Example usage for org.bouncycastle.cert.ocsp OCSPReqBuilder addRequest

Introduction

In this page you can find the example usage for org.bouncycastle.cert.ocsp OCSPReqBuilder addRequest.

Prototype

public OCSPReqBuilder addRequest(CertificateID certId) 

Source Link

Document

Add a request for the given CertificateID.

Usage

From source file:be.fedict.trust.ocsp.OnlineOcspRepository.java

License:Open Source License

private OCSPResp getOcspResponse(URI ocspUri, X509Certificate certificate, X509Certificate issuerCertificate)
        throws Exception {
    LOG.debug("OCSP URI: " + ocspUri);
    OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
    DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build();
    CertificateID certId = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCertificate), certificate.getSerialNumber());
    ocspReqBuilder.addRequest(certId);

    OCSPReq ocspReq = ocspReqBuilder.build();
    byte[] ocspReqData = ocspReq.getEncoded();

    HttpPost httpPost = new HttpPost(ocspUri.toString());
    ContentType contentType = ContentType.create("application/ocsp-request");
    HttpEntity requestEntity = new ByteArrayEntity(ocspReqData, contentType);
    httpPost.addHeader("User-Agent", "jTrust OCSP Client");
    httpPost.setEntity(requestEntity);/*from w  w w .j  a va  2s  . c  o m*/

    DefaultHttpClient httpClient = new DefaultHttpClient();
    if (null != this.networkConfig) {
        HttpHost proxy = new HttpHost(this.networkConfig.getProxyHost(), this.networkConfig.getProxyPort());
        httpClient.getParams().setParameter(ConnRoutePNames.DEFAULT_PROXY, proxy);
    }
    if (null != this.credentials) {
        this.credentials.init(httpClient.getCredentialsProvider());
    }

    HttpResponse httpResponse;
    int responseCode;
    try {
        httpResponse = httpClient.execute(httpPost);
        StatusLine statusLine = httpResponse.getStatusLine();
        responseCode = statusLine.getStatusCode();
    } catch (ConnectException e) {
        LOG.debug("OCSP responder is down");
        return null;
    }

    if (HttpURLConnection.HTTP_OK != responseCode) {
        LOG.error("HTTP response code: " + responseCode);
        return null;
    }

    Header responseContentTypeHeader = httpResponse.getFirstHeader("Content-Type");
    if (null == responseContentTypeHeader) {
        LOG.error("no Content-Type response header");
        return null;
    }
    String resultContentType = responseContentTypeHeader.getValue();
    if (!"application/ocsp-response".equals(resultContentType)) {
        LOG.error("result content type not application/ocsp-response");
        LOG.error("actual content-type: " + resultContentType);
        if ("text/html".equals(resultContentType)) {
            LOG.error("content: " + EntityUtils.toString(httpResponse.getEntity()));
        }
        return null;
    }

    Header responseContentLengthHeader = httpResponse.getFirstHeader("Content-Length");
    if (null != responseContentLengthHeader) {
        String resultContentLength = responseContentLengthHeader.getValue();
        if ("0".equals(resultContentLength)) {
            LOG.debug("no content returned");
            return null;
        }
    }

    HttpEntity httpEntity = httpResponse.getEntity();
    OCSPResp ocspResp = new OCSPResp(httpEntity.getContent());
    LOG.debug("OCSP response size: " + ocspResp.getEncoded().length + " bytes");
    httpPost.releaseConnection();
    return ocspResp;
}

---

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static OCSPResp createOcspResp(X509Certificate certificate, boolean revoked,
        X509Certificate issuerCertificate, X509Certificate ocspResponderCertificate,
        PrivateKey ocspResponderPrivateKey, String signatureAlgorithm) throws Exception {
    // request/* w  w  w. j a v a 2  s. com*/
    OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
    DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build();
    CertificateID certId = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCertificate), certificate.getSerialNumber());
    ocspReqBuilder.addRequest(certId);
    OCSPReq ocspReq = ocspReqBuilder.build();
    BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(
            ocspResponderCertificate.getPublicKey(), digCalcProv.get(CertificateID.HASH_SHA1));

