certificate.crt
# export as PKCS12 keystore
openssl pkcs12 -export -out keystore.pfx -inkey private.pem -in certificate.crt -passout pass:password
您也可以使用OpenSSL签名data.txt：
openssl dgst -sha256 -sign private.pem < data.txt | openssl base64
所有版本都会输出相同的结果。
如果您有JKS密钥库，并且想使用存储在此密钥库中的私钥，则可以将JKS密钥库导出到PKCS12：
keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.pfx \
-srcstoretype JKS -deststoretype PKCS12 -deststorepass password \
-srcalias alias -destalias 1
还有一点要注意，因为这似乎总是很困惑：
您不使用证书签署数据。您使用（专用）密钥签名数据。证书或多或少就是用私钥签名的一条数据。使用您自己的私钥对自签名证书进行签名。由证书颁发机构（CA）颁发的证书是用CA的私钥签名的。
在上面的示例中，生成的证书签名请求（CSR）和证书基本上只被创建为将私钥导入到PKCS12密钥库中。您也可以将普通的private.pem密钥文件用于签名目的，但是当您使用PKCS12密钥库时，我也做了同样的事情。