如何在Java 11中不使用BouncyCastle生成X.509证书？

你可以使用Java 11自带的sun.security.x509.X509v3CertificateBuilder（属于Sun/Oracle内部API，虽未公开但Java 11仍可正常使用）替代BouncyCastle的X509V3CertificateGenerator，以下是等价的实现代码：

import java.math.BigInteger;
import java.security.*;
import java.security.cert.X509Certificate;
import java.util.Date;
import javax.security.auth.x500.X500Principal;
import sun.security.x509.X509v3CertificateBuilder;
import sun.security.x509.X500Name;
import sun.security.x509.SubjectPublicKeyInfo;
import sun.security.x509.X509CertImpl;

public class NativeX509CertificateGenerator {

    public static void main(String[] args) {
        try {
            // 生成2048位RSA密钥对
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
            keyPairGenerator.initialize(2048);
            KeyPair keyPair = keyPairGenerator.generateKeyPair();

            // 生成自签名X.509证书
            X509Certificate certificate = generateSelfSignedCertificate(keyPair);

            // 打印证书详情
            System.out.println(certificate.toString());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static X509Certificate generateSelfSignedCertificate(KeyPair keyPair) throws Exception {
        // 定义证书核心参数
        X500Principal subjectDN = new X500Principal("CN=Test Certificate");
        X500Name issuerName = new X500Name(subjectDN.getName());
        BigInteger serialNumber = BigInteger.valueOf(System.currentTimeMillis());
        Date notBefore = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
        Date notAfter = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);
        SubjectPublicKeyInfo subjectPublicKeyInfo = new SubjectPublicKeyInfo(keyPair.getPublic());

        // 初始化证书构建器
        X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(
                issuerName,
                serialNumber,
                notBefore,
                notAfter,
                subjectDN,
                subjectPublicKeyInfo
        );

        // 使用私钥签名生成证书，指定SHA256WithRSA签名算法
        X509CertImpl certImpl = certBuilder.build(
                Signature.getInstance("SHA256WithRSAEncryption"),
                keyPair.getPrivate()
        );

        return certImpl;
    }
}

关键说明 #

• 该方案完全基于Java 11自带API，无需引入任何第三方依赖
• sun.security.x509下的类属于内部API，未来Java版本可能移除，但Java 11中可稳定运行
• 实现逻辑与原BouncyCastle示例完全对齐：自签名证书、2048位RSA密钥、有效期1年、SHA256WithRSA签名算法

可选替代方案：CertificateFactory（更规范但实现复杂） #

如果不想依赖内部API，也可以通过CertificateFactory手动构造证书的ASN.1结构，但步骤繁琐且容易出错，一般优先推荐上述X509v3CertificateBuilder的实现方式。

内容的提问来源于stack exchange，提问作者Dhruva Mahajan