// add the extensions
//
v3CertGen.addExtension(
X509Extensions.SubjectKeyIdentifier,
false,
new SubjectKeyIdentifierStructure(pubKey));
v3CertGen.addExtension(
X509Extensions.AuthorityKeyIdentifier,
false,
new AuthorityKeyIdentifierStructure(caPubKey));
X509Certificate cert = v3CertGen.generateX509Certificate(caPrivKey);
cert.checkValidity(new Date());
cert.verify(caPubKey);
PKCS12BagAttributeCarrier bagAttr = (PKCS12BagAttributeCarrier)cert;
//
// this is also optional - in the sense that if you leave this
// out the keystore will add it automatically, note though that
// for the browser to recognise the associated private key this
// you should at least use the pkcs_9_localKeyId OID and set it
// to the same as you do for the private key's localKeyId.
//
bagAttr.setBagAttribute(
PKCSObjectIdentifiers.pkcs_9_at_friendlyName,
new DERBMPString("Eric's Key"));
bagAttr.setBagAttribute(
PKCSObjectIdentifiers.pkcs_9_at_localKeyId,
new SubjectKeyIdentifierStructure(pubKey));
return cert;
}