Example usage for org.bouncycastle.x509 X509V3CertificateGenerator setSerialNumber

List of usage examples for org.bouncycastle.x509 X509V3CertificateGenerator setSerialNumber

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.x509.*
  5. X509V3CertificateGenerator
  6. setSerialNumber

Introduction

In this page you can find the example usage for org.bouncycastle.x509 X509V3CertificateGenerator setSerialNumber.

Prototype

public void setSerialNumber(BigInteger serialNumber)

Source Link

Document

set the serial number for the certificate.

Usage

From source file:org.apache.kerby.pkix.IntermediateCaGenerator.java

License:Apache License

/**
 * Create certificate./*from w w w . ja v a  2 s  .c  om*/
 *
 * @param issuerCert
 * @param issuerPrivateKey
 * @param publicKey
 * @param dn
 * @param validityDays
 * @param friendlyName
 * @return The certificate.
 * @throws InvalidKeyException
 * @throws SecurityException
 * @throws SignatureException
 * @throws NoSuchAlgorithmException
 * @throws DataLengthException
 * @throws CertificateException
 */
public static X509Certificate generate(X509Certificate issuerCert, PrivateKey issuerPrivateKey,
        PublicKey publicKey, String dn, int validityDays, String friendlyName)
        throws InvalidKeyException, SecurityException, SignatureException, NoSuchAlgorithmException,
        DataLengthException, CertificateException {
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    // Set certificate attributes.
    certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));

    certGen.setIssuerDN(PrincipalUtil.getSubjectX509Principal(issuerCert));
    certGen.setSubjectDN(new X509Principal(dn));

    certGen.setNotBefore(new Date());

    Calendar expiry = Calendar.getInstance();
    expiry.add(Calendar.DAY_OF_YEAR, validityDays);

    certGen.setNotAfter(expiry.getTime());

    certGen.setPublicKey(publicKey);
    certGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifier(getDigest(SubjectPublicKeyInfo.getInstance(publicKey.getEncoded()))));

    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(0));

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(issuerCert));

    certGen.addExtension(X509Extensions.KeyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

    X509Certificate cert = certGen.generate(issuerPrivateKey);

    PKCS12BagAttributeCarrier bagAttr = (PKCS12BagAttributeCarrier) cert;

    bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_friendlyName, new DERBMPString(friendlyName));
    bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_localKeyId,
            new SubjectKeyIdentifier(getDigest(SubjectPublicKeyInfo.getInstance(publicKey.getEncoded()))));

    return cert;
}

From source file:org.apache.kerby.pkix.TrustAnchorGenerator.java

License:Apache License

/**
 * Create CA certificate.//from  w  ww .  j a  v  a 2 s  .  c  o  m
 *
 * @param publicKey
 * @param privateKey
 * @param dn
 * @param validityDays
 * @param friendlyName
 * @return The certificate.
 * @throws InvalidKeyException
 * @throws SecurityException
 * @throws SignatureException
 * @throws NoSuchAlgorithmException
 * @throws DataLengthException
 * @throws CertificateException
 */
public static X509Certificate generate(PublicKey publicKey, PrivateKey privateKey, String dn, int validityDays,
        String friendlyName) throws InvalidKeyException, SecurityException, SignatureException,
        NoSuchAlgorithmException, DataLengthException, CertificateException {
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    // Set certificate attributes.
    certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));

    X509Principal x509Principal = new X509Principal(dn);
    certGen.setIssuerDN(x509Principal);
    certGen.setSubjectDN(x509Principal);

    certGen.setNotBefore(new Date());

    Calendar expiry = Calendar.getInstance();
    expiry.add(Calendar.DAY_OF_YEAR, validityDays);

    certGen.setNotAfter(expiry.getTime());

    certGen.setPublicKey(publicKey);
    certGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifier(getDigest(SubjectPublicKeyInfo.getInstance(publicKey.getEncoded()))));

    certGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(1));

    certGen.addExtension(X509Extensions.KeyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));

    X509Certificate cert = certGen.generate(privateKey);

