org.bouncycastle.cert.ocsp.RevokedStatus Java Examples

private void extractStatusInfo(SingleResp bestSingleResp) {
	org.bouncycastle.cert.ocsp.CertificateStatus certStatus = bestSingleResp.getCertStatus();
	if (org.bouncycastle.cert.ocsp.CertificateStatus.GOOD == certStatus) {
		if (LOG.isInfoEnabled()) {
			LOG.info("OCSP status is good");
		}
		status = CertificateStatus.GOOD;
	} else if (certStatus instanceof RevokedStatus) {
		if (LOG.isInfoEnabled()) {
			LOG.info("OCSP status revoked");
		}
		final RevokedStatus revokedStatus = (RevokedStatus) certStatus;
		status = CertificateStatus.REVOKED;
		revocationDate = revokedStatus.getRevocationTime();
		int reasonId = 0; // unspecified
		if (revokedStatus.hasRevocationReason()) {
			reasonId = revokedStatus.getRevocationReason();
		}
		reason = RevocationReason.fromInt(reasonId);
	} else if (certStatus instanceof UnknownStatus) {
		if (LOG.isInfoEnabled()) {
			LOG.info("OCSP status unknown");
		}
		status = CertificateStatus.UNKNOWN;
	} else {
		LOG.info("OCSP certificate status: {}", certStatus);
	}
}
 

@Nonnull
public static ETriState evalOCSPResponse (@Nonnull final OCSPResp aOCSPResponse) throws OCSPException
{
  final EOCSPResponseStatus eStatus = EOCSPResponseStatus.getFromValueOrNull (aOCSPResponse.getStatus ());
  if (eStatus == null)
    throw new OCSPException ("Unsupported status code " + aOCSPResponse.getStatus () + " received!");
  if (eStatus.isFailure ())
    throw new OCSPException ("Non-success status code " + aOCSPResponse.getStatus () + " received!");

  final Object aResponseObject = aOCSPResponse.getResponseObject ();
  if (aResponseObject instanceof BasicOCSPResp)
  {
    final BasicOCSPResp aBasicResponse = (BasicOCSPResp) aResponseObject;
    final SingleResp [] aResponses = aBasicResponse.getResponses ();
    // Assume we queried only one
    if (aResponses.length == 1)
    {
      final SingleResp aResponse = aResponses[0];
      final CertificateStatus aStatus = aResponse.getCertStatus ();
      if (aStatus == CertificateStatus.GOOD)
        return ETriState.TRUE;
      if (aStatus instanceof RevokedStatus)
        return ETriState.FALSE;
      // else status is unknown
    }
  }
  return ETriState.UNDEFINED;
}
 

/**
 * Validates OCSP Basic OCSP response.
 *
 * @param currentTime   the current timestamp.
 * @param basicOcspResp BasicOcspResponse data.
 * @throws SFOCSPException raises if any failure occurs.
 */
private void validateBasicOcspResponse(
    Date currentTime, BasicOCSPResp basicOcspResp)
throws SFOCSPException
{
  for (SingleResp singleResps : basicOcspResp.getResponses())
  {
    checkCertUnknownTestParameter();
    CertificateStatus certStatus = singleResps.getCertStatus();
    if (certStatus != CertificateStatus.GOOD)
    {
      if (certStatus instanceof RevokedStatus)
      {
        RevokedStatus status = (RevokedStatus) certStatus;
        int reason;
        try
        {
          reason = status.getRevocationReason();
        }
        catch (IllegalStateException ex)
        {
          reason = -1;
        }
        Date revocationTime = status.getRevocationTime();
        throw new SFOCSPException(OCSPErrorCode.CERTIFICATE_STATUS_REVOKED,
                                  String.format(
                                      "The certificate has been revoked. Reason: %d, Time: %s",
                                      reason, DATE_FORMAT_UTC.format(revocationTime)));
      }
      else
      {
        // Unknown status
        throw new SFOCSPException(OCSPErrorCode.CERTIFICATE_STATUS_UNKNOWN,
                                  "Failed to validate the certificate for UNKNOWN reason.");
      }
    }

