基于ejbca community 6.3.1.1构建独立ca系统管理数字证书

tar xvf jboss-as-7.1.1.Final.tar.gz -C /usr/java
vi /etc/profile

#jboss conf
export JBOSS_HOME=/usr/java/jboss-as-7.1.1.Final

source /etc/profile

sh /usr/java/jboss-as-7.1.1.Final/bin/standalone.sh &
exit

ps -ef|grep jboss
kill -9 进程号

mkdir -p /usr/java/jboss-as-7.1.1.Final/modules/com/mysql/main
cd /usr/java/jboss-as-7.1.1.Final/modules/com/mysql/main
vi module.xml

<?xml version="1.0" encoding="UTF-8"?>
<module xmlns="urn:jboss:module:1.0" name="com.mysql">
	<resources>
		<resource-root path="mysql-connector-java-5.1.27.jar"/>
	</resources>
	<dependencies>
		<module name="javax.api"/>
		<module name="javax.transaction.api"/>
	</dependencies>
</module>

cp /usr/file/mysql-connector-java-5.1.27.jar ./

sh /usr/java/jboss-as-7.1.1.Final/bin/jboss-cli.sh -c

/subsystem=datasources/jdbc-driver=com.mysql.jdbc.Driver:add(driver-name=com.mysql.jdbc.Driver,driver-class-name=com.mysql.jdbc.Driver,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc.jdbc2.optional.MysqlXADataSource)
:reload

unzip /usr/file/ejbca_ce_6_3_1_1.zip -d /usr/java
cd /usr/java
mv ejbca_ce_6_3_1_1 ejbca-ce-6.3.1.1
cd /usr/java/ejbca-ce-6.3.1.1/conf/

mv ejbca.properties.sample ejbca.properties
vi ejbca.properties

appserver.home=/usr/java/jboss-as-7.1.1.Final
appserver.type=jboss

mv database.properties.sample database.properties
vi database.properties

# dataSource
datasource.jndi-name=jboss/datasources/MySqlDS
# mysql info
database.name=mysql
database.url=jdbc:mysql://127.0.0.1:3306/ejbca?characterEncoding=UTF-8
database.driver=com.mysql.jdbc.Driver
database.username=root
database.password=root

mv install.properties.sample install.properties
vi install.properties

#设置ca名称
ca.name=test
#设置ca信息
ca.dn=CN=test,O=test,C=cn

mv cesecore.properties.sample cesecore.properties
mv jaxws.properties.sample jaxws.properties

mv web.properties.sample web.properties
vi web.properties

#密码最好6位
superadmin.password=123456
superadmin.cn=superadmin
httpsserver.hostname=ca.test.com
httpsserver.dn=CN=${httpsserver.hostname},O=test,C=cn

cd /usr/java/ejbca-ce-6.3.1.1

ant clean deploy
ant install
ant deploy-keystore

sh /usr/java/jboss-as-7.1.1.Final/bin/jboss-cli.sh -c

/interface=http:add(inet-address="0.0.0.0")
/interface=httpspub:add(inet-address="0.0.0.0")
/interface=httpspriv:add(inet-address="0.0.0.0")
/socket-binding-group=standard-sockets/socket-binding=http:add(port="8080",interface="http")
/subsystem=undertow/server=default-server/http-listener=http:add(socket-binding=http)
/subsystem=undertow/server=default-server/http-listener=http:write-attribute(name=redirect-socket, value="httpspriv")
:reload

/core-service=management/security-realm=SSLRealm:add()
/core-service=management/security-realm=SSLRealm/server-identity=ssl:add(keystore-path="${jboss.server.config.dir}/keystore/keystore.jks", keystore-password="serverpwd", alias="prod-ica1")
/core-service=management/security-realm=SSLRealm/authentication=truststore:add(keystore-path="${jboss.server.config.dir}/keystore/truststore.jks", keystore-password="changeit")
/socket-binding-group=standard-sockets/socket-binding=httpspriv:add(port="8443",interface="httpspriv")
/socket-binding-group=standard-sockets/socket-binding=httpspub:add(port="8442", interface="httpspub")
:reload

/subsystem=undertow/server=default-server/https-listener=httpspriv:add(socket-binding=httpspriv, security-realm="SSLRealm", verify-client=REQUIRED)
/subsystem=undertow/server=default-server/https-listener=httpspub:add(socket-binding=httpspub, security-realm="SSLRealm")
:reload

/system-property=org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH:add(value=true)
/system-property=org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH:add(value=true)
/system-property=org.apache.catalina.connector.URI_ENCODING:add(value="UTF-8")
/system-property=org.apache.catalina.connector.USE_BODY_ENCODING_FOR_QUERY_STRING:add(value=true)
/subsystem=webservices:write-attribute(name=wsdl-host, value=jbossws.undefined.host)
/subsystem=webservices:write-attribute(name=modify-wsdl-address, value=true)
:reload