    PKCS12BagAttributeCarrier bagAttr = (PKCS12BagAttributeCarrier) cert;

    bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_friendlyName, new DERBMPString(friendlyName));
    bagAttr.setBagAttribute(PKCSObjectIdentifiers.pkcs_9_at_localKeyId,
            new SubjectKeyIdentifier(getDigest(SubjectPublicKeyInfo.getInstance(publicKey.getEncoded()))));

    return cert;
}

From source file:org.apache.synapse.transport.certificatevalidation.Utils.java

License:Apache License

/**
 * CRLVerifierTest and OCSPVerifierTest both will use this method. This has common code for both test classes
 * in creating fake peer certificates.//from   w  w  w. j a va  2 s .  c om
 * @param caCert Certificate of CA which signs the peer certificate which will be generated.
 * @param peerPublicKey public key of the peer certificate which will be generated.
 * @param serialNumber  serial number of the peer certificate.
 * @return
 */
public X509V3CertificateGenerator getUsableCertificateGenerator(X509Certificate caCert, PublicKey peerPublicKey,
        BigInteger serialNumber) {
    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    certGen.setSerialNumber(serialNumber);
    certGen.setIssuerDN(caCert.getSubjectX500Principal());
    certGen.setNotBefore(new Date(System.currentTimeMillis()));
    certGen.setNotAfter(new Date(System.currentTimeMillis() + TestConstants.VALIDITY_PERIOD));
    certGen.setSubjectDN(new X500Principal("CN=Test End Certificate"));
    certGen.setPublicKey(peerPublicKey);
    certGen.setSignatureAlgorithm("SHA1WithRSAEncryption");

    return certGen;
}

From source file:org.atticfs.key.KeyUtils.java

License:Apache License

public static X509Certificate createSignedCertificate(KeyPair keyPair, PrivateKey caKey, X509Certificate caCert,
        String dn, int days) throws Exception {
    Date startDate = new Date();
    Calendar cal = Calendar.getInstance();
    cal.add(Calendar.DAY_OF_YEAR, days);

    Date expiryDate = cal.getTime();
    BigInteger serialNumber = randomHexInteger(64);

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
    X500Principal subjectName = new X500Principal(dn);

    certGen.setSerialNumber(serialNumber);
    certGen.setIssuerDN(caCert.getSubjectX500Principal());
    certGen.setNotBefore(startDate);//w w w.  j  ava2s  .  c  o m
    certGen.setNotAfter(expiryDate);

    certGen.setSubjectDN(subjectName);
    certGen.setPublicKey(keyPair.getPublic());
    certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifierStructure(keyPair.getPublic()));

    X509Certificate cert = certGen.generate(caKey, providerName); // note: private key of CA
    return cert;
}

From source file:org.browsermob.proxy.selenium.CertificateCreator.java

License:Open Source License

/**
 * This method creates an X509v3 certificate based on an an existing certificate.
 * It attempts to create as faithful a copy of the existing certificate as possible
 * by duplicating all certificate extensions.
 *
 * If you are testing an application that makes use of additional certificate
 * extensions (e.g. logotype, S/MIME capabilities) this method will preserve those
 * fields./*from www . ja  v  a2  s.c om*/
 *
 * You may optionally include a set of OIDs not to copy from the original certificate.
 * The most common reason to do this would be to remove fields that would cause inconsistency,
 * such as Authority Info Access or Issuer Alternative Name where these are not defined for
 * the MITM authority certificate.
 *
 * OIDs 2.5.29.14 : Subject Key Identifier and 2.5.29.35 : Authority Key Identifier,
 * are never copied, but generated directly based on the input keys and certificates.
 *
 * You may also optionally include maps of custom extensions which will be added to or replace
 * extensions with the same OID on the original certificate for the the MITM certificate.
 *
 * FUTURE WORK: JDK 1.5 is very strict in parsing extensions.  In particular, known extensions
 * that include URIs must parse to valid URIs (including URL encoding all non-valid URI characters)
 * or the extension will be rejected and not available to copy to the MITM certificate.  Will need
 * to directly extract these as ASN.1 fields and re-insert (hopefully BouncyCastle will handle them)
 *
 *
 * @param originalCert  The original certificate to duplicate.
 * @param newPubKey     The new public key for the MITM certificate.
 * @param caCert        The certificate of the signing authority fot the MITM certificate.
 * @param caPrivateKey  The private key of the signing authority.
 * @param extensionOidsNotToCopy  An optional list of certificate extension OIDs not to copy to the MITM certificate.
 * @param criticalCustomExtensions An optional map of critical extension OIDs to add/replace on the MITM certificate.
 * @param noncriticalCustomExtensions An optional map of non-critical extension OIDs to add/replace on the MITM certificate.
 * @return The new MITM certificate.
 * @throws CertificateParsingException
 * @throws SignatureException
 * @throws InvalidKeyException
 * @throws CertificateExpiredException
 * @throws CertificateNotYetValidException
 * @throws CertificateException
 * @throws NoSuchAlgorithmException
 * @throws NoSuchProviderException
 */
public static X509Certificate mitmDuplicateCertificate(final X509Certificate originalCert,
        final PublicKey newPubKey, final X509Certificate caCert, final PrivateKey caPrivateKey,
        Set<String> extensionOidsNotToCopy, Map<String, DEREncodable> criticalCustomExtensions,
        Map<String, DEREncodable> noncriticalCustomExtensions)
        throws CertificateParsingException, SignatureException, InvalidKeyException, CertificateException,
        NoSuchAlgorithmException, NoSuchProviderException {
    if (extensionOidsNotToCopy == null) {
        extensionOidsNotToCopy = new HashSet<String>();
    }
    if (noncriticalCustomExtensions == null) {
        noncriticalCustomExtensions = new HashMap<String, DEREncodable>();
    }
    if (criticalCustomExtensions == null) {
        criticalCustomExtensions = new HashMap<String, DEREncodable>();
    }

