还行。。。我想做同样的事情，对于我的生活，我不知道该怎么做。API 都讨论生成密钥对，然后生成证书，而不是如何对 CSR 进行签名。不知何故，很偶然 - 这是我发现的。
由于 PKCS10 表示请求（CSR）的格式，因此您首先需要将 CSR 放入 PKCS10Holder 中。然后，将其传递给 CertificateBuilder（因为 CertificateGenerator 已被弃用）。传递它的方式是在持有者上调用 getSubject。
这是代码（Java，请根据需要进行调整）：
public static X509Certificate sign(PKCS10CertificationRequest inputCSR, PrivateKey caPrivate, KeyPair pair)
throws InvalidKeyException, NoSuchAlgorithmException,
NoSuchProviderException, SignatureException, IOException,
OperatorCreationException, CertificateException {
AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder()
.find("SHA1withRSA");
AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder()
.find(sigAlgId);
AsymmetricKeyParameter foo = PrivateKeyFactory.createKey(caPrivate
.getEncoded());
SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(pair
.getPublic().getEncoded());
PKCS10CertificationRequestHolder pk10Holder = new PKCS10CertificationRequestHolder(inputCSR);
//in newer version of BC such as 1.51, this is
//PKCS10CertificationRequest pk10Holder = new PKCS10CertificationRequest(inputCSR);
X509v3CertificateBuilder myCertificateGenerator = new X509v3CertificateBuilder(
new X500Name("CN=issuer"), new BigInteger("1"), new Date(
System.currentTimeMillis()), new Date(
System.currentTimeMillis() + 30 * 365 * 24 * 60 * 60
* 1000), pk10Holder.getSubject(), keyInfo);
ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
.build(foo);
X509CertificateHolder holder = myCertificateGenerator.build(sigGen);
X509CertificateStructure eeX509CertificateStructure = holder.toASN1Structure();
//in newer version of BC such as 1.51, this is
//org.spongycastle.asn1.x509.Certificate eeX509CertificateStructure = holder.toASN1Structure();
CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
// Read Certificate
InputStream is1 = new ByteArrayInputStream(eeX509CertificateStructure.getEncoded());
X509Certificate theCert = (X509Certificate) cf.generateCertificate(is1);
is1.close();
return theCert;
//return null;
}
如您所见，我已经在此方法之外生成了请求，但将其传入。然后，我有PKCS10CertificationRequestHolder接受它作为构造函数arg。
接下来，在 X509v3CertificateBuilder 参数中，您将看到 pk10Holder.getSubject - 这显然是您所需要的全部？如果缺少某些内容，也请告诉我!!!它对我有用。我正确生成的证书具有我需要的 DN 信息。
维基百科上有一个关于PKCS的杀手部分 - http://en.wikipedia.org/wiki/PKCS
