package com.qianwen.license.keystore;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.FileReader;
import java.math.BigInteger;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Security;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.jce.provider.PEMUtil;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;

import cn.hutool.core.date.DateField;
import cn.hutool.core.date.DateTime;
import cn.hutool.core.date.DateUtil;
import cn.hutool.core.util.RandomUtil;
import cn.hutool.core.util.StrUtil;
import cn.hutool.crypto.KeyUtil;
import cn.hutool.crypto.PemUtil;

public class PubKeyGenDemo {
	static String root = "d:/cert"; 
	/**
     * 自签名根证书私钥保存路径 /ca/ca-private.key
     */
    private static final String CA_PRIVATE_KEY_FILE_PATH = StrUtil.format("{}/ca/ca-private.key", root);
    /**
     * 自签名根证书公钥保存路径 /ca/ca-public.key
     */
    private static final String CA_PUBLIC_KEY_FILE_PATH = StrUtil.format("{}/ca/ca-public.key", root);
    /**
     * 自签名根证书保存路径ca/ca.cer
     */
    private static final String CA_CERTIFICATE_FILE_PATH = StrUtil.format("{}/ca/ca.cer", root);
    /**
     * 自签名证书私钥保存路径self/self-private.key
     */
    private static final String SELF_SIGNED_PRIVATE_KEY_FILE_PATH = StrUtil.format("{}/self/self-private.key", root);
    /**
     * 自签名证书公钥保存路径self/self-public.key
     */
    private static final String SELF_SIGNED_PUBLIC_KEY_FILE_PATH = StrUtil.format("{}/self/self-public.key", root);
    /**
     * 自签名证书保存路径 self/self.cer
     */
    private static final String SELF_SIGNED_CERTIFICATE_FILE_PATH = StrUtil.format("{}/self/self.cer", root);
    /**
     * pkcs12 格式证书保存路径 self/self.p12
     */
    private static final String SELF_SIGNED_PKCS12_FILE_PATH = StrUtil.format("{}/self/self.p12", root);
    
    /**
     * pkcs12 公钥库格式证书保存路径
     */
    private static final String SELF_SIGNED_PUBLIC_PKCS12_FILE_PATH = StrUtil.format("{}/self/publicself.p12", root);
    /**
     * pkcs12 格式证书密码
     */
    private static final String SELF_SIGNED_PKCS12_CERTIFICATE_PASSWORD = "a1b2c3";
 
    public static void main(String[] args) throws Throwable {
    	
    	//Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
    	
        toCaCertificate();
        
        toSelfSignedCertificate();
        
        toPrivatePkcs12Store();

        toPublicPkcs12Store();
    }
 
    /**
     * 生成根证书及其密钥对,保存位2个key文件和一个ca.cer,这个在后续只是一个颁发者的属性需要使用
     * @throws Throwable
     */
    public static void toCaCertificate() throws Throwable {
        //根证书主题信息
        X500Name subject = new SubjectBuilder()
                .setCn("yangys")
                .setO("My CA organization")
                .setOu("My CA organizational unit name")
                .setC("My CA country code")
                .setSt("My CA state, or province name")
                .setL("My CA locality name")
                .build();
 
        //根证书颁发者信息，即自身
        X500Name issuer = subject;
 
        //根证书有效期
        DateTime notBefore = DateUtil.yesterday();
        DateTime notAfter = DateUtil.offset(notBefore, DateField.YEAR, 10);
 
        CertificateInfo certificateInfo = new CertificateInfo();
        certificateInfo.setSerial(BigInteger.valueOf(RandomUtil.randomLong(1L, Long.MAX_VALUE)));
        certificateInfo.setIssuer(issuer);
        certificateInfo.setSubject(subject);
        certificateInfo.setNotBefore(notBefore);
        certificateInfo.setNotAfter(notAfter);
        certificateInfo.setKeyAlgorithm(X509CertificateConstants.KEY_ALGORITHM);
        certificateInfo.setSignAlgorithm(X509CertificateConstants.SIGN_ALGORITHM);
 
        //生成根证书及其密钥对
        KeyAndCertificate keyAndCertificate = CertificateUtils.generateCertificate(certificateInfo, null);
        //保存根证书及其密钥对到磁盘
        CertificateUtils.save(keyAndCertificate.getPrivateKey(), CA_PRIVATE_KEY_FILE_PATH);
        CertificateUtils.save(keyAndCertificate.getPublicKey(), CA_PUBLIC_KEY_FILE_PATH);
        CertificateUtils.save(keyAndCertificate.getCertificate(), CA_CERTIFICATE_FILE_PATH);
    }
    
