JDK11下SHA256withECDSA证书链验证报错及疑问

我在JDK 11环境下，尝试基于SHA256withECDSA算法验证证书链，调用CertPathValidator.getInstance("PKIX").validate方法时程序崩溃，抛出以下错误：

Unrecognized algorithm for signature parameters SHA256withECDSA

错误栈追踪 #

Caused by: java.security.cert.CertPathValidatorException: signature check failed 
at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135) 
at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:233) 
at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:141) 
at java.base/sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:80) 
at java.base/java.security.cert.CertPathValidator.validate(CertPathValidator.java:309) 
at net.corda.core.internal.InternalUtils.validate(InternalUtils.kt:469) 
... 64 more 
Caused by: java.security.cert.CertificateException: Unrecognized algorithm for signature parameters SHA256withECDSA 
at java.base/sun.security.x509.X509CertImpl.verify(X509CertImpl.java:445) 
at java.base/sun.security.provider.certpath.BasicChecker.verifySignature(BasicChecker.java:166) 
at java.base/sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:147) 
at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125) 
... 69 more

根因分析 #

问题出在SunEC Provider中不存在AlgorithmParameters服务对应SHA256withECDSA：

SunEC.getService("AlgorithmParameters", "SHA256withECDSA"); // 返回null

而我的X509证书实例（X509CertImpl）包含的AlgorithmId，其算法OID为1.2.840.10045.4.3.2（对应SHA256withECDSA），同时附带了参数OID1.2.840.10045.3.1.7（对应prime256v1曲线）。实际上对于SHA256withECDSA，prime256v1是默认且唯一受支持的参数，这个冗余的参数声明导致JDK无法识别，需要在代码中移除该参数。

解决方案：修改证书的AlgorithmId参数 #

我们可以通过解析证书，手动修改其签名算法的参数为null，然后重新生成证书对象，再进行验证。以下是具体实现步骤：

1. 将证书的PEM内容解析为X509Certificate对象
2. 将证书转换为X509CertImpl（使用JDK内部API实现）
3. 获取证书的AlgorithmId，修改其参数为null
4. 重新生成修改后的证书对象
5. 使用修改后的证书构建证书链进行验证

代码示例

import sun.security.x509.AlgorithmId;
import sun.security.x509.X509CertImpl;
import java.io.ByteArrayInputStream;
import java.security.KeyStore;
import java.security.cert.CertificateFactory;
import java.security.cert.CertPathValidator;
import java.security.cert.X509Certificate;
import java.util.Base64;
import java.util.Arrays;

public class FixEcdsaCertParams {

    public static X509Certificate removeSignatureParams(X509Certificate originalCert) throws Exception {
        // 将证书转换为X509CertImpl
        X509CertImpl certImpl = (X509CertImpl) originalCert;
        
        // 获取签名算法的AlgorithmId
        AlgorithmId sigAlgId = certImpl.getSigAlgId();
        
        // 创建一个新的AlgorithmId，参数设为null
        AlgorithmId newSigAlgId = new AlgorithmId(sigAlgId.getAlgorithm(), null);
        
        // 修改证书的签名算法ID
        certImpl.setSigAlgId(newSigAlgId);
        
        // 重新生成证书字节数组并转换为X509Certificate
        byte[] modifiedCertBytes = certImpl.getEncoded();
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        return (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(modifiedCertBytes));
    }

    // 使用示例：处理证书链中的每个证书
    public static void main(String[] args) throws Exception {
        // 加载原始证书链
        X509Certificate[] certChain = loadOriginalCertChain();
        
        // 修改每个证书的签名参数
        X509Certificate[] modifiedChain = new X509Certificate[certChain.length];
        for (int i = 0; i < certChain.length; i++) {
            modifiedChain[i] = removeSignatureParams(certChain[i]);
        }
        