    X509V3CertificateGenerator v3CertGen = new X509V3CertificateGenerator();

    v3CertGen.setSubjectDN(originalCert.getSubjectX500Principal());
    v3CertGen.setSignatureAlgorithm(CertificateCreator.SIGN_ALGO); // needs to be the same as the signing cert, not the copied cert
    v3CertGen.setPublicKey(newPubKey);
    v3CertGen.setNotAfter(originalCert.getNotAfter());
    v3CertGen.setNotBefore(originalCert.getNotBefore());
    v3CertGen.setIssuerDN(caCert.getSubjectX500Principal());
    v3CertGen.setSerialNumber(originalCert.getSerialNumber());

    // copy other extensions:
    Set<String> critExts = originalCert.getCriticalExtensionOIDs();

    // get extensions returns null, not an empty set!
    if (critExts != null) {
        for (String oid : critExts) {
            if (!clientCertOidsNeverToCopy.contains(oid) && !extensionOidsNotToCopy.contains(oid)
                    && !criticalCustomExtensions.containsKey(oid)) {
                v3CertGen.copyAndAddExtension(new DERObjectIdentifier(oid), true, originalCert);
            }
        }
    }
    Set<String> nonCritExs = originalCert.getNonCriticalExtensionOIDs();

    if (nonCritExs != null) {
        for (String oid : nonCritExs) {

            if (!clientCertOidsNeverToCopy.contains(oid) && !extensionOidsNotToCopy.contains(oid)
                    && !noncriticalCustomExtensions.containsKey(oid)) {
                v3CertGen.copyAndAddExtension(new DERObjectIdentifier(oid), false, originalCert);
            }
        }
    }

    for (Map.Entry<String, DEREncodable> customExtension : criticalCustomExtensions.entrySet()) {
        v3CertGen.addExtension(customExtension.getKey(), true, customExtension.getValue());
    }

    for (Map.Entry<String, DEREncodable> customExtension : noncriticalCustomExtensions.entrySet()) {
        v3CertGen.addExtension(customExtension.getKey(), false, customExtension.getValue());
    }

    v3CertGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifierStructure(newPubKey));

    v3CertGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert.getPublicKey()));

    X509Certificate cert = v3CertGen.generate(caPrivateKey, "BC");

    // For debugging purposes.
    //cert.checkValidity(new Date());
    //cert.verify(caCert.getPublicKey());

    return cert;
}

From source file:org.browsermob.proxy.selenium.CertificateCreator.java

License:Open Source License

/**
 * Creates a typical Certification Authority (CA) certificate.
 * @param keyPair/*from   w w w  . j  a v a 2 s .c o m*/
 * @throws SecurityException
 * @throws InvalidKeyException
 * @throws NoSuchProviderException
 * @throws NoSuchAlgorithmException
 * @throws CertificateException
 */
@SuppressWarnings("deprecation")
public static X509Certificate createTypicalMasterCert(final KeyPair keyPair)
        throws SignatureException, InvalidKeyException, SecurityException, CertificateException,
        NoSuchAlgorithmException, NoSuchProviderException {

    X509V3CertificateGenerator v3CertGen = new X509V3CertificateGenerator();

    X509Principal issuer = new X509Principal(
            "O=CyberVillians.com,OU=CyberVillians Certification Authority,C=US");

    // Create
    v3CertGen.setSerialNumber(BigInteger.valueOf(1));
    v3CertGen.setIssuerDN(issuer);
    v3CertGen.setSubjectDN(issuer);

    //Set validity period
    v3CertGen
            .setNotBefore(new Date(System.currentTimeMillis() - 12 /* months */ * (1000L * 60 * 60 * 24 * 30)));
    v3CertGen.setNotAfter(new Date(System.currentTimeMillis() + 48 /* months */ * (1000L * 60 * 60 * 24 * 30)));