    // request processing
    Req[] requestList = ocspReq.getRequestList();
    for (Req ocspRequest : requestList) {
        CertificateID certificateID = ocspRequest.getCertID();
        CertificateStatus certificateStatus;
        if (revoked) {
            certificateStatus = new RevokedStatus(new Date(), CRLReason.unspecified);
        } else {
            certificateStatus = CertificateStatus.GOOD;
        }
        basicOCSPRespBuilder.addResponse(certificateID, certificateStatus);
    }

    // basic response generation
    X509CertificateHolder[] chain = null;
    if (!ocspResponderCertificate.equals(issuerCertificate)) {
        chain = new X509CertificateHolder[] { new X509CertificateHolder(ocspResponderCertificate.getEncoded()),
                new X509CertificateHolder(issuerCertificate.getEncoded()) };
    }

    ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithm)
            .build(ocspResponderPrivateKey);
    BasicOCSPResp basicOCSPResp = basicOCSPRespBuilder.build(contentSigner, chain, new Date());

    // response generation
    OCSPRespBuilder ocspRespBuilder = new OCSPRespBuilder();
    OCSPResp ocspResp = ocspRespBuilder.build(OCSPRespBuilder.SUCCESSFUL, basicOCSPResp);

    return ocspResp;
}

---

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static OCSPResp createOcspResp(X509Certificate certificate, boolean revoked,
        X509Certificate issuerCertificate, X509Certificate ocspResponderCertificate,
        PrivateKey ocspResponderPrivateKey, String signatureAlgorithm,
        List<X509Certificate> ocspResponderCertificateChain) throws Exception {
    // request//from w  ww . j  a  va2 s.  c om
    OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
    DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build();
    CertificateID certId = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCertificate), certificate.getSerialNumber());
    ocspReqBuilder.addRequest(certId);
    OCSPReq ocspReq = ocspReqBuilder.build();
    BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(
            ocspResponderCertificate.getPublicKey(), digCalcProv.get(CertificateID.HASH_SHA1));

    // request processing
    Req[] requestList = ocspReq.getRequestList();
    for (Req ocspRequest : requestList) {
        CertificateID certificateID = ocspRequest.getCertID();
        CertificateStatus certificateStatus;
        if (revoked) {
            certificateStatus = new RevokedStatus(new Date(), CRLReason.unspecified);
        } else {
            certificateStatus = CertificateStatus.GOOD;
        }
        basicOCSPRespBuilder.addResponse(certificateID, certificateStatus);
    }

    // basic response generation
    X509CertificateHolder[] chain;
    if (ocspResponderCertificateChain.isEmpty()) {
        chain = null;
    } else {
        chain = new X509CertificateHolder[ocspResponderCertificateChain.size()];
        for (int idx = 0; idx < chain.length; idx++) {
            chain[idx] = new X509CertificateHolder(ocspResponderCertificateChain.get(idx).getEncoded());
        }
    }

    ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").build(ocspResponderPrivateKey);
    BasicOCSPResp basicOCSPResp = basicOCSPRespBuilder.build(contentSigner, chain, new Date());

    // response generation
    OCSPRespBuilder ocspRespBuilder = new OCSPRespBuilder();
    OCSPResp ocspResp = ocspRespBuilder.build(OCSPRespBuilder.SUCCESSFUL, basicOCSPResp);

    return ocspResp;
}

---

From source file:com.itextpdf.signatures.SignUtils.java

License:Open Source License

static OCSPReq generateOcspRequestWithNonce(CertificateID id) throws IOException, OCSPException {
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(id);

    Extension ext = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
            new DEROctetString(new DEROctetString(PdfEncryption.generateNewDocumentId()).getEncoded()));
    gen.setRequestExtensions(new Extensions(new Extension[] { ext }));
    return gen.build();
}

