ByteArrayOutputStream bos = new ByteArrayOutputStream();
    KeyStore ks = KeyStore.getInstance("PKCS12",BouncyCastleProvider.PROVIDER_NAME);
    ks.load(null);
    ks.setKeyEntry("key-alias",(Key) key,password.tochararray(),new java.security.cert.Certificate[] { x509Certificate });
    ks.store(bos,password.tochararray());
    bos.close();
    return bos.toByteArray();

解决方法

EVP_PKEY * pkey;
pkey = EVP_PKEY_new();

RSA * rsa;
rsa = RSA_generate_key(
        2048,/* number of bits for the key - 2048 is a sensible value */
        RSA_F4,/* exponent - RSA_F4 is defined as 0x10001L */
        NULL,/* callback - can be NULL if we aren't displaying progress */
        NULL    /* callback argument - not needed in this case */
);

EVP_PKEY_assign_RSA(pkey,rsa);

X509 * x509;
x509 = X509_new();

ASN1_INTEGER_set(X509_get_serialNumber(x509),1);

X509_gmtime_adj(X509_get_notBefore(x509),0);
X509_gmtime_adj(X509_get_notAfter(x509),31536000L);

X509_set_pubkey(x509,pkey);

X509_NAME * name;
name = X509_get_subject_name(x509);

X509_NAME_add_entry_by_txt(name,"C",MBSTRING_ASC,(unsigned char *)"CA",-1,0);
X509_NAME_add_entry_by_txt(name,"O",(unsigned char *)"MyCompany Inc.","CN",(unsigned char *)"localhost",0);

X509_set_issuer_name(x509,name);

//X509_sign(x509,pkey,EVP_sha1());

const EVP_CIPHER *aConst = EVP_des_ede3_cbc();

PEM_write_PrivateKey(f,NULL,NULL);


PEM_write_X509(
            f,/* write the certificate to the file we've opened */
            x509 /* our certificate */
);

/* pkwrite.c */

#include <stdio.h>
#include <stdlib.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>

/* Simple PKCS#12 file creator */
int main(int argc,char **argv)
{
    FILE *fp;
    EVP_PKEY *pkey;
    X509 *cert;
    PKCS12 *p12;
    if (argc != 5) {
        fprintf(stderr,"Usage: pkwrite infile password name p12file\n");
        exit(1);
    }
    SSLeay_add_all_algorithms();
    ERR_load_crypto_strings();
    if (!(fp = fopen(argv[1],"r"))) {
        fprintf(stderr,"Error opening file %s\n",argv[1]);
        exit(1);
    }
    cert = PEM_read_X509(fp,NULL);
    rewind(fp);
    pkey = PEM_read_PrivateKey(fp,NULL);
    fclose(fp);
    p12 = PKCS12_create(argv[2],argv[3],cert,0);
    if(!p12) {
        fprintf(stderr,"Error creating PKCS#12 structure\n");
        ERR_print_errors_fp(stderr);
        exit(1);
    }
    if (!(fp = fopen(argv[4],"wb"))) {
        fprintf(stderr,argv[1]);
        ERR_print_errors_fp(stderr);
        exit(1);
    }
    i2d_PKCS12_fp(fp,p12);
    PKCS12_free(p12);
    fclose(fp);
    return 0;
}

在Java 8之前，SunPKCS11提供程序的加载方式如下：

Provider provider = new sun.security.pkcs11.SunPKCS11 (new ByteArrayInputStream (configFile.getBytes ()));
Security.addProvider (provider);

configFile是带有配置参数的字符串。因此，如果应用程序需要使用多个连接的智能卡，则可以创建多个提供程序。要访问每个提供程序，使用的名称是“
SunPKCS11-”，后跟我们在配置中指示的名称。

在Java 8中，sun.security.pkcs11.SunPKCS11该类已在JDK中删除。因此，我必须通过反射对上一个调用进行编程。

Java 9中的PKCS＃11提供程序的操作似乎非常不同：

• 该SunPKCS11构造已更改为空单。配置是通过“ configure”方法加载的，因此必须将其保存在磁盘上的文件中，并且我无法再通过流将其加载到字符串中。

• 如果我们尝试使用反射，则会出现以下警告：

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by PruebaTarjeta

(file:/C:/temp/pkcs11java9/classes/) to constructor
sun.security.pkcs11.SunPKCS11()
WARNING: Please consider reporting this to the maintainers of
PruebaTarjeta
WARNING: Use –illegal-access=warn to enable warnings of further illegal
reflective access operations
WARNING: All illegal access operations will be denied in a future
release