    //Set signature algorithm & public key
    v3CertGen.setPublicKey(keyPair.getPublic());
    v3CertGen.setSignatureAlgorithm(CertificateCreator.SIGN_ALGO);

    // Add typical extensions for signing cert
    v3CertGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            new SubjectKeyIdentifierStructure(keyPair.getPublic()));

    v3CertGen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(0));

    v3CertGen.addExtension(X509Extensions.KeyUsage, false,
            new KeyUsage(KeyUsage.cRLSign | KeyUsage.keyCertSign));

    DEREncodableVector typicalCAExtendedKeyUsages = new DEREncodableVector();

    typicalCAExtendedKeyUsages.add(new DERObjectIdentifier(ExtendedKeyUsageConstants.serverAuth));
    typicalCAExtendedKeyUsages.add(new DERObjectIdentifier(ExtendedKeyUsageConstants.OCSPSigning));
    typicalCAExtendedKeyUsages.add(new DERObjectIdentifier(ExtendedKeyUsageConstants.verisignUnknown));

    v3CertGen.addExtension(X509Extensions.ExtendedKeyUsage, false, new DERSequence(typicalCAExtendedKeyUsages));

    X509Certificate cert = v3CertGen.generate(keyPair.getPrivate(), "BC");

    cert.checkValidity(new Date());

    cert.verify(keyPair.getPublic());

    return cert;
}

From source file:org.candlepin.controller.CrlGeneratorTest.java

License:Open Source License

private static X509Certificate generateCertificate() {
    X500Principal principal = new X500Principal(generateFakePrincipal());
    X509V3CertificateGenerator gen = new X509V3CertificateGenerator();
    gen.setSerialNumber(BigInteger.TEN);
    gen.setNotBefore(Util.yesterday());
    gen.setNotAfter(Util.getFutureDate(2));
    gen.setSubjectDN(principal);//ww w  .  j  av a 2s. c  om
    gen.setIssuerDN(principal);
    gen.setPublicKey(KP.getPublic());
    gen.setSignatureAlgorithm("SHA1WITHRSA");
    try {
        return gen.generate(KP.getPrivate());
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

From source file:org.candlepin.pki.impl.BouncyCastlePKIUtility.java

License:Open Source License

@Override
public X509Certificate createX509Certificate(String dn, Set<X509ExtensionWrapper> extensions,
        Set<X509ByteExtensionWrapper> byteExtensions, Date startDate, Date endDate, KeyPair clientKeyPair,
        BigInteger serialNumber, String alternateName) throws GeneralSecurityException, IOException {

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
    X509Certificate caCert = reader.getCACert();
    // set cert fields
    certGen.setSerialNumber(serialNumber);
    certGen.setIssuerDN(caCert.getSubjectX500Principal());
    certGen.setNotBefore(startDate);/*from w ww  . java  2 s .  co m*/
    certGen.setNotAfter(endDate);

    X500Principal subjectPrincipal = new X500Principal(dn);
    certGen.setSubjectDN(subjectPrincipal);
    certGen.setPublicKey(clientKeyPair.getPublic());
    certGen.setSignatureAlgorithm(SIGNATURE_ALGO);

    // set key usage - required for proper x509 function
    KeyUsage keyUsage = new KeyUsage(
            KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment);

    // add SSL extensions - required for proper x509 function
    NetscapeCertType certType = new NetscapeCertType(NetscapeCertType.sslClient | NetscapeCertType.smime);

    certGen.addExtension(MiscObjectIdentifiers.netscapeCertType.toString(), false, certType);
    certGen.addExtension(X509Extensions.KeyUsage.toString(), false, keyUsage);

    certGen.addExtension(X509Extensions.AuthorityKeyIdentifier, false,
            new AuthorityKeyIdentifierStructure(caCert));
    certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
            subjectKeyWriter.getSubjectKeyIdentifier(clientKeyPair, extensions));
    certGen.addExtension(X509Extensions.ExtendedKeyUsage, false,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));

    // Add an alternate name if provided
    if (alternateName != null) {
        GeneralName name = new GeneralName(GeneralName.uniformResourceIdentifier, "CN=" + alternateName);
        certGen.addExtension(X509Extensions.SubjectAlternativeName, false, new GeneralNames(name));
    }

    if (extensions != null) {
        for (X509ExtensionWrapper wrapper : extensions) {
            // Bouncycastle hates null values. So, set them to blank
            // if they are null
            String value = wrapper.getValue() == null ? "" : wrapper.getValue();
            certGen.addExtension(wrapper.getOid(), wrapper.isCritical(), new DERUTF8String(value));
        }
    }

    if (byteExtensions != null) {
        for (X509ByteExtensionWrapper wrapper : byteExtensions) {
            // Bouncycastle hates null values. So, set them to blank
            // if they are null
            byte[] value = wrapper.getValue() == null ? new byte[0] : wrapper.getValue();
            certGen.addExtension(wrapper.getOid(), wrapper.isCritical(), new DEROctetString(value));
        }
    }

