bouncycastle - How to create a .crt store file containing a certificate chain from a PKCS12 one?

Question

I have a PKCS12 file containing a certificate chain and a private key. I would like to use BouncyCastle to create a CRT file with that cert chain, the same way we can do using OpenSSL command-line tool:

openssl pkcs12 -in [yourfilename.pfx] -clcerts -nokeys -out [certificatename.crt]

I was already able to load the pkcs12 Keystore and obtain the certificates:

Certificate[] certs = pKeyStore.getCertificateChain(pAlias);

But I wasn't able to find a store builder for a CRT file that could accept the array of certificates above...

question from:https://stackoverflow.com/questions/65903364/how-to-create-a-crt-store-file-containing-a-certificate-chain-from-a-pkcs12-one

Answer 1

The class you are looking for is org.bouncycastle.openssl.jcajce.JcaPEMWriter in bcpkix. You can use its write method to encode all sorts of JCE interfaces (X509Certificate, X509CRL, PublicKey, PrivateKey, KeyPair) to a PEM file.

In your case:

final JcaPEMWriter pemWriter = new JcaPEMWriter(System.out);
for (final Certificate cert : certs) {
    pemWriter.write(cert);
}