如何正确签署CMP请求消息?(Java，有弹性城堡)

Question

我尝试通过证书授权(CMP服务器(上的CMP(证书管理协议(撤销证书，并获取错误代码"无效的签名密钥代码"。我认为这是因为我签署CMP消息的方式，那里出现了问题。

i使用org.bouncycastle.asn1.cmp.pkiheaderbuilder和org.bouncycastle.asn1.crmf.certtemplatebuilder：

CertTemplateBuilder builderCer = new CertTemplateBuilder();
// cert to revoke
builderCer.setIssuer(issuer);            
builderCer.setSerialNumber(serial);
//body
ArrayList revDetailsList = new ArrayList();
revDetailsList.add(new RevDetails(builderCer.build()));
RevReqContent revReqContent = new RevReqContent((RevDetails[]) revDetailsList.toArray(new RevDetails[revDetailsList.size()]));
PKIBody body = new PKIBody(PKIBody.TYPE_REVOCATION_REQ, revReqContent); 
// header
X509Name recipient  = new X509Name("CN=recipient");
X509Name sender = new X509Name("CN=sender");
int pvno = 1;
PKIHeaderBuilder builderHeader = new PKIHeaderBuilder(pvno, new GeneralName(sender), new GeneralName(recipient));
AlgorithmIdentifier algId = new AlgorithmIdentifier(new ASN1ObjectIdentifier("1.2.840.10045.4.1"));
builderHeader.setProtectionAlg(algId);
PKIHeader header = builderHeader.build();

然后，我必须签署整个消息，并且似乎有不同的方法。在Extracerts(cmpcertificate(中，我必须添加签名的公共密钥，该签名必须对此publickey进行验证。如何正确签署此消息的此消息？我尝试了org.bouncycastle.asn1.cmp.pkimessages和org.bouncycastle.cmp.cmp.protectedpkimessage。

pkimessages：

DERBitString signature = new DERBitString(createSignature("signature".getBytes())); 
X509Certificate signercert = convertToX509Cert(certPEM);
CMPCertificate cmpCert = new CMPCertificate(org.bouncycastle.asn1.x509.Certificate.getInstance(signercert.getEncoded()));
PKIMessage message = new PKIMessage(header, body, signature, new CMPCertificate[] { cmpCert });
// createsignature() 
private static byte[] createSignature(byte[] str){
Signature dsa = Signature.getInstance("SHA256WithRSA");
dsa.initSign(privateKey);
dsa.update(str, 0, str.length);
signature = dsa.sign();
return signature;

->来自CMP服务器的错误：" signature_invalid_key_code"

preectedpkimessage：

ContentSigner signer = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider(BouncyCastleProvider.PROVIDER_NAME).build((PrivateKey) ks.getKey(KEYSTORE_ALIAS, KEYSTORE_PWD.toCharArray()));
ProtectedPKIMessage message = new ProtectedPKIMessageBuilder(pvno, new GeneralName(sender), new GeneralName(recipient))
.addCMPCertificate(new X509CertificateHolder(ks.getCertificate(KEYSTORE_ALIAS).getEncoded()))
.setBody(body).build(signer);

->来自CMP服务器的错误：" error_reading_cms_object_code"

我的签名cmp请求消息的方式正确吗？pkimessage和"保护"参数和org.bouncycastle.cert.cmp.cmp.protectedpkimessage？

Answer 1

这是我用来签名CMP请求

的方式

GeneralName generalName = new GeneralName(subjectDN);
ProtectedPKIMessageBuilder pbuilder = new 
ProtectedPKIMessageBuilder(generalName,
                    protectedPKIMessage.getHeader().getSender());
            pbuilder.setBody(pkibody);
            ContentSigner msgsigner = new 
            JcaContentSignerBuilder(contentSignerBuilder)//
                   .setProvider("BC")//
                   .build(getKey().getPrivate());
           ProtectedPKIMessage message = pbuilder.build(msgsigner)

;

Answer 2

我还通过使用pkimessage(不保护Pkimessage(找到了另一个解决方案：

// ProtectedPart from bouncy castle
ProtectedPart protectedPart = new ProtectedPart(header, body);
Signature signature = Signature.getInstance("1.2.840.113549.1.1.11", "BC");
signature.initSign((PrivateKey) key);
signature.update(protectedPart.getEncoded());
byte[] sigBytes = signature.sign();
DERBitString signatureDER = new DERBitString(sigBytes);
PKIMessage message = new PKIMessage(header, body, signatureDER, new CMPCertificate[] { cmpCert });