private X509Certificate createCACert ( PublicKey publicKey , PrivateKey privateKey ) throws Exception { // signers name X500Name issuerName = new X500Name ( "CN=www.mockserver.com, O=MockServer, L=London, ST=England, C=UK" ) ; // subjects name - the same as we are self signed. X500Name subjectName = issuerName ; // serial BigInteger serial = BigInteger . valueOf ( new Random ( ) . nextInt ( Integer . MAX_VALUE ) ) ; // create the certificate - version 3 X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder ( issuerName , serial , NOT_BEFORE , NOT_AFTER , subjectName , publicKey ) ; builder . addExtension ( Extension . subjectKeyIdentifier , false , createSubjectKeyIdentifier ( publicKey ) ) ; builder . addExtension ( Extension . basicConstraints , true , new BasicConstraints ( true ) ) ; KeyUsage usage = new KeyUsage ( KeyUsage . keyCertSign | KeyUsage . digitalSignature | KeyUsage . keyEncipherment | KeyUsage . dataEncipherment | KeyUsage . cRLSign ) ; builder . addExtension ( Extension . keyUsage , false , usage ) ; ASN1EncodableVector purposes = new ASN1EncodableVector ( ) ; purposes . add ( KeyPurposeId . id_kp_serverAuth ) ; purposes . add ( KeyPurposeId . id_kp_clientAuth ) ; purposes . add ( KeyPurposeId . anyExtendedKeyUsage ) ; builder . addExtension ( Extension . extendedKeyUsage , false , new DERSequence ( purposes ) ) ; X509Certificate cert = signCertificate ( builder , privateKey ) ; cert . checkValidity ( new Date ( ) ) ; cert . verify ( publicKey ) ; return cert ; }
Create a certificate to use by a Certificate Authority signed by a self signed certificate .