diff --git a/src/main/java/com/sunyard/constant/CertUsage.java b/src/main/java/com/sunyard/constant/CertUsage.java
new file mode 100644
index 0000000..17733b4
--- /dev/null
+++ b/src/main/java/com/sunyard/constant/CertUsage.java
@@ -0,0 +1,16 @@
+package com.sunyard.constant;
+
+/**
+ * 证书用途
+ */
+public enum CertUsage {
+    digitalSignature,
+    nonRepudiation,
+    keyEncipherment,
+    dataEncipherment,
+    keyAgreement,
+    keyCertSign,
+    cRLSign,
+    encipherOnly,
+    decipherOnly
+}
diff --git a/src/main/java/com/sunyard/inf/SydCertApi.java b/src/main/java/com/sunyard/inf/SydCertApi.java
index d153121..dc2cacc 100644
--- a/src/main/java/com/sunyard/inf/SydCertApi.java
+++ b/src/main/java/com/sunyard/inf/SydCertApi.java
@@ -3,6 +3,7 @@ package com.sunyard.inf;
 
 import com.sunyard.RetWrap;
 import com.sunyard.cert.X509;
+import com.sunyard.constant.CertUsage;
 
 import java.io.UnsupportedEncodingException;
 
@@ -118,16 +119,28 @@ public interface SydCertApi {
      * 上传指定证书到加密设备
      * @param certData 证书的字节数组
      * @param organizationId 机构号的字节数组
+     * @param us 白名单类型
      * @return
      */
+    RetWrap importCert(byte[] certData, byte[] organizationId, CertUsage... us);
     RetWrap importCert(byte[] certData, byte[] organizationId);
 
+    /**
+     * 从加密设备中删除指定 DN 的公钥证书
+     * @param dn：传入的证书
+     *
+     * @return
+     */
+    boolean deleteCert(String dn);
+
     /**
      * 上传指定证书到加密设备,并在证书前后加上begin和end
      * @param certData 证书的字节数组
      * @param organizationId 机构号的字节数组
+     * @param us 白名单类型
      * @return
      */
+    RetWrap importCertAddHT(String certData, byte[] organizationId, CertUsage... us);
     RetWrap importCertAddHT(String certData, byte[] organizationId);
 
 }
diff --git a/src/main/java/com/sunyard/util/CertUtil.java b/src/main/java/com/sunyard/util/CertUtil.java
index 73ac14a..6b4a31b 100644
--- a/src/main/java/com/sunyard/util/CertUtil.java
+++ b/src/main/java/com/sunyard/util/CertUtil.java
@@ -2,6 +2,7 @@ package com.sunyard.util;
 
 import cn.hutool.core.codec.Base64;
 import com.sunyard.RetWrap;
+import com.sunyard.constant.CertUsage;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import sun.misc.BASE64Encoder;
 
@@ -13,6 +14,8 @@ import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
+import java.util.HashSet;
+import java.util.Set;
 
 public class CertUtil {
     public static String encodeBase64(byte[] data) {
@@ -92,4 +95,32 @@ public class CertUtil {
         return isSM2Cert((String) ret.get("cert"));
     }
 