172.17.210.124 ca.test.com

https://ca.test.com:8443/ejbca/adminweb/

http://ca.test.com:8080/ejbca/

/usr/java/ejbca-ce-6.3.1.1/dist/ejbca-ws-cli/lib
/usr/java/ejbca-ce-6.3.1.1/dist/ejbca-ws-cli

public void init() {
	if (!new File(certPath).exists()) return;
	
	CryptoProviderTools.installBCProvider();

	System.setProperty("javax.net.ssl.trustStore", "d:/superadmin.jks");
	System.setProperty("javax.net.ssl.trustStorePassword", "123456");
	System.setProperty("javax.net.ssl.keyStore", "d:/superadmin.jks");
	System.setProperty("javax.net.ssl.keyStorePassword", "123456");

	QName qname = new QName("http://ws.protocol.core.ejbca.org/", "EjbcaWSService");

	try {
		EjbcaWSService service = new EjbcaWSService(new URL("https://ca.test.com:8443/ejbca/ejbcaws/ejbcaws?wsdl"), qname);
		EjbcaWS ejbcaWS = service.getEjbcaWSPort();
	} catch (Exception e) {
	}
}

172.17.210.124 ca.test.com

private boolean isExist(String username) throws Exception {
	UserMatch usermatch = new UserMatch();
	usermatch.setMatchwith(UserMatch.MATCH_WITH_USERNAME);
	usermatch.setMatchtype(UserMatch.MATCH_TYPE_EQUALS);
	usermatch.setMatchvalue(username);
	try {
		List<UserDataVOWS> users = ejbcaWS.findUser(usermatch);
		if (users != null && users.size() > 0) {
			return true;
		} else {
			return false;
		}
	} catch (Exception e) {
		throw new Exception("检查用户 " + username() + " 是否存在时出错：" + e.getMessage());
	}
}

public void editUser() throws Exception {
	UserDataVOWS userData = new UserDataVOWS();
	userData.setUsername("testname");//用户名
	userData.setPassword("123456");//密码
	userData.setClearPwd(false);//默认
	userData.setSubjectDN("CN=" + "testname"
			+ ",OU=" + "testou"
			+ ",O=" + "testo"
			+ ",C=cn"
			+ ",telephoneNumber=" + "1234567890"
			);//设置唯一甄别名

	String pattern = "yyyy-MM-dd HH:mm:ssZZ"; // ISO 8601标准时间格式
	userData.setStartTime(DateFormatUtils.format(new Date(),pattern));//证书有效起始日期
	userData.setEndTime(DateFormatUtils.format(DateUtils.addDays(new Date(), 100), pattern));//结束日期

	userData.setCaName("test");//ca名称，ejbca的名称
	userData.setSubjectAltName(null);
	userData.setEmail("test@test.com");//邮件地址
	userData.setStatus(UserDataVOWS.STATUS_NEW);//状态为new
	userData.setTokenType(UserDataVOWS.TOKEN_TYPE_P12);//设置p12格式证书
	userData.setEndEntityProfileName("user");//终端实体模板
	userData.setCertificateProfileName("user");//证书模板
	try {
		ejbcaWS.editUser(userData);
	} catch (Exception e) {
		throw new Exception(e.getMessage());
	}
}

public void revoke(String username) throws ServiceException {
	try {
		ejbcaWS.revokeUser(username, RevokedCertInfo.REVOCATION_REASON_UNSPECIFIED, false);
	} catch (Exception e) {
	}
}

private void createCert(String username, String password, String path) throws Exception {
	FileOutputStream fileOutputStream = null;
	try {
		// 创建证书文件
		KeyStore ksenv = ejbcaWS.pkcs12Req(username, password, null, "2048", AlgorithmConstants.KEYALGORITHM_RSA);
		java.security.KeyStore ks = KeyStoreHelper.getKeyStore(ksenv.getKeystoreData(), "PKCS12", password);
		fileOutputStream = new FileOutputStream(path + File.separator + username + ".p12");
		ks.store(fileOutputStream, password.toCharArray());

		// 创建密码文件
		File pwdFile = new File(path + File.separator + username + ".pwd");
		pwdFile.createNewFile();
		BufferedWriter out = new BufferedWriter(new FileWriter(pwdFile));
		out.write(password);
		out.flush();
		out.close();
	} catch (Exception e) {
		throw new Exception("用户  " + username + " 证书创建失败：" + e.getMessage());
	} finally {
		if (fileOutputStream != null) {
			try {
				fileOutputStream.close();
			} catch (IOException e) {
			}
		}
	}
}