1.改用自适应加载制章人证书

src/main/java/com/ymwk/icvp/signature/service/impl/SealBuilderImpl.java

@@ -6,7 +6,6 @@ import com.ymwk.icvp.pki.entity.CertificateEntity;
 import com.ymwk.icvp.pki.mapper.CertificateMapper;
 import com.ymwk.icvp.pki.service.impl.CertificateAssembleService;
 import com.ymwk.icvp.utils.MinioClientService;
-import org.ofdrw.gm.cert.PKCS12Tools;
 import org.ofdrw.gm.ses.v1.SES_ESPictrueInfo;
 import org.ofdrw.gm.ses.v1.SES_Header;
 import org.ofdrw.gm.ses.v4.SES_CertList;
@@ -15,7 +14,6 @@ import org.ofdrw.gm.ses.v4.SES_SealInfo;
 import org.ofdrw.gm.ses.v4.SESeal;
 import com.ymwk.icvp.signature.entity.Picture;
 import com.ymwk.icvp.signature.mapper.PictureMapper;
-import com.ymwk.icvp.signature.model.SealCreateDTO;
 import com.ymwk.icvp.signature.entity.Seal;
 import com.ymwk.icvp.signature.service.SealBuilder;
 import com.ymwk.icvp.signature.model.SealBuildResult;
@@ -25,13 +23,12 @@ import org.bouncycastle.asn1.*;
 import org.bouncycastle.asn1.gm.GMObjectIdentifiers;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Component;
 
 import java.io.InputStream;
-import java.net.URL;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
+import java.security.Key;
+import java.security.KeyStore;
 import java.security.PrivateKey;
 import java.security.Signature;
 
@@ -53,7 +50,7 @@ public class SealBuilderImpl implements SealBuilder {
     private final CertificateAssembleService certificateAssembleService;
 
     @Value("${seal.sealer-p12-path}")
-    private String sealerP12Path;
+    private Resource sealerP12Resource;
 
     @Value("${seal.sealer-p12-password}")
     private String sealerP12Password;
@@ -61,10 +58,16 @@ public class SealBuilderImpl implements SealBuilder {
     @Override
     public SealBuildResult buildEsl(Seal seal) {
         try {
-            // 1. 制章人证书 + 私钥（固定路径固定密码）
-            Path sealerPath = Paths.get(sealerP12Path);
-            Certificate sealerCert = PKCS12Tools.ReadUserCert(sealerPath, "Sig", sealerP12Password);
-            PrivateKey sealerPrvKey = PKCS12Tools.ReadPrvKey(sealerPath, "Sig", sealerP12Password);
+            // 1. 从配置资源加载制章人证书和私钥
+            KeyStore keyStore = KeyStore.getInstance("PKCS12", new BouncyCastleProvider());
+            try (InputStream input = sealerP12Resource.getInputStream()) {
+                keyStore.load(input, sealerP12Password.toCharArray());
+            }
+            Certificate sealerCert = keyStore.getCertificate("Sig");
+            Key sealerKey = keyStore.getKey("Sig", sealerP12Password.toCharArray());
+            if (sealerCert == null || !(sealerKey instanceof PrivateKey sealerPrvKey)) {
+                throw new IllegalStateException("PKCS12资源中缺少别名Sig对应的证书或私钥");
+            }
 
             // 2. 签章人证书
             X509Certificate userCert = loadUserCert(seal.getCertId());

src/main/resources/application.yaml

@@ -28,8 +28,8 @@ minio:
   secret-key: minio_mP6zC4
 
 seal:
-  #sealer-p12-path: /opt/icvp/seal/SealBuilder.p12
-  sealer-p12-path: D:/IdeaProject/icvpServer/src/main/resources/SealBuilder.p12
+  sealer-p12-path: classpath:SealBuilder.p12
+  #sealer-p12-path: D:/IdeaProject/icvpServer/src/main/resources/SealBuilder.p12
   sealer-p12-password: 12345678
 
 # 2. MyBatis-Plus 专属配置