X509V1CertificateGenerator emigrate to X509v1CertificateBuilder

Question

Hello I am using the class X509V1CertificateGenerator to generate a certificate of the type X509Certificate. now the class X509V1CertificateGenerator is deprecated and the recommanded alternative is X509v1CertificateBuilder but I do not know how to do the Migration.

Here is the Code:

X509V1CertificateGenerator certGen = new X509V1CertificateGenerator();

// set the necessary X500-fields
X500Principal dnName = new X500Principal("CN=MyServerName");
certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
certGen.setIssuerDN(dnName);

// expire-date
Calendar expireDate = Calendar.getInstance();
certGen.setNotBefore(expireDate.getTime());

// expires in 25 years
expireDate.add(Calendar.YEAR, 25);
certGen.setNotAfter(expireDate.getTime());

certGen.setSubjectDN(dnName); // note: same as issuer
certGen.setPublicKey(pair.getPublic());

// set the right signature-algorithm ->RSA/DSA
if (this.algorithm)
    certGen.setSignatureAlgorithm("MD5withRSA");
else
    certGen.setSignatureAlgorithm("SHA1withDSA");

// generate the X509-certificate
X509Certificate cert = certGen.generate(pair.getPrivate(), "BC");

What should I do to do the Migration?

Answer 1

Try this extracted from keycloak CertificateUtils

SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(pair.getPublic().getEncoded());
X509v1CertificateBuilder builder = new X509v1CertificateBuilder(
       subjectDN, 
       serialNumber, 
       validityStartDate,
       validityEndDate, 
       subjectDN, 
       subPubKeyInfo);

AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(signatureAlgorithm); 
AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId); 
ContentSigner contentSigner = 
      new BcRSAContentSignerBuilder(sigAlgId, digAlgId)                   
               .build(PrivateKeyFactory.createKey(pair.getPrivate().getEncoded())); 

X509CertificateHolder holder = builder.build(contentSigner);

X509Certificate cert = JcaX509CertificateConverter().getCertificate(holder);