从PIV智能卡中提取名称

我可以使用Java bouncycastle和iaik pkcs11包装器来获得通用名称和UPN /证书替代名称。

//path to .so library file
Module pkcs11Module = Module.getInstance(this.getProperties().getProperty("PKCS11_LIBRARY"));
pkcs11Module.initialize(null);
Slot[] slotsWithToken = pkcs11Module.getSlotList(Module.SlotRequirement.TOKEN_PRESENT);
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
for(Slot s : slotsWithToken)    {
    Session session = s.getToken().openSession(Token.SessionType.SERIAL_SESSION, Token.SessionReadWriteBehavior.RO_SESSION, null, null);
    session.findObjectsInit(new X509PublicKeyCertificate());
    Object[] objects = null;
    while((objects = session.findObjects(1)).length > 0)    {
        for(Object c : objects) {
            X509PublicKeyCertificate cert = (X509PublicKeyCertificate) c;
            byte[] certValue = cert.getValue().getByteArrayValue();
            Certificate cc = certFactory.generateCertificate(new ByteArrayInputStream(certValue));
            if(cc instanceof X509Certificate)   {
                X509Certificate x509 = (X509Certificate) cc;
                //COMMON NAME:
                String name = new X500Name(x509.getSubjectDN().getName()).getRDNs()[0].getFirst().getValue().toString();
                Collection<List<?>> altNames = x509.getSubjectAlternativeNames();
                for(List<?> list : altNames)    {
                    ASN1Sequence seq = ASN1Sequence.getInstance(new ASN1InputStream(new ByteArrayInputStream((byte[]) list.get(1))).readObject());
                    ASN1TaggedObject obj = (ASN1TaggedObject) seq.getObjectAt(1);
                    //ALT NAME:
                    String upn = obj.getObject().toString();
                    upn = upn.substring(upn.lastIndexOf("]") + 1);
                }
            }
        }
    }
}

在upn的前面附加了“ [0]”，但我不确定为什么这样做，因此我对其进行了操作以消除此问题。