如何将 PKCS12 格式转换为 PKCS8 keyvault？

Question

我从 keyvault 检索到了 PKCS12 格式的证书，但我希望将其私钥转换为 PKCS8，并且在 BouncyCastle 库中看不到任何选项，因为我只看到 PKCS8EncodedSpec 选项。将 PKCS12 转换为 PKCS8 的最佳方法或示例是什么？

Answer 1

嗨，萨姆，我假设您已经添加了城堡库，然后尝试一下这段代码

import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openssl.PEMKeyPair;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.security.KeyPair;
import java.security.PrivateKey;
import java.security.Security;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public class PKCS12toPKCS8Converter {

    public static void main(String[] args) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        // Replace 'pkcs12Data' with your actual PKCS12 data in byte array format
        byte[] pkcs12Data = /* Your PKCS12 data here */;

        // Replace 'password' with the password used to protect the PKCS12 file
        char[] password = "password".toCharArray();

        // Convert PKCS12 to PKCS8
        PrivateKey privateKey = convertPKCS12toPKCS8(pkcs12Data, password);

        // Now you have the private key in PKCS8 format, you can use it as needed
        System.out.println("Private key in PKCS8 format: " + privateKey);
    }

    private static PrivateKey convertPKCS12toPKCS8(byte[] pkcs12Data, char[] password) throws IOException {
        try (ByteArrayInputStream pkcs12Stream = new ByteArrayInputStream(pkcs12Data)) {
            // Load PKCS12 data
            KeyPair keyPair = loadKeyPairFromPKCS12(pkcs12Stream, password);

            // Convert to PKCS8 format
            return convertToPKCS8(keyPair.getPrivate());
        }
    }

    private static KeyPair loadKeyPairFromPKCS12(ByteArrayInputStream pkcs12Stream, char[] password) throws IOException {
        try {
            // Load PKCS12
            KeyStore keyStore = KeyStore.getInstance("PKCS12");
            keyStore.load(pkcs12Stream, password);

            // Assuming only one key entry in the PKCS12 file
            String alias = keyStore.aliases().nextElement();

            // Retrieve private key and certificate chain
            PrivateKey privateKey = (PrivateKey) keyStore.getKey(alias, password);
            Certificate[] chain = keyStore.getCertificateChain(alias);

            // Assuming the first certificate in the chain is the end-entity certificate
            X509Certificate endEntityCert = (X509Certificate) chain[0];

            // Return as KeyPair
            return new KeyPair(endEntityCert.getPublicKey(), privateKey);
        } catch (Exception e) {
            throw new IOException("Error loading KeyPair from PKCS12", e);
        }
    }

    private static PrivateKey convertToPKCS8(PrivateKey privateKey) throws IOException {
        try {
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
            PEMKeyPair pemKeyPair = new PEMKeyPair(privateKey, null);

            // Convert to PKCS8 format
            return converter.getKeyPair(pemKeyPair).getPrivate();
        } catch (Exception e) {
            throw new IOException("Error converting private key to PKCS8", e);
        }
    }
}

这里的convertPKCS12toPKCS8方法获取PKCS12数据并传递，从PKCS12文件加载私钥，然后使用BouncyCastle将其转换为PKCS8格式。