Creating certificate chains, any java CA APIs????

[gfrommer]

Hello everyone,

I'm writing a program in which I want to create a certificate for
the user on-the-fly. This is easy enough, possibly running the keytool
through a Runtime.exec() command, but I want to have the newly created
certificate signed by a parent certificate, and the keytool wont do
this.

So I'll be given a list of 5 master certificates or so, and client
applications will request a new certificate derived from one of the
five... is there an API or a java library I can use to do this?

Thanks everyone

Greg

 

[Chris Head]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello everyone,

I'm writing a program in which I want to create a certificate for
the user on-the-fly. This is easy enough, possibly running the keytool
through a Runtime.exec() command, but I want to have the newly created
certificate signed by a parent certificate, and the keytool wont do
this.

So I'll be given a list of 5 master certificates or so, and client
applications will request a new certificate derived from one of the
five... is there an API or a java library I can use to do this?

Thanks everyone

Greg

Hi,
The BouncyCastle cryptography provider contains classes which are able
to generate X.509 certificates. (See http://bouncycastle.org/) It may
take a bit of work, and some time reading RFCs, but they do work. I
haven't used them for a while, so I can't really help you any more than
this. Note that if you want to generate certificate X signed by
certificate Y, then you MUST have the private key for certificate Y. If
you do not have the private key, it is impossible to generate the signature.

Chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)

iD8DBQFCskGxgxSrXuMbw1YRAnB9AKC2zwUddzT/NqfUdUrp67h4wD8sWwCeOzJb
OEXW97XMvGnNEEVLy5wyDT4=
=sNm+
-----END PGP SIGNATURE-----

 

[iksrazal]

Apart from the bouncy castle advice which you may need to look into as
a provider, there is the Java api certpath.

http://java.sun.com/j2se/1.4.2/docs/guide/security/certpath/CertPathProgGuide.html

I know X.509 a bit and you are correct that while you can generate one
with keytool and the java.security.* and javax.crypto.* libs, what you
really need for a certchain is certpath.

HTH,
iksrazal
http://www.braziloutsource.com/