save

src/main/java/com/cisd/tms/modules/cert/support/CertUtil.java

@@ -42,12 +42,12 @@ public class CertUtil {
         return (X509Certificate) CF.generateCertificate(new ByteArrayInputStream(certificateString.getBytes()));  // 将文件流的证书转化为证书类
     }
 
-    public static String convertToPem(String cert) throws CertificateEncodingException {
+    public static String convertToPem(X509Certificate cert) throws CertificateEncodingException {
 
         String cert_begin = "-----BEGIN CERTIFICATE-----\n";
         String end_cert = "\n-----END CERTIFICATE-----";
 
-        byte[] derCert = cert.getBytes();
+        byte[] derCert = cert.getEncoded();
         String pemCertPre = Base64.getMimeEncoder().encodeToString(derCert);
         String pemCert = cert_begin + pemCertPre + end_cert;
         return pemCert;

src/main/java/com/cisd/tms/modules/openapi/service/impl/OpenApiService.java

@@ -1,8 +1,10 @@
 package com.cisd.tms.modules.openapi.service.impl;
 
+import com.cisd.tms.integration.crypto.pcie.PcieSessionTemplate;
 import com.cisd.tms.integration.crypto.pcie.service.JnaPcieCryptoService;
 import com.cisd.tms.modules.cert.repository.CertificateRepository;
 import com.cisd.tms.modules.cert.service.CertificateService;
+import com.cisd.tms.modules.cert.support.CertUtil;
 import com.cisd.tms.modules.openapi.service.IOpenApiService;
 import com.cisd.tms.modules.openapi.service.dto.GenericCertificate;
 import com.sun.jna.Pointer;
@@ -23,6 +25,7 @@ import java.security.cert.X509Certificate;
 @RequiredArgsConstructor
 public class OpenApiService implements IOpenApiService {
 
+    private final PcieSessionTemplate sessionTemplate;
     private JnaPcieCryptoService sdf;
     private final CertificateService certificateService;
 
@@ -45,50 +48,52 @@ public class OpenApiService implements IOpenApiService {
             byte[] hash = new byte[32]; // SM3 哈希长度为 32 字节
             IntByReference hashLength = new IntByReference();
 
-            // 使用空指针作为会话句柄（SDFSoft 支持）
-            Pointer sessionHandle = Pointer.NULL;
-
             // 默认的 SM2 用户 ID
-            String userId = "1234567812345678";
+            final String userId = "1234567812345678";
 
-            // 初始化哈希（包含公钥和用户 ID）
+            return sessionTemplate.withSession("SM2Sign", (sdf, deviceHandle, sessionHandle) -> {
-            int ret = sdf.SDF_HashInit(sessionHandle, 0, publicKey, userId, userId.length());
-            if (ret != 0) {
-                throw new RuntimeException("SDF_HashInit failed with code: " + ret);
-            }
 
-            // 更新哈希（添加原始数据）
+                // 初始化哈希（包含公钥和用户 ID）
-            ret = sdf.SDF_HashUpdate(sessionHandle, origBytes, origBytes.length);
+                sessionTemplate.ensureSuccess(
-            if (ret != 0) {
+                        "SDF_HashInit",
-                throw new RuntimeException("SDF_HashUpdate failed with code: " + ret);
+                        sdf.SDF_HashInit(sessionHandle, 0, publicKey, userId.getBytes(), 16)
-            }
+                );
 
-            // 完成哈希
+                // 更新哈希（添加原始数据）
-            ret = sdf.SDF_HashFinal(sessionHandle, hash, hashLength);
+                sessionTemplate.ensureSuccess(
-            if (ret != 0) {
+                        "SDF_HashUpdate",
-                throw new RuntimeException("SDF_HashFinal failed with code: " + ret);
+                        sdf.SDF_HashUpdate(sessionHandle, origBytes, origBytes.length)
-            }
+                );
 
-            // 使用 SDF 接口进行 SM2 签名
+                // 完成哈希
-            byte[] signature = new byte[64]; // SM2 签名长度为 64 字节
+                sessionTemplate.ensureSuccess(
-            ret = sdf.SDF_InternalSign_ECC(sessionHandle, keyIndex, hash, hashLength.getValue(), signature);
+                        "SDF_HashFinal",
-            if (ret != 0) {
+                        sdf.SDF_HashFinal(sessionHandle, hash, hashLength)
-                throw new RuntimeException("SDF_InternalSign_ECC failed with code: " + ret);
+                );
-            }
+
+                // 使用 SDF 接口进行 SM2 签名
+                byte[] signature = new byte[64]; // SM2 签名长度为 64 字节
+                sessionTemplate.ensureSuccess(
+                        "SDF_InternalSign_ECC",
+                        sdf.SDF_InternalSign_ECC(sessionHandle, keyIndex, hash, hashLength.getValue(), signature)
+                );
+
+                // 返回 Base64 编码的签名
+                return new String(Base64.encode(signature));
+            });
 
-            // 返回 Base64 编码的签名
-            return new String(Base64.encode(signature));
         } catch (Exception e) {
             e.printStackTrace();
             throw new RuntimeException("Raw sign failed: " + e.getMessage(), e);
         }
     }
 
+
     @Override
     public boolean rawVerify(byte[] origBytes, String certStr, String dn) {
         try {
             // 获取证书
-            X509Certificate cert = certManager.getCertificate(dn);
+            X509Certificate cert = certificateService.getBySubjectDn(dn);
             if (cert == null) {
                 return false;
             }
@@ -141,7 +146,7 @@ public class OpenApiService implements IOpenApiService {
         try {
             // 获取密钥对和证书
             KeyPair keyPair = certManager.getKeyPair(dn);
-            X509Certificate cert = certManager.getCertificate(dn);
+            X509Certificate cert = certificateService.getBySubjectDn(dn);
             if (keyPair == null || cert == null) {
                 throw new RuntimeException("Certificate not found for DN: " + dn);
             }
@@ -198,7 +203,7 @@ public class OpenApiService implements IOpenApiService {
                         // 验证证书有效性（检查有效期）
                         cert.checkValidity(new java.util.Date());
 
-                        return new GenericCertificate(cert);
+                        return CertUtil.convertToPem(cert);
                     }
                 } catch (org.bouncycastle.cms.CMSSignerDigestMismatchException e) {
                     // 签名验证失败（数据不匹配），不打印堆栈信息
@@ -238,7 +243,7 @@ public class OpenApiService implements IOpenApiService {
                 // 只验证签名是否正确，不检查证书有效期
                 try {
                     if (signerInfo.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(cert.getPublicKey()))) {
-                        return new GenericCertificate(cert);
+                        return CertUtil.convertToPem(cert);
                     }
                 } catch (org.bouncycastle.cms.CMSSignerDigestMismatchException e) {
                     // 签名验证失败（数据不匹配），不打印堆栈信息