---

From source file:com.itextpdf.text.pdf.security.OcspClientBouncyCastle.java

License:Open Source License

/**
 * Generates an OCSP request using BouncyCastle.
 * @param issuerCert   certificate of the issues
 * @param serialNumber   serial number//from w  w w  .  j  a va  2s  .  c o m
 * @return   an OCSP request
 * @throws OCSPException
 * @throws IOException
 */
private static OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber)
        throws OCSPException, IOException, OperatorException, CertificateEncodingException {
    //Add provider BC
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

    // Generate the id for the certificate we are looking for
    CertificateID id = new CertificateID(
            new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCert), serialNumber);

    // basic request generation with nonce
    OCSPReqBuilder gen = new OCSPReqBuilder();

    gen.addRequest(id);

    Extension ext = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
            new DEROctetString(new DEROctetString(PdfEncryption.createDocumentId()).getEncoded()));
    gen.setRequestExtensions(new Extensions(new Extension[] { ext }));

    return gen.build();
}

---

From source file:com.tremolosecurity.proxy.auth.ssl.OCSP.java

License:Apache License

private OCSPReq generateOcspRequest(X509Certificate issuerCert, BigInteger serialNumber)
        throws OCSPException, CertificateEncodingException, OperatorCreationException, IOException {

    BcDigestCalculatorProvider util = new BcDigestCalculatorProvider();

    // Generate the id for the certificate we are looking for
    CertificateID id = new CertificateID(util.get(CertificateID.HASH_SHA1),
            new X509CertificateHolder(issuerCert.getEncoded()), serialNumber);
    OCSPReqBuilder ocspGen = new OCSPReqBuilder();

    ocspGen.addRequest(id);

    BigInteger nonce = BigInteger.valueOf(System.currentTimeMillis());
    Extension ext = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, true,
            new DEROctetString(nonce.toByteArray()));
    ocspGen.setRequestExtensions(new Extensions(new Extension[] { ext }));

    return ocspGen.build();
}

---

From source file:controller.CCInstance.java

License:Open Source License

private static OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber)
        throws OCSPException, IOException, OperatorException, CertificateEncodingException {
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
    CertificateID id = new CertificateID(
            new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCert), serialNumber);
    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(id);
    Extension ext = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false,
            new DEROctetString(new DEROctetString(PdfEncryption.createDocumentId()).getEncoded()));
    gen.setRequestExtensions(new Extensions(new Extension[] { ext }));
    return gen.build();
}

---

From source file:ec.rubrica.ocsp.ValidadorOCSP.java

License:Open Source License

public static void check(X509Certificate issuerCert, X509Certificate x509Cert)
        throws OcspValidationException, OcspTimeoutException {
    try {/*from  w w w  .j  a  v  a 2s  .c om*/
        BigInteger serialNumber = x509Cert.getSerialNumber();
        X509CertificateHolder holder;

        try {
            holder = new X509CertificateHolder(issuerCert.getEncoded());
        } catch (IOException e) {
            throw new RuntimeException(e);
        }

        CertificateID id = new CertificateID(new JcaDigestCalculatorProviderBuilder()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build().get(CertificateID.HASH_SHA1), holder,
                serialNumber);

        OCSPReqBuilder ocspGen = new OCSPReqBuilder();
        ocspGen.addRequest(id);
        OCSPReq ocspReq = ocspGen.build();

        // Ir al OCSP
        String ocspUrl = CertificateUtil.getOCSPURL(x509Cert);

        if (ocspUrl == null) {
            logger.info("URL de OCSP is null");
            return;
        }

        URL url;

        try {
            url = new URL(ocspUrl);
        } catch (MalformedURLException e) {
            throw new RuntimeException(e);
        }

        HttpURLConnection con;
        OCSPResp ocspResponse;

        try {
            con = (HttpURLConnection) url.openConnection();

            con.setRequestProperty("Content-Type", "application/ocsp-request");
            con.setRequestProperty("Accept", "application/ocsp-response");
            con.setDoOutput(true);

