package com.example.keygen;

// Use the standard Java API to build a simple cert (requires JDK 9+) Certificate cert = CertificateGenerator.generateSelfSignedCertificate( kp, dn, serial, notBefore, notAfter, "SHA256withRSA");

It’s an industry‑standard format ( .p12 / .pfx ) supported by virtually every platform (Java, .NET, OpenSSL, browsers). 3.2 PEM Files (Base64 with headers) Sometimes you need the key in PEM format (e.g., for OpenSSL). Bouncy Castle makes this trivial.

// Validity period CertificateValidity interval = new CertificateValidity(notBefore, notAfter); info.set(X509CertInfo.VALIDITY, interval);

| Scenario | Algorithm | Typical key sizes | When to use | |----------|-----------|-------------------|-------------| | (asymmetric, encryption & signatures) | RSA | 2048 bits (minimum), 3072 bits, 4096 bits | General‑purpose public‑key encryption or signing | | ECDSA (asymmetric, signatures) | EC (named curves) | secp256r1 (aka P‑256 ), secp384r1 ( P‑384 ) | Smaller keys, same security as RSA‑3072, faster | | AES (symmetric, encryption) | AES | 128, 192, 256 bits | Bulk data encryption, symmetric key exchange |

public class RsaKeyGen