Return .p12 file to client without creating keystore file

问题

Is there any way to return a file to client with .p12 extension (base64 encoded string, that is later decoded on the client side and saved with .p12 extension) without storing it to PKCS12 keystore? I have code for creating root certificate, client certificate and setting keyentry to PKCS12 keystore bellow, but I don't want to have .p12 file on the file system, just to generate it and return it to client. Thanks!

Simplified code of creating root certificate:

public static void createRootCertificate(PublicKey pubKey, PrivateKey privKey) {    
    certGen.setSerialNumber(...);
    certGen.setIssuerDN(...);
    certGen.setNotBefore(...);
    certGen.setNotAfter(...);
    certGen.setSubjectDN(...);
    certGen.setPublicKey(pubKey);
    certGen.setSignatureAlgorithm("SHA1WithRSA");

    // add extensions, key identifier, etc.

    X509Certificate cert = certGen.generateX509Certificate(privKey);
    cert.checkValidity(new Date());
    cert.verify(pubKey);
}

The root certificate and its private key is saved to the trusted store after creating.

Than, in the service for generating client certificates, I read root certificate from trusted store and generate client ones:

public static Certificate createClientCertificate(PublicKey pubKey) {   

    PrivateKey rootPrivateKey = ... //read key from trusted store
    X509Certificate rootCertificate = ... //read certificate from trusted store

    certGen.setSerialNumber(...);
    certGen.setIssuerDN(...); // rootCertificate.getIssuerDN ...
    certGen.setNotBefore(...);
    certGen.setNotAfter(...);
    certGen.setSubjectDN(...);
    certGen.setPublicKey(pubKey);
    certGen.setSignatureAlgorithm("SHA1WithRSA");

    // add extensions, issuer key, etc.

    X509Certificate cert = certGen.generateX509Certificate(rootPrivateKey);
    cert.checkValidity(new Date());
    cert.verify(rootCertificate.getPublicKey(););

    return cert;
}

Main class look like this:

public static void main(String[] args) {        
    // assume I have all needed keys generated
    createRootCertificate(rootPubKey, rootPrivKey);
    X509Certificate clientCertificate = createClientCertificate(client1PubKey);

    KeyStore store = KeyStore.getInstance("PKCS12", "BC");

    store.load(null, null);

    store.setKeyEntry("Client1_Key", client1PrivKey, passwd, new Certificate[]{clientCertificate});    
    FileOutputStream fOut = new FileOutputStream("client1.p12");   
    store.store(fOut, passwd);
}

After the code above, I'm reading client1.p12 and I'm creating Base64 encoded response of that file. When I decode response on my client and save with .p12 extension everything works, I can import it to browser. Can this be done without storing it to file?

I have tried with:

store.setKeyEntry("Client1_Key", client1PrivKey, passwd, new Certificate[]{clientCertificate}); 

and after that:

Key key = store.getKey("Client1_Key", passwd);

but when encode key variable, send to client and than decode it and save with .p12 extension, browser say invalid or corrupted file.

Thanks in advance!

回答1:

Simply use a ByteArrayOutputStream instead of FileOutputStream to store the p12:

ByteArrayOutputStream baos = new ByteArrayOutputStream();
store.store(baos, passwd);
byte[] p12Bytes = baos.toByteArray();
String p12Base64 = new String(Base64.encode(p12Bytes));

来源：https://stackoverflow.com/questions/33091424/return-p12-file-to-client-without-creating-keystore-file