如何用Bouncy Castle的PEMParser读取解密私钥与X509证书？

提取X509证书 #

当你从pemParser.readObject()得到X509CertificateHolder后，可通过以下步骤转换为标准X509Certificate对象：

• 调用X509CertificateHolder.getEncoded()获取DER编码的字节流
• 使用JDK的CertificateFactory解析该字节流得到证书

示例代码：

import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.io.ByteArrayInputStream;
import org.bouncycastle.cert.X509CertificateHolder;

// 假设holder为已获取的X509CertificateHolder实例
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
X509Certificate x509Cert = (X509Certificate) certFactory.generateCertificate(
    new ByteArrayInputStream(holder.getEncoded())
);

解密加密私钥 #

如果读取到的是加密私钥（通常为PKCS8EncryptedPrivateKeyInfo类型），需用BouncyCastle的解密工具结合密码获取明文私钥：

1. 先确保已注册BouncyCastle安全提供者
2. 构建解密器并解密得到PrivateKeyInfo
3. 将PrivateKeyInfo转换为标准PrivateKey对象

示例代码：

import java.security.Security;
import java.security.PrivateKey;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openssl.PKCS8EncryptedPrivateKeyInfo;
import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
import org.bouncycastle.operator.InputDecryptorProvider;
import org.bouncycastle.pkcs.PrivateKeyInfo;

// 注册BouncyCastle提供者
Security.addProvider(new BouncyCastleProvider());

// 假设encryptedKeyInfo为已获取的PKCS8EncryptedPrivateKeyInfo实例
char[] password = "你的私钥密码".toCharArray();
JceOpenSSLPKCS8DecryptorProviderBuilder decryptorBuilder = new JceOpenSSLPKCS8DecryptorProviderBuilder();
decryptorBuilder.setProvider("BC");
InputDecryptorProvider decryptorProvider = decryptorBuilder.build(password);
PrivateKeyInfo privateKeyInfo = encryptedKeyInfo.decryptPrivateKeyInfo(decryptorProvider);

// 转换为标准PrivateKey
JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
PrivateKey privateKey = converter.getPrivateKey(privateKeyInfo);

注意：如果你的加密私钥是传统OpenSSL格式，可能会得到PEMEncryptedKeyPair实例，逻辑类似——用密码解密后从KeyPair中提取私钥即可。

内容的提问来源于stack exchange，提问作者VladimirCoder84