core/src/main/java/org/keycloak/util/CertificateUtils.java
/**
     * Generates version 3 {@link java.security.cert.X509Certificate}.
     *
     * @param keyPair the key pair
     * @param caPrivateKey the CA private key
     * @param caCert the CA certificate
     * @param subject the subject name
     * 
     * @return the x509 certificate
     * 
     * @throws Exception the exception
     */


@param keyPair the key pair
@param caPrivateKey the CA private key
@param caCert the CA certificate
@param subject the subject name

@return the x509 certificate

@throws Exception the exception
@param keyPair the key pair @param caPrivateKey the CA private key @param caCert the CA certificate @param subject the subject name @return the x509 certificate @throws Exception the exception
public static X509Certificate generateV3Certificate(KeyPair keyPair, PrivateKey caPrivateKey, X509Certificate caCert,
            String subject) throws Exception {
        try {
            X500Name subjectDN = new X500Name("CN=" + subject);
            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
            BigInteger serialNumber = BigInteger.valueOf(Math.abs(random.nextInt()));
            Date notBefore = new Date(System.currentTimeMillis());
            Date notAfter = new Date(System.currentTimeMillis() + (((1000L * 60 * 60 * 24 * 30)) * 12) * 3);
            SubjectPublicKeyInfo subjPubKeyInfo = new SubjectPublicKeyInfo(ASN1Sequence.getInstance(keyPair.getPublic()
                    .getEncoded()));
            X509v3CertificateBuilder certGen = new X509v3CertificateBuilder(new X500Name(caCert.getSubjectDN().getName()),
                    serialNumber, notBefore, notAfter, subjectDN, subjPubKeyInfo);
            DigestCalculator digCalc = new BcDigestCalculatorProvider()
                    .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
            X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);
            certGen.addExtension(Extension.subjectKeyIdentifier, false,
                    x509ExtensionUtils.createSubjectKeyIdentifier(subjPubKeyInfo));
            certGen.addExtension(Extension.authorityKeyIdentifier, false,
                    x509ExtensionUtils.createAuthorityKeyIdentifier(subjPubKeyInfo));
            certGen.addExtension(Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign
                    | KeyUsage.cRLSign));
            KeyPurposeId[] EKU = new KeyPurposeId[2];
            EKU[0] = KeyPurposeId.id_kp_emailProtection;
            EKU[1] = KeyPurposeId.id_kp_serverAuth;
            certGen.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(EKU));
            certGen.addExtension(Extension.basicConstraints, true, new BasicConstraints(0));
            ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider("BC").build(caPrivateKey);
            return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certGen.build(sigGen));
        } catch (Exception e) {
            throw new RuntimeException("Error creating X509v3Certificate.", e);
        }
    }
public static X509Certificate generateV3Certificate ( KeyPair keyPair , PrivateKey caPrivateKey , X509Certificate caCert , String subject ) throws Exception { try { X500Name subjectDN = new X500Name ( "CN=" + subject ) ; SecureRandom random = SecureRandom . getInstance ( "SHA1PRNG" ) ; BigInteger serialNumber = BigInteger . valueOf ( Math . abs ( random . nextInt ( ) ) ) ; Date notBefore = new Date ( System . currentTimeMillis ( ) ) ; Date notAfter = new Date ( System . currentTimeMillis ( ) + ( ( ( 1000L * 60 * 60 * 24 * 30 ) ) * 12 ) * 3 ) ; SubjectPublicKeyInfo subjPubKeyInfo = new SubjectPublicKeyInfo ( ASN1Sequence . getInstance ( keyPair . getPublic ( ) . getEncoded ( ) ) ) ; X509v3CertificateBuilder certGen = new X509v3CertificateBuilder ( new X500Name ( caCert . getSubjectDN ( ) . getName ( ) ) , serialNumber , notBefore , notAfter , subjectDN , subjPubKeyInfo ) ; DigestCalculator digCalc = new BcDigestCalculatorProvider ( ) . get ( new AlgorithmIdentifier ( OIWObjectIdentifiers . idSHA1 ) ) ; X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils ( digCalc ) ; certGen . addExtension ( Extension . subjectKeyIdentifier , false , x509ExtensionUtils . createSubjectKeyIdentifier ( subjPubKeyInfo ) ) ; certGen . addExtension ( Extension . authorityKeyIdentifier , false , x509ExtensionUtils . createAuthorityKeyIdentifier ( subjPubKeyInfo ) ) ; certGen . addExtension ( Extension . keyUsage , false , new KeyUsage ( KeyUsage . digitalSignature | KeyUsage . keyCertSign | KeyUsage . cRLSign ) ) ; KeyPurposeId [ ] EKU = new KeyPurposeId [ 2 ] ; EKU [ 0 ] = KeyPurposeId . id_kp_emailProtection ; EKU [ 1 ] = KeyPurposeId . id_kp_serverAuth ; certGen . addExtension ( Extension . extendedKeyUsage , false , new ExtendedKeyUsage ( EKU ) ) ; certGen . addExtension ( Extension . basicConstraints , true , new BasicConstraints ( 0 ) ) ; ContentSigner sigGen = new JcaContentSignerBuilder ( "SHA1WithRSAEncryption" ) . setProvider ( "BC" ) . build ( caPrivateKey ) ; return new JcaX509CertificateConverter ( ) . setProvider ( "BC" ) . getCertificate ( certGen . build ( sigGen ) ) ; } catch ( Exception e ) { throw new RuntimeException ( "Error creating X509v3Certificate." , e ) ; } }
Generates version 3 {@link java.security.cert.X509Certificate}.
Generates version 3 { @link java . security . cert . X509Certificate } .
// Serial Number
 // Validity
 // SubjectPublicKeyInfo
 // Subject Key Identifier
 // Authority Key Identifier
 // Key Usage
 // Extended Key Usage
 // Basic Constraints
 // Content Signer
 // Certificate
