Example usage for org.bouncycastle.cert.ocsp RespID HASH_SHA1

Introduction

In this page you can find the example usage for org.bouncycastle.cert.ocsp RespID HASH_SHA1.

Prototype

AlgorithmIdentifier HASH_SHA1

To view the source code for org.bouncycastle.cert.ocsp RespID HASH_SHA1.

Click Source Link

Usage

From source file:org.cesecore.certificates.ocsp.SHA1DigestCalculator.java

License:Open Source License

public AlgorithmIdentifier getAlgorithmIdentifier() {
    return RespID.HASH_SHA1;
}

---

From source file:org.keycloak.testsuite.forms.x509.OcspHandler.java

License:Open Source License

@Override
public void handleRequest(final HttpServerExchange exchange) throws Exception {
    if (exchange.isInIoThread()) {
        exchange.dispatch(this);
        return;/*from  w  w  w. j  av a  2 s . co m*/
    }

    final byte[] buffy = new byte[16384];
    try (InputStream requestStream = exchange.getInputStream()) {
        requestStream.read(buffy);
    }

    final OCSPReq request = new OCSPReq(buffy);
    final Req[] requested = request.getRequestList();

    final Extension nonce = request.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);

    final DigestCalculator sha1Calculator = new JcaDigestCalculatorProviderBuilder().build()
            .get(AlgorithmIdentifier.getInstance(RespID.HASH_SHA1));

    final BasicOCSPRespBuilder responseBuilder = new BasicOCSPRespBuilder(subjectPublicKeyInfo, sha1Calculator);

    if (nonce != null) {
        responseBuilder.setResponseExtensions(new Extensions(nonce));
    }

    for (final Req req : requested) {
        final CertificateID certId = req.getCertID();

        final BigInteger certificateSerialNumber = certId.getSerialNumber();
        responseBuilder.addResponse(certId, REVOKED_CERTIFICATES_STATUS.get(certificateSerialNumber));
    }

    final ContentSigner contentSigner = new BcRSAContentSignerBuilder(
            new AlgorithmIdentifier(PKCSObjectIdentifiers.sha256WithRSAEncryption),
            new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256)).build(privateKey);

    final OCSPResp response = new OCSPRespBuilder().build(OCSPResp.SUCCESSFUL,
            responseBuilder.build(contentSigner, chain, new Date()));

    final byte[] responseBytes = response.getEncoded();

    final HeaderMap responseHeaders = exchange.getResponseHeaders();
    responseHeaders.put(Headers.CONTENT_TYPE, "application/ocsp-response");

    final Sender responseSender = exchange.getResponseSender();
    responseSender.send(ByteBuffer.wrap(responseBytes));

    exchange.endExchange();
}

---

From source file:org.signserver.validationservice.server.ValidationUtils.java

License:Open Source License

/**
 * Sends a request to the OCSP responder and returns the results.
 *
 * Note: Based on code from the EJBCA ValidationTool.
 *
 * @param url of the OCSP responder/*w  w  w .  j  a  v  a  2  s. c  om*/
 * @param request to send
 * @return An OCSPResponse object filled with information about the response
 * @throws IOException in case of networking related errors
 * @throws OCSPException in case of error parsing the response
 */
public static OCSPResponse queryOCSPResponder(URL url, OCSPReq request) throws IOException, OCSPException {
    final OCSPResponse result = new OCSPResponse();

    final HttpURLConnection con;
    final URLConnection urlCon = url.openConnection();
    if (!(urlCon instanceof HttpURLConnection)) {
        throw new IOException("Unsupported protocol in URL: " + url);
    }
    con = (HttpURLConnection) urlCon;

    // POST the OCSP request
    con.setDoOutput(true);
    con.setRequestMethod("POST");

    // POST it
    con.setRequestProperty("Content-Type", "application/ocsp-request");
    OutputStream os = null;
    try {
        os = con.getOutputStream();
        os.write(request.getEncoded());
    } finally {
        if (os != null) {
            os.close();
        }
    }

    result.setHttpReturnCode(con.getResponseCode());
    if (result.getHttpReturnCode() != 200) {
        if (result.getHttpReturnCode() == 401) {
            result.setError(OCSPResponse.Error.httpUnauthorized);
        } else {
            result.setError(OCSPResponse.Error.unknown);
        }
        return result;
    }

    OCSPResp response = null;
    InputStream in = null;
    try {
        in = con.getInputStream();
        if (in != null) {
            ByteArrayOutputStream bout = new ByteArrayOutputStream();
            int b;
            while ((b = in.read()) != -1) {
                bout.write(b);
            }
            response = new OCSPResp(bout.toByteArray());
        }
    } finally {
        if (in != null) {
            try {
                in.close();
            } catch (IOException ignored) {
            } // NOPMD
        }
    }

    if (response == null) {
        result.setError(OCSPResponse.Error.noResponse);
        return result;
    }
    result.setResp(response);

    if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) {
        result.setError(OCSPResponse.Error.fromBCOCSPResponseStatus(response.getStatus()));
        return result;
    }

    final BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
    result.setResponseObject(brep);
    if (brep == null) {
        result.setError(OCSPResponse.Error.noResponse);
        return result;
    }

    final RespID id = brep.getResponderId();
    final DERTaggedObject to = (DERTaggedObject) id.toASN1Object().toASN1Object();
    final RespID respId;

    final X509CertificateHolder[] chain = brep.getCerts();
    JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
    X509Certificate signerCertificate;
    try {
        signerCertificate = converter.getCertificate(chain[0]);
    } catch (CertificateException ex) {
        throw new IOException("Could not convert certificate: " + ex.getMessage());
    }
    result.setSignerCertificate(signerCertificate);

    if (to.getTagNo() == 1) {
        // This is Name
        respId = new JcaRespID(signerCertificate.getSubjectX500Principal());
    } else {
        // This is KeyHash
        final PublicKey signerPub = signerCertificate.getPublicKey();
        try {
            respId = new JcaRespID(signerPub,
                    new JcaDigestCalculatorProviderBuilder().build().get(RespID.HASH_SHA1));
        } catch (OperatorCreationException ex) {
            throw new IOException("Could not create respId: " + ex.getMessage());
        }
    }
    if (!id.equals(respId)) {
        // Response responderId does not match signer certificate responderId!
        result.setError(OCSPResponse.Error.invalidSignerId);
    }

    result.setIssuerDN(signerCertificate.getIssuerX500Principal());

    if (result.getError() == null) {
        result.setError(OCSPResponse.Error.responseSuccess);
    }

    return result;
}

---