如何在Android中生成临时TLS密钥和证书(无KeyStore)

在Android中生成临时TLS密钥和证书的方式可以通过使用Bouncy Castle库来实现。下面是一个简单的步骤：

首先，确保你的Android项目中已经引入了Bouncy Castle库。你可以在项目的build.gradle文件中添加以下依赖：

implementation 'org.bouncycastle:bcpkix-jdk15on:1.68'
implementation 'org.bouncycastle:bcprov-jdk15on:1.68'

创建一个类来生成临时TLS密钥和证书：

import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.crypto.util.PrivateKeyFactory;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemWriter;

import java.io.File;
import java.io.FileOutputStream;
import java.io.OutputStreamWriter;
import java.math.BigInteger;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.Security;
import java.security.cert.X509Certificate;
import java.time.LocalDate;
import java.time.ZoneOffset;
import java.util.Date;

public class TLSCertificateGenerator {

    private static final String ALGORITHM = "RSA";
    private static final int KEY_SIZE = 2048;
    private static final String SIGNATURE_ALGORITHM = "SHA256WithRSA";

    public static void main(String[] args) {
        try {
            Security.addProvider(new BouncyCastleProvider());

            // Generate key pair
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(ALGORITHM, "BC");
            keyPairGenerator.initialize(KEY_SIZE);
            KeyPair keyPair = keyPairGenerator.generateKeyPair();

            // Generate certificate
            X509CertificateHolder certHolder = generateCertificate(keyPair);

            // Save private key
            File privateKeyFile = new File("privatekey.pem");
            try (PemWriter pemWriter = new PemWriter(new OutputStreamWriter(new FileOutputStream(privateKeyFile)))) {
                pemWriter.writeObject(new PemObject("RSA PRIVATE KEY", keyPair.getPrivate().getEncoded()));
            }

            // Save public key
            File publicKeyFile = new File("publickey.pem");
            try (PemWriter pemWriter = new PemWriter(new OutputStreamWriter(new FileOutputStream(publicKeyFile)))) {
                pemWriter.writeObject(new PemObject("RSA PUBLIC KEY", keyPair.getPublic().getEncoded()));
            }

            // Save certificate
            File certificateFile = new File("certificate.pem");
            try (PemWriter pemWriter = new PemWriter(new OutputStreamWriter(new FileOutputStream(certificateFile)))) {
                pemWriter.writeObject(new PemObject("CERTIFICATE", certHolder.getEncoded()));
            }

            System.out.println("TLS key pair and certificate generated successfully.");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static X509CertificateHolder generateCertificate(KeyPair keyPair) throws Exception {
        X500Name issuer = new X500Name("CN=Test");
        BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
        Date notBefore = Date.from(LocalDate.now().atStartOfDay(ZoneOffset.UTC).toInstant());
        Date notAfter = Date.from(LocalDate.now().plusYears(1).atStartOfDay(ZoneOffset.UTC).toInstant());

        JcaX509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(
                issuer, serial, notBefore, notAfter, issuer, keyPair.getPublic());

        ContentSigner contentSigner = new JcaContentSignerBuilder(SIGNATURE_ALGORITHM).build(keyPair.getPrivate());

        return certBuilder.build(contentSigner);
    }
}