+
+    public static boolean certUsageCheck(String cert , CertUsage... us ) throws CertificateException, NoSuchProviderException {
+        if ( null == us || us.length == 0) {
+            return true;
+        }
+
+        X509Certificate certificate = convertToX509Cert(cert);
+        boolean[] usage = certificate.getKeyUsage();
+
+        if ( null == usage ) {
+            return false;
+        }
+
+        boolean checkRet = true;
+        Set<Integer> uset = new HashSet<Integer>();
+        for ( CertUsage u : us ) {
+            uset.add( u.ordinal() );
+        }
+
+        for ( int i = 0; i < usage.length; i++ ) {
+            if ( usage[ i ] ) {
+                checkRet &= uset.contains( i );
+            }
+        }
+
+        return checkRet;
+    }
+
 }
diff --git a/src/main/java/racal/sunyard/main/SydApi4j.java b/src/main/java/racal/sunyard/main/SydApi4j.java
index 7ed188a..f0fc0c3 100644
--- a/src/main/java/racal/sunyard/main/SydApi4j.java
+++ b/src/main/java/racal/sunyard/main/SydApi4j.java
@@ -6,6 +6,7 @@ import com.sunyard.SYMEnDeLongData;
 import com.sunyard.SydApi;
 import com.sunyard.SydApiException;
 import com.sunyard.cert.X509;
+import com.sunyard.constant.CertUsage;
 import com.sunyard.entity.Struct;
 import com.sunyard.proto.Packet;
 import com.sunyard.proto.PacketSection;
@@ -998,6 +999,13 @@ public class SydApi4j implements SydApi {
         return r;
     }
 
+    @Override
+    public RetWrap importCertAddHT(String certData, byte[] organizationId, CertUsage... us) {
+        String cert = CoderUtil.certAddHT(certData);
+
+        return importCert(Util.getSafeBytes(cert), organizationId, CertUsage.encipherOnly);
+    }
+
     /**
      * @param certData
      * @param organizationId
@@ -1010,9 +1018,19 @@ public class SydApi4j implements SydApi {
         return importCert(Util.getSafeBytes(cert), organizationId);
     }
 
-    // 测试通过
     @Override
     public RetWrap importCert(byte[] certData, byte[] organizationId) {
+        return importCert(certData, organizationId, CertUsage.encipherOnly);
+    }
+
+    @Override
+    public boolean deleteCert(String dn) {
+        return false;
+    }
+
+    // 测试通过
+    @Override
+    public RetWrap importCert(byte[] certData, byte[] organizationId, CertUsage... us) {
 
         Proto8009 proto = new Proto8009();
 
diff --git a/src/test/java/com/sunyard/sydapi/test/TestCertUtil.java b/src/test/java/com/sunyard/sydapi/test/TestCertUtil.java
index ce3bcef..f17724b 100644
--- a/src/test/java/com/sunyard/sydapi/test/TestCertUtil.java
+++ b/src/test/java/com/sunyard/sydapi/test/TestCertUtil.java
@@ -1,5 +1,6 @@
 package com.sunyard.sydapi.test;
 
+import com.sunyard.constant.CertUsage;
 import com.sunyard.util.CertUtil;
 import org.junit.Assert;
 import org.junit.Test;
@@ -70,4 +71,40 @@ public class TestCertUtil {
         );
     }
 
+
+    @Test
+    public void certtype1() throws CertificateException, NoSuchProviderException {
+        Assert.assertTrue(
+                CertUtil.certUsageCheck( readCert("/x509/c1.crt") , CertUsage.digitalSignature , CertUsage.nonRepudiation )
+        );
+    }
+
+    @Test
+    public void certtype2() throws CertificateException, NoSuchProviderException {
+        Assert.assertTrue(
+                CertUtil.certUsageCheck( readCert("/x509/c2.crt") , CertUsage.keyEncipherment )
+        );
+    }
+
+    @Test
+    public void certtype4() throws CertificateException, NoSuchProviderException {
+        Assert.assertTrue(
+                CertUtil.certUsageCheck( readCert("/x509/c4.crt") , CertUsage.keyEncipherment )
+        );
+    }
+
+    @Test
+    public void certtype5() throws CertificateException, NoSuchProviderException {
+        Assert.assertTrue(
+                CertUtil.certUsageCheck( readCert("/x509/c5.crt") )
+        );
+    }
+
+    @Test
+    public void certtype6() throws CertificateException, NoSuchProviderException {
+        Assert.assertTrue(
+                CertUtil.certUsageCheck( readCert("/x509/c6.crt") , CertUsage.digitalSignature , CertUsage.nonRepudiation)
+        );
+    }
+
 }