        // 验证修改后的证书链
        validateCertPath(modifiedChain);
    }

    // 辅助方法：加载原始证书链（从PEM字符串）
    private static X509Certificate[] loadOriginalCertChain() throws Exception {
        String[] pemCerts = {
            "-----BEGIN CERTIFICATE----- MIICDjCCAaugAwIBAgIIL8JlejRD9+AwFAYIKoZIzj0EAwIGCCqGSM49AwEHMDcx CzAJBgNVBAYTAkNIMQ8wDQYDVQQHDAZadXJpY2gxFzAVBgNVBAoMDk5vdGFyeSBT ZXJ2aWNlMB4XDTE5MDUxODAwMDAwMFoXDTI3MDUyMDAwMDAwMFowNzELMAkGA1UE BhMCQ0gxDzANBgNVBAcMBlp1cmljaDEXMBUGA1UECgwOTm90YXJ5IFNlcnZpY2Uw WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATQ5/8MzkZLIrlCmJwW36VFYN8qs/Qh O4VVdsU54u/NvXr4ZHdvuhUshPusxger2tmTQ1G74JeHasiYuXRK7w5+o4GWMIGT MB0GA1UdDgQWBBQU0zTXsjkN2A97z/YWgIat6XynDDAMBgNVHRMBAf8EAjAAMAsG A1UdDwQEAwIDqDAjBgNVHSUEHDAaBggrBgEFBQcDAQYIKwYBBQUHAwIGBFUdJQAw HwYDVR0jBBgwFoAU93fYF/b7cP07vc/w+joyfiG/AR0wEQYKKwYBBAGDimIBAQQD AgEFMBQGCCqGSM49BAMCBggqhkjOPQMBBwNHADBEAiBwb2uZZjD8qAoxHOxpbajB RQ6LCIjkbUN2f8my0X00lAIge/qClByuVWeAkibOLM0rxs9tdpU8JMBKlFCQltXj iBM= -----END CERTIFICATE-----",
            "-----BEGIN CERTIFICATE----- MIICjTCCAimgAwIBAgIIfN0wQLUbHR8wFAYIKoZIzj0EAwIGCCqGSM49AwEHMGMx CzAJBgNVBAYTAlVTMREwDwYDVQQHEwhOZXcgWW9yazEOMAwGA1UECxMFQ29yZGEx FjAUBgNVBAoTDVIzIEhvbGRDbyBMTEMxGTAXBgNVBAMTEENvcmRhIERvb3JtYW4g Q0EwHhcNMTkwNTE4MDAwMDAwWhcNMjcwNTIwMDAwMDAwWjA3MQswCQYDVQQGEwJD SDEPMA0GA1UEBwwGWnVyaWNoMRcwFQYDVQQKDA5Ob3RhcnkgU2VydmljZTBZMBMG ByqGSM49AgEGCCqGSM49AwEHA0IABNrSB6SrX1F//yNl58QWH14ittAcPs0KIcGg 2KFzF6Y1aHzHdZPvE9M1ErJW3A/ElrfXBtYeVqUch9155ZvL0gyjgegwgeUwHQYD VR0OBBYEFPd32Bf2+3D9O73P8Po6Mn4hvwEdMA8GA1UdEwEB/wQFMAMBAf8wCwYD VR0PBAQDAgGGMCMGA1UdJQQcMBoGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lADAf BgNVHSMEGDAWgBTr7i4wFSlArhmYHthv431/B6LCEzARBgorBgEEAYOKYgEBBAMC AQQwTQYDVR0eAQH/BEMwQaA9MDukOTA3MQswCQYDVQQGEwJDSDEPMA0GA1UEBwwG WnVyaWNoMRcwFQYDVQQKDA5Ob3RhcnkgU2VydmljZaEAMBQGCCqGSM49BAMCBggq hkjOPQMBBwNIADBFAiEA7RJ9ofluL3ainww+zUbKBpAMgbdjE/54EkCy2wZJVRQC IBq7Hb1jUa5VlpMWiB1LjkzUX7Zyovv3i14d+iRkjIIW -----END CERTIFICATE-----",
            "-----BEGIN CERTIFICATE----- MIICXjCCAfugAwIBAgIIHVb6wd3RHhIwFAYIKoZIzj0EAwIGCCqGSM49AwEHMFgx GzAZBgNVBAMMEkNvcmRhIE5vZGUgUm9vdCBDQTELMAkGA1UECgwCUjMxDjAMBgNV BAsMBWNvcmRhMQ8wDQYDVQQHDAZMb25kb24xCzAJBgNVBAYTAlVLMB4XDTE4MDcx MDAwMDAwMFoXDTI3MDUyMDAwMDAwMFowYzELMAkGA1UEBhMCVVMxETAPBgNVBAcT CE5ldyBZb3JrMQ4wDAYDVQQLEwVDb3JkYTEWMBQGA1UEChMNUjMgSG9sZENvIExM QzEZMBcGA1UEAxMQQ29yZGEgRG9vcm1hbiBDQTBZMBMGByqGSM49AgEGCCqGSM49 AwEHA0IABAPL3qAm4WZms5ciBVoxMQXfK7uTmHRVvWfWQ+QVYP3bMHSguHZRzB3v 7EOE8RZpGDan+w007Xj7XR0+xG9SxmCjgZkwgZYwHQYDVR0OBBYEFOvuLjAVKUCu GZge2G/jfX8HosITMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgGGMCMGA1Ud JQQcMBoGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lADAfBgNVHSMEGDAWgBR8rqnf uUgBKxOJC5rmRYUcORcHczARBgorBgEEAYOKYgEBBAMCAQEwFAYIKoZIzj0EAwIG CCqGSM49AwEHA0cAMEQCIBmzQXpnCo9eAxkhwMt0bBr1Q0APJXF0KuBRsFBWAa6S AiBgx6G8G9Ij7B8+y65ItLKVcs7Kh6Rdnr5/1zB/yPwfrg== -----END CERTIFICATE-----",
            "-----BEGIN CERTIFICATE----- MIICCTCCAbCgAwIBAgIIcFe0qctqSucwCgYIKoZIzj0EAwIwWDEbMBkGA1UEAwwS Q29yZGEgTm9kZSBSb290IENBMQswCQYDVQQKDAJSMzEOMAwGA1UECwwFY29yZGEx DzANBgNVBAcMBkxvbmRvbjELMAkGA1UEBhMCVUswHhcNMTcwNTIyMDAwMDAwWhcN MjcwNTIwMDAwMDAwWjBYMRswGQYDVQQDDBJDb3JkYSBOb2RlIFJvb3QgQ0ExCzAJ BgNVBAoMAlIzMQ4wDAYDVQQLDAVjb3JkYTEPMA0GA1UEBwwGTG9uZG9uMQswCQYD VQQGEwJVSzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGlm6LFHrVkzfuUHin36 Jrm1aUMarX/NUZXw8n8gSiJmsZPlUEplJ+f/lzZMky5EZPTtCciG34pnOP0eiMd/ JTCjZDBiMB0GA1UdDgQWBBR8rqnfuUgBKxOJC5rmRYUcORcHczALBgNVHQ8EBAMC AYYwIwYDVR0lBBwwGgYIKwYBBQUHAwEGCCsGAQUFBwMCBgRVHSUAMA8GA1UdEwEB /wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIgDaL4SguKsNeTT7SeUkFdoCBACeG8 GqO4M1KlfimphQwCICiq00hDanT5W8bTLqE7GIGuplf/O8AABlpWrUg6uiUB -----END CERTIFICATE-----"
        };

