# 根據報錯創建文件
[root@VM-0-10-centos www.yonyong.top]# touch /etc/pki/CA/index.txt
# 根據報錯創建文件
[root@VM-0-10-centos www.yonyong.top]# touch /etc/pki/CA/serial
# 根據報錯創建文件
[root@VM-0-10-centos www.yonyong.top]# echo '01' >/etc/pki/CA/serial

[root@VM-0-10-centos www.yonyong.top]# openssl ca -in app.csr -out app.crt -cert CARoot1024.crt -keyfile CARoot1024.key -days 1826 -policy policy_anything
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Apr 24 10:37:05 2022 GMT
            Not After : Apr 24 10:37:05 2027 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = js
            localityName              = nj
            organizationName          = yd
            organizationalUnitName    = yd
            commonName                = yd
            emailAddress              = yd@qq.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                EA:82:46:3F:C6:D4:CD:E6:62:00:72:DE:89:55:6D:D7:68:00:14:F4
            X509v3 Authority Key Identifier: 
                keyid:B1:0A:8A:8B:C5:11:4E:47:22:C3:12:C8:47:23:26:C2:1F:24:09:E3

Certificate is to be certified until Apr 24 10:37:05 2027 GMT (1826 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@VM-0-10-centos www.yonyong.top]# ll
total 24
-rw-r--r-- 1 root root 4551 Apr 24 18:37 app.crt
-rw-r--r-- 1 root root 1062 Apr 24 18:21 app.csr
-rw-r--r-- 1 root root 1679 Apr 24 18:20 app.key
-rw-r--r-- 1 root root 1399 Apr 24 18:12 CARoot1024.crt
-rw-r--r-- 1 root root 1679 Apr 24 18:20 CARoot1024.key
[root@VM-0-10-centos www.yonyong.top]# 

// 使用CA的公私鑰文件給 csr 文件簽名，生成中級證書，有效期5年 
openssl ca -extensions v3_ca -in app.csr -out app.crt -cert CARoot1024.crt -keyfile CARoot1024.key -days 1826 -policy policy_anything

[root@VM-0-10-centos www.yonyong.top]# openssl ca -extensions v3_ca -in app.csr -out app.crt -cert CARoot1024.crt -keyfile CARoot1024.key -days 1826 -policy policy_anything
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: Apr 24 10:41:20 2022 GMT
            Not After : Apr 24 10:41:20 2027 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = js
            localityName              = nj
            organizationName          = yd
            organizationalUnitName    = yd
            commonName                = yd
            emailAddress              = yd@qq.com
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                EA:82:46:3F:C6:D4:CD:E6:62:00:72:DE:89:55:6D:D7:68:00:14:F4
            X509v3 Authority Key Identifier: 
                keyid:B1:0A:8A:8B:C5:11:4E:47:22:C3:12:C8:47:23:26:C2:1F:24:09:E3

            X509v3 Basic Constraints: 
                CA:TRUE
Certificate is to be certified until Apr 24 10:41:20 2027 GMT (1826 days)
Sign the certificate? [y/n]:y
failed to update database
TXT_DB error number 2
[root@VM-0-10-centos www.yonyong.top]# ll
total 16
-rw-r--r-- 1 root root    0 Apr 24 18:41 app.crt
-rw-r--r-- 1 root root 1062 Apr 24 18:21 app.csr
-rw-r--r-- 1 root root 1679 Apr 24 18:20 app.key
-rw-r--r-- 1 root root 1399 Apr 24 18:12 CARoot1024.crt
-rw-r--r-- 1 root root 1679 Apr 24 18:20 CARoot1024.key
[root@VM-0-10-centos www.yonyong.top]# 

/**
 * 通過PKCS12格式的證書庫文件獲取證書對象（包含公鑰和私鑰證書）
 * 自簽證書：
 * https://csr.chinassl.net/keytool-commands.html
 * keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048
 */
private static void test() throws Exception {
    InputStream inStream = new FileInputStream(CERTIFICATE_SELF_SIGN);

    KeyStore ks = KeyStore.getInstance("PKCS12");
    ks.load(inStream, "123456".toCharArray());

    String alias = ks.aliases().nextElement();

    //獲取私鑰
    PrivateKey privateKey = (PrivateKey) ks.getKey(alias, "123456".toCharArray());

    //獲取公鑰證書
    X509Certificate certificate = (X509Certificate) ks.getCertificate(alias);
    System.out.println(certificate.getNotAfter());
}

/**
 * 通過pem文件獲取證書對象
 */
private static void test2() throws Exception {
    CertificateFactory fact = CertificateFactory.getInstance("X.509");
    X509Certificate certificate = (X509Certificate) fact.generateCertificate(new FileInputStream (CERTIFICATE_IT610));
    PublicKey publicKey = certificate.getPublicKey();
}

/**
 * 從字符串中加載公鑰
 *
 * @param publicKeyStr 公鑰數據字符串
 * @throws Exception 異常信息
 */
public static PublicKey loadPublicKey(String publicKeyStr) throws Exception {
    try {
        byte[] buffer = Base64.decode(publicKeyStr);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(buffer);
        return keyFactory.generatePublic(keySpec);
    } catch (NoSuchAlgorithmException e) {
        throw new Exception("無此算法");
    } catch (InvalidKeySpecException e) {
        throw new Exception("公鑰非法");
    } catch (NullPointerException e) {
        throw new Exception("公鑰數據為空");
    }
}

/**
 * 從字符串中加載私鑰<br>
 * 加載時使用的是PKCS8EncodedKeySpec（PKCS#8編碼的Key指令）。
 *
 * @param privateKeyStr 私鑰
 * @return {@link PrivateKey}
 * @throws Exception 異常信息
 */
public static PrivateKey loadPrivateKey(String privateKeyStr) throws Exception {
    try {
        byte[] buffer = Base64.decode(privateKeyStr);
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(buffer);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        return keyFactory.generatePrivate(keySpec);
    } catch (NoSuchAlgorithmException e) {
        throw new Exception("無此算法");
    } catch (InvalidKeySpecException e) {
        throw new Exception("私鑰非法");
    } catch (NullPointerException e) {
        throw new Exception("私鑰數據為空");
    }
}