求无需依赖sun.security或BouncyCastle的Java X.509证书生成方法

Got it, so you need to create an X.509 certificate in Java without relying on the sun.security.x509.* packages or BouncyCastle? Great news—this is totally achievable using only standard JDK APIs. Let me walk you through two practical approaches depending on your Java version:

方案1：Java 15+（推荐，简洁且官方支持） #

Starting with Java 15, the JDK introduced a dedicated CertificateBuilder API in the standard library, which makes certificate creation straightforward and avoids any non-standard dependencies. Here's the step-by-step breakdown:

• Generate an RSA Key Pair
  First, create a public-private key pair using the standard KeyPairGenerator:

  KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
  keyPairGen.initialize(2048); // Go for 4096 bits if you need stronger security
  KeyPair keyPair = keyPairGen.generateKeyPair();
  

• Define Certificate Metadata
  Set up the core details of your certificate—like issuer/subject DN (for self-signed certs, these are the same), validity period, and a unique serial number:

  // Define the Distinguished Name (DN) for the issuer/subject
  X500Principal dn = new X500Principal("CN=Self-Signed CA, OU=MyTeam, O=MyCompany, L=Austin, ST=Texas, C=US");
  
  BigInteger serialNumber = BigInteger.valueOf(System.currentTimeMillis()); // Unique serial number
  Date notBefore = new Date();
  Date notAfter = new Date(notBefore.getTime() + 365L * 24 * 60 * 60 * 1000); // Valid for 1 year
  

• Build and Sign the Certificate
  Use X509CertificateBuilder to assemble the certificate, then sign it with your private key:

  X509CertificateBuilder certBuilder = CertificateBuilder.getInstance("X.509")
          .setIssuer(dn)
          .setSubject(dn)
          .setSerialNumber(serialNumber)
          .setNotBefore(notBefore)
          .setNotAfter(notAfter)
          .setPublicKey(keyPair.getPublic())
          .setSignatureAlgorithm("SHA256withRSA"); // Avoid SHA1—it's no longer secure
  
  // Sign the certificate with the private key to get the final X509Certificate
  X509Certificate cert = certBuilder.build(keyPair.getPrivate());
  

• Verify the Certificate (Optional)
  Double-check that the certificate is valid by verifying its signature against the public key:

  cert.verify(keyPair.getPublic());
  System.out.println("Self-signed certificate is valid!");
  

方案2：Java 8-14（兼容旧版本） #

Older JDK versions don't have the CertificateBuilder API, so we need a workaround. The catch is that constructing the X.509 certificate manually requires knowledge of its ASN.1 DER structure, but here's the core approach:

• Generate the RSA key pair (same as Scheme 1)
• Construct the TBS (To Be Signed) Certificate
  Manually assemble the core certificate fields (version, serial number, signature algorithm, issuer, validity, subject, public key) into the ASN.1 format required for X.509.
• Sign the TBS Section
  Use the Signature class to sign the TBS bytes with your private key using a secure algorithm like SHA256withRSA.
• Assemble the Full Certificate
  Combine the TBS bytes, signature algorithm ID, and signature value into a complete X.509 ASN.1 structure, then encode it to DER format.
• Parse the DER into an X509Certificate
  Use CertificateFactory.getInstance("X.509") to parse the DER bytes into a usable X509Certificate object.

A heads-up: Manual ASN.1 construction is tedious and error-prone. If possible, upgrading to Java 15+ will save you a lot of hassle.

Key Best Practices #

• Always use secure signature algorithms: SHA256withRSA or SHA384withRSA (avoid SHA1 entirely)
• Use key lengths of at least 2048 bits (4096 is better for long-term security)
• Ensure the serial number is unique for each certificate (timestamp-based values work well)

内容的提问来源于stack exchange，提问作者Raghu