    Date thisUpdate = singleResps.getThisUpdate();
    Date nextUpdate = singleResps.getNextUpdate();
    LOGGER.debug("Current Time: {}, This Update: {}, Next Update: {}",
                 currentTime, thisUpdate, nextUpdate);
    if (!isValidityRange(currentTime, thisUpdate, nextUpdate))
    {
      throw new SFOCSPException(OCSPErrorCode.INVALID_OCSP_RESPONSE_VALIDITY,
                                String.format(
                                    "The OCSP response validity is out of range: " +
                                    "Current Time: %s, This Update: %s, Next Update: %s",
                                    DATE_FORMAT_UTC.format(currentTime),
                                    DATE_FORMAT_UTC.format(thisUpdate),
                                    DATE_FORMAT_UTC.format(nextUpdate)));
    }
  }
  LOGGER.debug("OK. Verified the certificate revocation status.");
}
 

@Override
public ValidationStatus validate(X509Certificate certificate, List<X509Certificate> issuers, Date validationDate) {
	X509Certificate issuer = issuers.get(0);
	ValidationStatus status = new ValidationStatus(certificate, issuer, validationDate, ValidatorSourceType.OCSP, CertificateValidity.UNKNOWN);

	try {
		Principal subjectX500Principal = certificate.getSubjectX500Principal();

		String ocspUrl = getOCSPUrl(certificate);
		if (ocspUrl == null) {
			log.error("OCSP URL for '" + subjectX500Principal + "' is empty");
			return status;
		}

		log.debug("OCSP URL for '" + subjectX500Principal + "' is '" + ocspUrl + "'");

		DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
		CertificateID certificateId = new CertificateID(digestCalculator, new JcaX509CertificateHolder(certificate), certificate.getSerialNumber());

		// Generate OCSP request
		OCSPReq ocspReq = generateOCSPRequest(certificateId);

		// Get OCSP response from server
		OCSPResp ocspResp = requestOCSPResponse(ocspUrl, ocspReq);
		if (ocspResp.getStatus() != OCSPRespBuilder.SUCCESSFUL) {
			log.error("OCSP response is invalid!");
			status.setValidity(CertificateValidity.INVALID);
			return status;
		}

		boolean foundResponse = false;
		BasicOCSPResp basicOCSPResp = (BasicOCSPResp) ocspResp.getResponseObject();
		SingleResp[] singleResps = basicOCSPResp.getResponses();
		for (SingleResp singleResp : singleResps) {
			CertificateID responseCertificateId = singleResp.getCertID();
			if (!certificateId.equals(responseCertificateId)) {
				continue;
			}

			foundResponse = true;

			log.debug("OCSP validationDate: " + validationDate);
			log.debug("OCSP thisUpdate: " + singleResp.getThisUpdate());
			log.debug("OCSP nextUpdate: " + singleResp.getNextUpdate());

			status.setRevocationObjectIssuingTime(basicOCSPResp.getProducedAt());

			Object certStatus = singleResp.getCertStatus();
			if (certStatus == CertificateStatus.GOOD) {
				log.debug("OCSP status is valid for '" + certificate.getSubjectX500Principal() + "'");
				status.setValidity(CertificateValidity.VALID);
			} else {
				if (singleResp.getCertStatus() instanceof RevokedStatus) {
					log.warn("OCSP status is revoked for: " + subjectX500Principal);
					if (validationDate.before(((RevokedStatus) singleResp.getCertStatus()).getRevocationTime())) {
						log.warn("OCSP revocation time after the validation date, the certificate '" + subjectX500Principal + "' was valid at " + validationDate);
						status.setValidity(CertificateValidity.VALID);
					} else {
						Date revocationDate = ((RevokedStatus) singleResp.getCertStatus()).getRevocationTime();
						log.info("OCSP for certificate '" + subjectX500Principal + "' is revoked since " + revocationDate);
						status.setRevocationDate(revocationDate);
						status.setRevocationObjectIssuingTime(singleResp.getThisUpdate());
						status.setValidity(CertificateValidity.REVOKED);
					}
				}
			}
		}

		if (!foundResponse) {
			log.error("There is no matching OCSP response entries");
		}
	} catch (Exception ex) {
		log.error("OCSP exception: ", ex);
	}

	return status;
}