• 在Java 9中，将自动生成SunPKCS11提供程序，该程序位于加密提供程序的列表中。可以从列表中获取并进行配置。问题是您只能在列表中加载一个PKCS＃11提供程序。在Java的9文档表明，我们可以得到的PKCS＃11提供商，“SunPKCS11-”之后，我们在配置中指示的名字，但事实并非如此。如果我们查看提供商列表，则只有一个是“ SunPKCS11”，因此每个智能卡都不能有一个提供商。

别人也会这样吗？有什么办法吗？

<dependency>
                            <groupId>org.bouncycastle</groupId>
                            <artifactId>bcprov-jdk15on</artifactId>
                            <version>1.49</version>
                    </dependency>
                    <dependency>
                            <groupId>org.bouncycastle</groupId>
                            <artifactId>bcpkix-jdk15on</artifactId>
                            <version>1.49</version>
                    </dependency>

直接上代码

package test;

import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.ASN1Primitive;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.*;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.X509v3CertificateBuilder;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;

import java.io.*;
import java.math.BigInteger;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.text.SimpleDateFormat;
import java.util.*;

/**
 * 成都一方思致科技有限公司
 *
 * @author 蒋昌宝
 * @version 1.0
 * @date 2019/8/23 9:26
 * @description 证书生成工具类
 * =========================================================================
 * 变更履历：
 * -------------------------------------------------------------------------
 * 变更编号     变更时间    变更人   变更原因    变更内容
 * -------------------------------------------------------------------------
 */

public class GenerateCertificateUtil {

private static KeyPair getKey() throws NoSuchAlgorithmException {
    // 密钥对 生成器，RSA算法 生成的  提供者是 BouncyCastle
    KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA",new BouncyCastleProvider());
    // 密钥长度 1024
    generator.initialize(1024);
    // 证书中的密钥 公钥和私钥
    KeyPair keyPair = generator.generateKeyPair();
    return keyPair;
}

/**
 * @param password  密码
 * @param issuerStr 颁发机构信息
 * @param subjectStr 使用者信息
 * @param certificateCRL 颁发地址
 * @return
 */
public static Map<String,byte[]> createCert(String password,String issuerStr,String subjectStr,String certificateCRL) {

    Map<String,byte[]> result = new HashMap<String,byte[]>();
    ByteArrayOutputStream out = null;
    try {
        //  生成JKS证书
        //  KeyStore keyStore = KeyStore.getInstance("JKS");
        //  标志生成PKCS12证书
        KeyStore keyStore = KeyStore.getInstance("PKCS12",new BouncyCastleProvider());
        keyStore.load(null,null);
        KeyPair keyPair = getKey();
        //  issuer与 subject相同的证书就是CA证书
        Certificate cert = generateCertificateV3(issuerStr,subjectStr,keyPair,result,certificateCRL,null);
        // cretkey随便写，标识别名
        keyStore.setKeyEntry("cretkey",keyPair.getPrivate(),password.tochararray(),new Certificate[] { cert });
        out = new ByteArrayOutputStream();
        cert.verify(keyPair.getPublic());
        keyStore.store(out,password.tochararray());
        byte[] keyStoreData = out.toByteArray();
        result.put("keyStoreData",keyStoreData);
        return result;
    } catch (Exception e) {
        e.printstacktrace();
    } finally {
        if (out != null) {
            try {
                out.close();
            } catch (IOException e) {
            }
        }
    }
    return result;
}

/**
 * @param issuerStr
 * @param subjectStr
 * @param keyPair
 * @param result
 * @param certificateCRL
 * @param extensions
 * @return
 */
public static Certificate generateCertificateV3(String issuerStr,KeyPair keyPair,Map<String,byte[]> result,String certificateCRL,List<Extension> extensions) {