    /**
     * 生成自签名证书及其密钥对
     * @throws Throwable
     */
    
    public static void toSelfSignedCertificate() throws Throwable {
        //根证书私钥
        PrivateKey caPrivateKey;
        //从磁盘加载根证书私钥
        try(FileInputStream fileInputStream = new FileInputStream(CA_PRIVATE_KEY_FILE_PATH);) {
            caPrivateKey = PemUtil.readPemPrivateKey(fileInputStream);
        }
 
        //从磁盘加载根证书
        X509Certificate caCertificate;
        try(FileInputStream fileInputStream = new FileInputStream(CA_CERTIFICATE_FILE_PATH);) {
            caCertificate = (X509Certificate) KeyUtil.readX509Certificate(fileInputStream);
        }
 
        //证书颁发者信息
        X500Name issuer = new X500Name(caCertificate.getIssuerX500Principal().getName());
 
        //证书主题信息
        X500Name subject = new SubjectBuilder()
                .setCn("My common name")
                .setO("My organization")
                .setOu("My organizational unit name")
                .setC("My country code")
                .setSt("My state, or province name")
                .setL("My locality name")
                .build();
 
        //证书有效期
        DateTime notBefore = DateUtil.yesterday();
        DateTime notAfter = DateUtil.offset(notBefore, DateField.YEAR, 10);
 
        CertificateInfo certificateInfo = new CertificateInfo();
        certificateInfo.setSerial(BigInteger.valueOf(RandomUtil.randomLong(1L, Long.MAX_VALUE)));
        certificateInfo.setIssuer(issuer);
        certificateInfo.setSubject(subject);
        certificateInfo.setNotBefore(notBefore);
        certificateInfo.setNotAfter(notAfter);
        certificateInfo.setKeyAlgorithm(X509CertificateConstants.KEY_ALGORITHM);
        certificateInfo.setSignAlgorithm(X509CertificateConstants.SIGN_ALGORITHM);
 
        //生成自签名证书及其密钥对
        KeyAndCertificate keyAndCertificate = CertificateUtils.generateCertificate(certificateInfo, caPrivateKey);
        //保存自签名证书及其密钥对到磁盘
        CertificateUtils.save(keyAndCertificate.getPrivateKey(), SELF_SIGNED_PRIVATE_KEY_FILE_PATH);
        CertificateUtils.save(keyAndCertificate.getPublicKey(), SELF_SIGNED_PUBLIC_KEY_FILE_PATH);
        CertificateUtils.save(keyAndCertificate.getCertificate(), SELF_SIGNED_CERTIFICATE_FILE_PATH);
    }
   
    /**
     * 生成 pkcs12 格式证书,根据情况，可胜场公，私2中证书
     * @throws Exception
     */
    
    public static void toPrivatePkcs12Store() throws Exception {
        char[] password = SELF_SIGNED_PKCS12_CERTIFICATE_PASSWORD.toCharArray();
        //证书私钥
        PrivateKey privateKey;
        //从磁盘加载证书私钥
        try(FileInputStream fileInputStream = new FileInputStream(SELF_SIGNED_PRIVATE_KEY_FILE_PATH)) {
            privateKey = PemUtil.readPemPrivateKey(fileInputStream);
        }
        //证书
        Certificate certificate;
        //从磁盘加载证书
        try(FileInputStream fileInputStream = new FileInputStream(SELF_SIGNED_CERTIFICATE_FILE_PATH)) {
            certificate = KeyUtil.readX509Certificate(fileInputStream);
        }
        KeyStore pkcs12 = KeyStore.getInstance("pkcs12");
        pkcs12.load(null, password);
        pkcs12.setKeyEntry("myPrivate", privateKey, password, new Certificate[] {certificate});
        try(FileOutputStream fileOutputStream = new FileOutputStream(SELF_SIGNED_PKCS12_FILE_PATH)) {
            pkcs12.store(fileOutputStream, password);
        }
    }
    
    
    public static void toPublicPkcs12Store() throws Exception {
        char[] password = SELF_SIGNED_PKCS12_CERTIFICATE_PASSWORD.toCharArray();
     // 加载证书
        
        Certificate certificate;
        //从磁盘加载证书,就是用keytool从私钥导出的证书
 
        try(FileInputStream fileInputStream = new FileInputStream(SELF_SIGNED_CERTIFICATE_FILE_PATH)) {
            certificate = KeyUtil.readX509Certificate(fileInputStream);
        }

        KeyStore pkcs12 = KeyStore.getInstance("pkcs12");//自己改的, "BC"
        pkcs12.load(null, password);
        
        String alias = "myPublicKey";
        pkcs12.setCertificateEntry(alias, certificate);
        //pkcs12.setKeyEntry("myPublicKey", publicKey, password, new Certificate[] {certificate});
        try(FileOutputStream fileOutputStream = new FileOutputStream(SELF_SIGNED_PUBLIC_PKCS12_FILE_PATH)) {
            pkcs12.store(fileOutputStream, password);
        }
    }
}