Class OCSPClientImpl


  • public class OCSPClientImpl
    extends java.lang.Object
    OCSP client is responsible for the network related activity of the OCSP invocation pipeline. This class is state less and thread safe.

    It is implementing the RFC 2560 also taking care to support the lightweight profile recommendations defined in the RFC 5019.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private static java.nio.charset.Charset ASCII  
      private static int MAX_RESPONSE_SIZE  
    • Constructor Summary

      Constructors 
      Constructor Description
      OCSPClientImpl()  
    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      private boolean checkCertIDMatching​(java.security.cert.X509Certificate toFind, java.security.cert.X509Certificate issuerCert, org.bouncycastle.cert.ocsp.CertificateID checkedCertId)  
      private void configureHttpConnection​(java.net.HttpURLConnection con, int timeout)  
      org.bouncycastle.cert.ocsp.OCSPReq createRequest​(java.security.cert.X509Certificate toCheckCert, java.security.cert.X509Certificate issuerCert, X509Credential requester, boolean addNonce)  
      private java.net.HttpURLConnection doPost​(java.net.URL responder, byte[] request, int timeout)  
      private java.security.PublicKey establishResponsePubKey​(org.bouncycastle.cert.ocsp.BasicOCSPResp bresp, java.security.cert.X509Certificate issuerCert)  
      static byte[] extractNonce​(org.bouncycastle.cert.ocsp.OCSPReq request)  
      private java.lang.String getHttpGetUrl​(java.net.URL responder, byte[] request)  
      static java.util.Date getNextUpdateFromCacheHeader​(java.lang.String cc)  
      private static java.lang.String getResponderErrorDesc​(int errorNo)  
      OCSPResult queryForCertificate​(java.net.URL responder, java.security.cert.X509Certificate toCheckCert, java.security.cert.X509Certificate issuerCert, X509Credential requester, boolean addNonce, int timeout)
      Returns a verified single response, related to the checked certificate.
      OCSPResponseStructure send​(java.net.URL responder, org.bouncycastle.cert.ocsp.OCSPReq requestO, int timeout)  
      org.bouncycastle.cert.ocsp.SingleResp verifyResponse​(org.bouncycastle.cert.ocsp.OCSPResp response, java.security.cert.X509Certificate toCheckCert, java.security.cert.X509Certificate issuerCert, byte[] checkNonce)
      Verifies the provided response
      private void verifyTimeRange​(java.util.Date thisUpdate, java.util.Date nextUpdate)  
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Field Detail

      • ASCII

        private static final java.nio.charset.Charset ASCII
    • Constructor Detail

      • OCSPClientImpl

        public OCSPClientImpl()
    • Method Detail

      • queryForCertificate

        public OCSPResult queryForCertificate​(java.net.URL responder,
                                              java.security.cert.X509Certificate toCheckCert,
                                              java.security.cert.X509Certificate issuerCert,
                                              X509Credential requester,
                                              boolean addNonce,
                                              int timeout)
                                       throws java.io.IOException,
                                              org.bouncycastle.cert.ocsp.OCSPException
        Returns a verified single response, related to the checked certificate. This is single-shot version, which can be used instead of manual invocation of low-level methods.
        Parameters:
        responder - mandatory - URL of the responder. HTTP or HTTPs, however in https mode the
        toCheckCert - mandatory certificate to be checked
        issuerCert - mandatory certificate of the toCheckCert issuer
        requester - if not null, then it is assumed that request must be signed by the requester.
        addNonce - if true nonce will be added to the request and required in response
        timeout - timeout
        Returns:
        Final OCSP checking result
        Throws:
        java.io.IOException - IO exception
        org.bouncycastle.cert.ocsp.OCSPException - OCSP exception
      • createRequest

        public org.bouncycastle.cert.ocsp.OCSPReq createRequest​(java.security.cert.X509Certificate toCheckCert,
                                                                java.security.cert.X509Certificate issuerCert,
                                                                X509Credential requester,
                                                                boolean addNonce)
                                                         throws org.bouncycastle.cert.ocsp.OCSPException
        Throws:
        org.bouncycastle.cert.ocsp.OCSPException
      • send

        public OCSPResponseStructure send​(java.net.URL responder,
                                          org.bouncycastle.cert.ocsp.OCSPReq requestO,
                                          int timeout)
                                   throws java.io.IOException
        Throws:
        java.io.IOException
      • configureHttpConnection

        private void configureHttpConnection​(java.net.HttpURLConnection con,
                                             int timeout)
      • getHttpGetUrl

        private java.lang.String getHttpGetUrl​(java.net.URL responder,
                                               byte[] request)
        Returns:
        null if the encoded request is > 255, or the string which can be used as GET request URL with request encoded.
      • doPost

        private java.net.HttpURLConnection doPost​(java.net.URL responder,
                                                  byte[] request,
                                                  int timeout)
                                           throws java.io.IOException
        Throws:
        java.io.IOException
      • getNextUpdateFromCacheHeader

        public static java.util.Date getNextUpdateFromCacheHeader​(java.lang.String cc)
      • getResponderErrorDesc

        private static java.lang.String getResponderErrorDesc​(int errorNo)
      • verifyResponse

        public org.bouncycastle.cert.ocsp.SingleResp verifyResponse​(org.bouncycastle.cert.ocsp.OCSPResp response,
                                                                    java.security.cert.X509Certificate toCheckCert,
                                                                    java.security.cert.X509Certificate issuerCert,
                                                                    byte[] checkNonce)
                                                             throws org.bouncycastle.cert.ocsp.OCSPException
        Verifies the provided response
        Parameters:
        response - OCSP response
        toCheckCert - mandatory certificate to be checked
        issuerCert - mandatory certificate of the toCheckCert issuer
        checkNonce - expected OCSP nonce
        Returns:
        verified response corresponding to the certificate being checked
        Throws:
        org.bouncycastle.cert.ocsp.OCSPException - OCSP exception
      • verifyTimeRange

        private void verifyTimeRange​(java.util.Date thisUpdate,
                                     java.util.Date nextUpdate)
                              throws org.bouncycastle.cert.ocsp.OCSPException
        Throws:
        org.bouncycastle.cert.ocsp.OCSPException
      • checkCertIDMatching

        private boolean checkCertIDMatching​(java.security.cert.X509Certificate toFind,
                                            java.security.cert.X509Certificate issuerCert,
                                            org.bouncycastle.cert.ocsp.CertificateID checkedCertId)
                                     throws org.bouncycastle.cert.ocsp.OCSPException
        Throws:
        org.bouncycastle.cert.ocsp.OCSPException
      • establishResponsePubKey

        private java.security.PublicKey establishResponsePubKey​(org.bouncycastle.cert.ocsp.BasicOCSPResp bresp,
                                                                java.security.cert.X509Certificate issuerCert)
                                                         throws org.bouncycastle.cert.ocsp.OCSPException
        Throws:
        org.bouncycastle.cert.ocsp.OCSPException
      • extractNonce

        public static byte[] extractNonce​(org.bouncycastle.cert.ocsp.OCSPReq request)
                                   throws java.io.IOException
        Throws:
        java.io.IOException