    ByteArrayInputStream bout = null;
    X509Certificate cert = null;
    try {
        PublicKey publicKey = keyPair.getPublic();
        PrivateKey privateKey = keyPair.getPrivate();
        Date notBefore = new Date();
        Calendar rightNow = Calendar.getInstance();
        rightNow.setTime(notBefore);
        // 日期加1年
        rightNow.add(Calendar.YEAR,1);
        Date notAfter = rightNow.getTime();
        // 证书序列号
        BigInteger serial = BigInteger.probablePrime(256,new Random());
        X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
                new X500Name(issuerStr),serial,notBefore,notAfter,new X500Name(subjectStr),publicKey);
        JcaContentSignerBuilder jBuilder = new JcaContentSignerBuilder( "SHA1withRSA");
        Secur删除eRandom secur删除eRandom = new Secur删除eRandom();
        jBuilder.setSecur删除eRandom(secur删除eRandom);
        ContentSigner singer = jBuilder.setProvider(  new BouncyCastleProvider()).build(privateKey);
        // 分发点
        ASN1ObjectIdentifier cRLdistributionPoints = new ASN1ObjectIdentifier( "2.5.29.31");
        GeneralName generalName = new GeneralName( GeneralName.uniformResourceIdentifier,certificateCRL);
        GeneralNames seneralNames = new GeneralNames(generalName);
        distributionPointName distributionPoint = new distributionPointName( seneralNames);
        distributionPoint[] points = new distributionPoint[1];
        points[0] = new distributionPoint(distributionPoint,null,null);
        CRLdistPoint cRLdistPoint = new CRLdistPoint(points);
        builder.addExtension(cRLdistributionPoints,true,cRLdistPoint);
        // 用途
        ASN1ObjectIdentifier keyUsage = new ASN1ObjectIdentifier( "2.5.29.15");
        // | KeyUsage.nonRepudiation | KeyUsage.keyCertSign
        builder.addExtension(keyUsage,new KeyUsage( KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
        // 基本限制 X509Extension.java
        ASN1ObjectIdentifier basicConstraints = new ASN1ObjectIdentifier("2.5.29.19");
        builder.addExtension(basicConstraints,new BasicConstraints(true));
        // privKey:使用自己的私钥进行签名，CA证书
        if (extensions != null){
            for (Extension ext : extensions) {
                builder.addExtension(
                        new ASN1ObjectIdentifier(ext.getoid()),ext.isCritical(),ASN1Primitive.fromByteArray(ext.getValue()));
            }
        }
        X509CertificateHolder holder = builder.build(singer);
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        bout = new ByteArrayInputStream(holder.toASN1Structure() .getEncoded());
        cert = (X509Certificate) cf.generateCertificate(bout);
        byte[] certBuf = holder.getEncoded();
        SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd");
        // 证书数据
        result.put("certificateData",certBuf);
        //公钥
        result.put("publicKey",publicKey.getEncoded());
        //私钥
        result.put("privateKey",privateKey.getEncoded());
        //证书有效开始时间
        result.put("notBefore",format.format(notBefore).getBytes("utf-8"));
        //证书有效结束时间
        result.put("notAfter",format.format(notAfter).getBytes("utf-8"));
    } catch (Exception e) {
        e.printstacktrace();
    } finally {
        if (bout != null) {
            try {
                bout.close();
            } catch (IOException e) {
            }
        }
    }
    return cert;
}

class Extension {

    private String oid;
    private boolean critical;
    private byte[] value;

    public String getoid() {
        return oid;
    }

    public void setoid(String oid) {
        this.oid = oid;
    }

    public boolean isCritical() {
        return critical;
    }

    public void setCritical(boolean critical) {
        this.critical = critical;
    }

    public byte[] getValue() {
        return value;
    }

    public void setValue(byte[] value) {
        this.value = value;
    }
}

/**

• 测试证书生成
• @throws Exception
  */
  public static void main(String[] args) throws Exception{
  // CN: 名字与姓氏 OU : 组织单位名称
  // O ：组织名称 L : 城市或区域名称 E : 电子邮件
  // ST: 州或省份名称 C: 单位的两字母国-家代码
  String issuerStr = "CN=jcb凭证,OU=研发部,O=jcb有限公司,C=CN,[email protected],L=北京,ST=北京";
  String subjectStr = "CN=jcb有限公司,OU=用户,O=test,[email protected],ST=北京";
  String certificateCRL = "https://jcb.cn";
  Map<String,byte[]> result = GenerateCertificateUtil.createCert("123456",issuerStr,certificateCRL);
  // 生成.p12
  FileOutputStream outPutStream = new FileOutputStream("d:/keystore_jcb.p12");
  outPutStream.write(result.get("keyStoreData"));
  outPutStream.flush();
  outPutStream.close();
  //生成.cer颁发给用户的证书
  // FileOutputStream fos = new FileOutputStream(new File("d:/zheng.cer"));
  // fos.write(result.get("certificateData"));
  // fos.flush();
  // fos.close();
  }

}