RSA encryption : How to create “.arm” certificate file for Public key?

Question

I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption. I am currently able to generate the public key as ".key" file.

P.S I am new to encryption so, this may be a basic question.

Answer 1

Neither .arm nor .key are standard extensions. You should be more specific on who/what generated .key files and who/what is going to use .arm files.

I can only guess .arm refers to "ASCII armor" which is an old PGP jargon for Base64, a format where only 7-bit ASCII characters are used.

The PEM format is exactly that. Assuming .key files are DER encoded (binary), try to use openssl to covert your certificate to PEM format:

openssl x509 -inform der -in certificate.key -out certificate.arm

Answer 2

Have no fears on being new - you've hit on a weird one.

I swear I've seen *.arm used as an extension - but not often. Typically certificates (which include the public key as part of the data) are stored in either a binary (commonly called DER) or as ASCII (commonly called PEM). Most likely an *.arm certificate is one of those, hopefully without extra formatting.

Here's a quick rundown of the really common types of storage along with some command line instructions for one of the most common open source tools for certificate manipulation - OpenSSL.

It's probably worthwhile to ask what the consumer of this data will be, get access to the software or a test kit and run tests. You try a basic PEM or DER encoding and change the file type to *.arm just to see if it works. Given that this is non-standard, you may have to check back with the stakeholders who need this requirement to see if they can give you the format of this... sadly, you may end up developing it yourself - unless they can also give you an API for generating it...

Answer 3

Following code solved my problem.

import java.security.PrivateKey;

import java.security.PublicKey;

import com.dds.security.KeyCreator;

import com.dds.security.KeyReader;

import com.dds.security.SecurityUtil;
import java.io.*;

    import sun.security.x509.*;
    import java.security.cert.*;
    import java.security.*;
    import java.math.BigInteger;
    import java.nio.charset.Charset;
    import java.util.Date;
        /** 
         * Create a self-signed X.509 Certificate
         * @param dn the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
         * @param pair the KeyPair
         * @param days how many days from now the Certificate is valid for
         * @param algorithm the signing algorithm, eg "SHA1withRSA"
         */ 
        static X509Certificate generateCertificate(String dn, KeyPair pair, int days, String algorithm)
          throws GeneralSecurityException, IOException
        {
          PrivateKey privkey = pair.getPrivate();
          X509CertInfo info = new X509CertInfo();
          Date from = new Date();
          Date to = new Date(from.getTime() + days * 86400000l);
          CertificateValidity interval = new CertificateValidity(from, to);
          BigInteger sn = new BigInteger(64, new SecureRandom());
          X500Name owner = new X500Name(dn);

          info.set(X509CertInfo.VALIDITY, interval);
          info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn));
          info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner));
          info.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner));
          info.set(X509CertInfo.KEY, new CertificateX509Key(pair.getPublic()));
          info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3));

          AlgorithmId algo = new AlgorithmId(AlgorithmId.sha1WithRSAEncryption_oid);
          info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo));

          // Sign the cert to identify the algorithm that's used.
          X509CertImpl cert = new X509CertImpl(info);
          cert.sign(privkey, algorithm);

          // Update the algorith, and resign.
          algo = (AlgorithmId)cert.get(X509CertImpl.SIG_ALG);
          info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo);
          cert = new X509CertImpl(info);
          cert.sign(privkey, algorithm);
          return cert;
        }   


        // This method writes a certificate to a file. If binary is false, the
        // certificate is base64 encoded.
        public static void export(java.security.cert.Certificate cert, File file, boolean binary) throws IOException {

          System.out.println("Your file has been written");  
            try {
                // Get the encoded form which is suitable for exporting
                byte[] buf = cert.getEncoded();

                FileOutputStream os = new FileOutputStream(file);
                if (binary) {
                    // Write in binary form
                    os.write(buf);
                } else {
                    // Write in text form
                    Writer wr = new OutputStreamWriter(os, Charset.forName("UTF-8"));
                    wr.write("-----BEGIN CERTIFICATE-----\n");
                    wr.write(new sun.misc.BASE64Encoder().encode(buf));
                    wr.write("\n-----END CERTIFICATE-----\n");
                    wr.flush();
                }
                os.close();
            } catch (CertificateEncodingException e) {
            } catch (IOException e) {
            }
        }

        }