    // Generate the certificate
    return certGen.generate(reader.getCaKey());
}

From source file:org.conscrypt.java.security.cert.CertificateFactoryTest.java

License:Apache License

@SuppressWarnings("deprecation")
private static KeyHolder generateCertificate(boolean isCa, KeyHolder issuer) throws Exception {
    Date startDate = new Date();

    GregorianCalendar cal = new GregorianCalendar();
    cal.setTimeZone(TimeZone.getTimeZone("UTC"));
    cal.set(2100, 0, 1, 0, 0, 0); // Jan 1, 2100 UTC
    Date expiryDate = cal.getTime();

    KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
    KeyPair keyPair = kpg.generateKeyPair();

    BigInteger serial;/*w  ww . ja  v  a 2s  . com*/
    X500Principal issuerPrincipal;
    X500Principal subjectPrincipal;
    PrivateKey caKey;
    if (issuer != null) {
        serial = issuer.certificate.getSerialNumber().add(BigInteger.ONE);
        subjectPrincipal = new X500Principal("CN=Test Certificate Serial #" + serial.toString());
        issuerPrincipal = issuer.certificate.getSubjectX500Principal();
        caKey = issuer.privateKey;
    } else {
        serial = BigInteger.ONE;
        subjectPrincipal = new X500Principal("CN=Test CA, O=Tests, C=US");
        issuerPrincipal = subjectPrincipal;
        caKey = keyPair.getPrivate();
    }

    BasicConstraints basicConstraints;
    if (isCa) {
        basicConstraints = new BasicConstraints(10 - serial.intValue());
    } else {
        basicConstraints = new BasicConstraints(false);
    }

    X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();

    PublicKey pubKey = keyPair.getPublic();
    certGen.setSerialNumber(serial);
    certGen.setIssuerDN(issuerPrincipal);
    certGen.setNotBefore(startDate);
    certGen.setNotAfter(expiryDate);
    certGen.setSubjectDN(subjectPrincipal);
    certGen.setPublicKey(pubKey);
    certGen.setSignatureAlgorithm("SHA1withRSA");

    if (issuer != null) {
        certGen.addExtension(Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifierStructure(issuer.certificate));
    } else {
        certGen.addExtension(Extension.authorityKeyIdentifier, false,
                new AuthorityKeyIdentifier(generatePublicKeyDigest(pubKey)));
    }

    certGen.addExtension(Extension.subjectKeyIdentifier, false,
            new SubjectKeyIdentifier(generatePublicKeyDigest(pubKey)));
    certGen.addExtension(Extension.basicConstraints, true, basicConstraints);

    X509Certificate cert = certGen.generate(caKey);

    KeyHolder holder = new KeyHolder();
    holder.certificate = cert;
    holder.privateKey = keyPair.getPrivate();

    return holder;
}

From source file:org.deviceconnect.android.ssl.AbstractKeyStoreManager.java

License:MIT License

private X509Certificate generateX509V3Certificate(final KeyPair keyPair, final X500Principal subject,
        final X500Principal issuer, final Date notBefore, final Date notAfter, final BigInteger serialNumber,
        final GeneralNames generalNames, final boolean isCA) throws GeneralSecurityException {
    Security.addProvider(new BouncyCastleProvider());
    X509V3CertificateGenerator generator = new X509V3CertificateGenerator();
    generator.setSerialNumber(serialNumber);
    generator.setIssuerDN(issuer);/* ww  w . j a v a2s .c  o m*/
    generator.setSubjectDN(subject);
    generator.setNotBefore(notBefore);
    generator.setNotAfter(notAfter);
    generator.setPublicKey(keyPair.getPublic());
    generator.setSignatureAlgorithm("SHA256WithRSAEncryption");
    generator.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(isCA));
    generator.addExtension(X509Extensions.KeyUsage, true, new KeyUsage(160));
    generator.addExtension(X509Extensions.ExtendedKeyUsage, true,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
    if (generalNames != null) {
        generator.addExtension(X509Extensions.SubjectAlternativeName, false, generalNames);
    }
    return generator.generateX509Certificate(keyPair.getPrivate(), "BC");
}