Problem with creating a third party signed x509 certificate

Question

Dear all
I'm working on pki project, in which i need to generate a key pair and and using it to create a self-signed x509 certificate, it will act as the CA and using it private key to sign all other x509 certificate, I have no problem on creating the self-signed cert, but when try to create other cert using CA private, I got the following exception
Caught exception: java.security.InvalidKeyException: Public key presented not for certificate signature
I'm using bouncycastle to do the cert generation, here is an example of my code
   Security.addProvider(new BouncyCastleProvider());
   //be sign key pair
   KeyPairGenerator keyGen=KeyPairGenerator.getInstance("DSA");
   keyGen.initialize(1024, new SecureRandom());
   KeyPair keypair=keyGen.generateKeyPair();
   PrivateKey prikey=keypair.getPrivate();
   PublicKey pubkey=keypair.getPublic();
   //ca key pair
   KeyPair cakeypair=keyGen.generateKeyPair();
   PrivateKey caprikey=cakeypair.getPrivate();
   PublicKey capubkey=cakeypair.getPublic();
   Hashtable attrs = new Hashtable();
   attrs.put(X509Principal.CN, "Test");
   //generate cert
   X509V3CertificateGenerator certGen=new X509V3CertificateGenerator();
   certGen.setSerialNumber(BigInteger.valueOf(1));
   certGen.setIssuerDN(new X509Principal(attrs ));
   certGen.setNotBefore(new Date(System.currentTimeMillis() - 50000));
   certGen.setNotAfter(new Date(System.currentTimeMillis() + 50000));
   certGen.setSubjectDN(new X509Principal(attrs));
   certGen.setPublicKey(pubkey);
   //certGen.setSignatureAlgorithm("MD5WithDSAEncryption");
   certGen.setSignatureAlgorithm("SHA1withDSA");
   X509Certificate cert=certGen.generateX509Certificate(caprikey);
   cert.checkValidity(new Date());
   cert.verify(pubkey);
   Set dummySet=cert.getNonCriticalExtensionOIDs();
   dummySet=cert.getNonCriticalExtensionOIDs();I have no idea what problem is
I hope that bouncycastle supporter or anyone could help me or give some guidance and I'm much appreciate that.

Answer 1

Hi tkfi
your problem is you'er not using the ca public key to do the verification, replace the
cert.verify(pubkey);
to
cert.verify(capubkey);
and it should be work