        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509Certificate[] chain = new X509Certificate[pemCerts.length];
        for (int i = 0; i < pemCerts.length; i++) {
            // 清理PEM字符串中的无关字符
            String cleanedPem = pemCerts[i].replaceAll("-----BEGIN CERTIFICATE-----", "")
                    .replaceAll("-----END CERTIFICATE-----", "")
                    .replaceAll("\\s+", "");
            byte[] certBytes = Base64.getDecoder().decode(cleanedPem);
            chain[i] = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(certBytes));
        }
        return chain;
    }

    // 辅助方法：验证证书链
    private static void validateCertPath(X509Certificate[] certChain) throws Exception {
        // 构建CertPath
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        java.security.cert.CertPath certPath = cf.generateCertPath(Arrays.asList(certChain));
        
        // 设置PKIX参数（关闭CRL验证，可根据需求调整）
        java.security.cert.PKIXParameters params = new java.security.cert.PKIXParameters(getTrustStore());
        params.setRevocationEnabled(false);
        
        // 执行验证
        CertPathValidator validator = CertPathValidator.getInstance("PKIX");
        validator.validate(certPath, params);
        System.out.println("证书链验证成功");
    }

    // 辅助方法：构建信任库（添加根证书到信任锚）
    private static KeyStore getTrustStore() throws Exception {
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(null, null);
        // 使用证书链的最后一个证书作为根证书
        X509Certificate rootCert = loadOriginalCertChain()[3];
        trustStore.setCertificateEntry("root-cert", rootCert);
        return trustStore;
    }
}

注意事项 #

• 上述代码使用了JDK内部的sun.security.x509包，这类API可能在未来JDK版本中发生变化，仅建议在JDK 11环境下使用。
• 如果追求更好的兼容性，可以考虑引入BouncyCastle Provider：添加依赖后将其注册为安全Provider，它可以原生支持带参数的SHA256withECDSA签名算法，无需修改证书内容。
• 修改证书后建议再次确认证书的签名有效性，确保仅移除了冗余参数，未破坏证书的完整性。

内容的提问来源于stack exchange，提问作者fcracker79