            OutputStream out = con.getOutputStream();
            DataOutputStream dataOut = new DataOutputStream(new BufferedOutputStream(out));
            dataOut.write(ocspReq.getEncoded());

            dataOut.flush();
            dataOut.close();

            /*
             * Se parsea la respuesta y se obtiene el estado del certificado
             * retornado por el OCSP
             */
            InputStream in = (InputStream) con.getContent();
            byte[] resp = read(in); // Read the reponse
            ocspResponse = new OCSPResp(resp);
        } catch (IOException e) {
            throw new OcspTimeoutException(url);
        }

        int status = ocspResponse.getStatus();
        System.out.println("status=" + status);

        BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject();

        if (basicResponse != null) {
            SingleResp[] responses = basicResponse.getResponses();
            SingleResp response = responses[0];
            CertificateStatus certStatus = response.getCertStatus();

            if (certStatus instanceof RevokedStatus) {
                System.out.println("REVOKED");
                RevokedStatus revokedStatus = (RevokedStatus) certStatus;
                System.out.println("Reason: " + revokedStatus.getRevocationReason());
                System.out.println("Date: " + revokedStatus.getRevocationTime());

                throw new OcspValidationException(revokedStatus.getRevocationReason(),
                        revokedStatus.getRevocationTime());
            }
        }
    } catch (OCSPException e) {
        throw new RuntimeException(e);
    } catch (CertificateEncodingException e) {
        throw new RuntimeException(e);
    } catch (OperatorCreationException e) {
        throw new RuntimeException(e);
    }
}

---

From source file:ee.ria.xroad.signer.certmanager.OcspClient.java

License:Open Source License

private static OCSPReq createRequest(X509Certificate subjectCert, X509Certificate issuerCert,
        PrivateKey signerKey, X509Certificate signerCert, String signAlgoId) throws Exception {
    OCSPReqBuilder requestBuilder = new OCSPReqBuilder();

    CertificateID id = CryptoUtils.createCertId(subjectCert, issuerCert);
    requestBuilder.addRequest(id);

    if (signerKey != null && signerCert != null) {
        X509CertificateHolder signerCertHolder = new X509CertificateHolder(signerCert.getEncoded());
        ContentSigner contentSigner = CryptoUtils.createContentSigner(signAlgoId, signerKey);

        log.trace("Creating signed OCSP request for certificate '{}' (signed by {})",
                subjectCert.getSubjectX500Principal(), signerCertHolder.getSubject());

        // needs to be set when generating signed requests
        requestBuilder.setRequestorName(signerCertHolder.getSubject());

        return requestBuilder.build(contentSigner, new X509CertificateHolder[] { signerCertHolder });
    }//from w w  w  .  j av  a2s  .com

    log.trace("Creating unsigned OCSP request for certificate '{}'", subjectCert.getSubjectX500Principal());

    return requestBuilder.build();
}

---

From source file:eu.europa.ec.markt.dss.validation102853.ocsp.OnlineOCSPSource.java

License:Open Source License

private byte[] buildOCSPRequest(final X509Certificate x509Certificate,
        final X509Certificate issuerX509Certificate) throws DSSException {

    try {/* ww w.  java2 s.co  m*/

        final CertificateID certId = DSSRevocationUtils.getOCSPCertificateID(x509Certificate,
                issuerX509Certificate);
        final OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
        ocspReqBuilder.addRequest(certId);

        /*
         * The nonce extension is used to bind a request to a response to prevent replay attacks.
          */
        if (ADD_NONCE) {

            final long currentTimeNonce = System.currentTimeMillis();

            nonce = new DEROctetString(DSSUtils.toByteArray(currentTimeNonce));
            final Extension extension = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, true, nonce);
            final Extensions extensions = new Extensions(extension);
            ocspReqBuilder.setRequestExtensions(extensions);
        }
        final OCSPReq ocspReq = ocspReqBuilder.build();
        final byte[] ocspReqData = ocspReq.getEncoded();
        return ocspReqData;
    } catch (OCSPException e) {
        throw new DSSException(e);
    } catch (IOException e) {
        throw new DSSException(e);
    }
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• »