Example usage for org.bouncycastle.cert.ocsp RevokedStatus RevokedStatus

Introduction

In this page you can find the example usage for org.bouncycastle.cert.ocsp RevokedStatus RevokedStatus.

Prototype

public RevokedStatus(Date revocationDate, int reason) 

Source Link

Usage

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static OCSPResp createOcspResp(X509Certificate certificate, boolean revoked,
        X509Certificate issuerCertificate, X509Certificate ocspResponderCertificate,
        PrivateKey ocspResponderPrivateKey, String signatureAlgorithm) throws Exception {
    // request//from   w  w  w .  j av a  2  s . c o  m
    OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
    DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build();
    CertificateID certId = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCertificate), certificate.getSerialNumber());
    ocspReqBuilder.addRequest(certId);
    OCSPReq ocspReq = ocspReqBuilder.build();
    BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(
            ocspResponderCertificate.getPublicKey(), digCalcProv.get(CertificateID.HASH_SHA1));

    // request processing
    Req[] requestList = ocspReq.getRequestList();
    for (Req ocspRequest : requestList) {
        CertificateID certificateID = ocspRequest.getCertID();
        CertificateStatus certificateStatus;
        if (revoked) {
            certificateStatus = new RevokedStatus(new Date(), CRLReason.unspecified);
        } else {
            certificateStatus = CertificateStatus.GOOD;
        }
        basicOCSPRespBuilder.addResponse(certificateID, certificateStatus);
    }

    // basic response generation
    X509CertificateHolder[] chain = null;
    if (!ocspResponderCertificate.equals(issuerCertificate)) {
        chain = new X509CertificateHolder[] { new X509CertificateHolder(ocspResponderCertificate.getEncoded()),
                new X509CertificateHolder(issuerCertificate.getEncoded()) };
    }

    ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithm)
            .build(ocspResponderPrivateKey);
    BasicOCSPResp basicOCSPResp = basicOCSPRespBuilder.build(contentSigner, chain, new Date());

    // response generation
    OCSPRespBuilder ocspRespBuilder = new OCSPRespBuilder();
    OCSPResp ocspResp = ocspRespBuilder.build(OCSPRespBuilder.SUCCESSFUL, basicOCSPResp);

    return ocspResp;
}

---

From source file:be.fedict.trust.test.PKITestUtils.java

License:Open Source License

public static OCSPResp createOcspResp(X509Certificate certificate, boolean revoked,
        X509Certificate issuerCertificate, X509Certificate ocspResponderCertificate,
        PrivateKey ocspResponderPrivateKey, String signatureAlgorithm,
        List<X509Certificate> ocspResponderCertificateChain) throws Exception {
    // request/* w  w  w.j  a  v  a 2s.c  om*/
    OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
    DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build();
    CertificateID certId = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(issuerCertificate), certificate.getSerialNumber());
    ocspReqBuilder.addRequest(certId);
    OCSPReq ocspReq = ocspReqBuilder.build();
    BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(
            ocspResponderCertificate.getPublicKey(), digCalcProv.get(CertificateID.HASH_SHA1));

    // request processing
    Req[] requestList = ocspReq.getRequestList();
    for (Req ocspRequest : requestList) {
        CertificateID certificateID = ocspRequest.getCertID();
        CertificateStatus certificateStatus;
        if (revoked) {
            certificateStatus = new RevokedStatus(new Date(), CRLReason.unspecified);
        } else {
            certificateStatus = CertificateStatus.GOOD;
        }
        basicOCSPRespBuilder.addResponse(certificateID, certificateStatus);
    }

    // basic response generation
    X509CertificateHolder[] chain;
    if (ocspResponderCertificateChain.isEmpty()) {
        chain = null;
    } else {
        chain = new X509CertificateHolder[ocspResponderCertificateChain.size()];
        for (int idx = 0; idx < chain.length; idx++) {
            chain[idx] = new X509CertificateHolder(ocspResponderCertificateChain.get(idx).getEncoded());
        }
    }

    ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").build(ocspResponderPrivateKey);
    BasicOCSPResp basicOCSPResp = basicOCSPRespBuilder.build(contentSigner, chain, new Date());

    // response generation
    OCSPRespBuilder ocspRespBuilder = new OCSPRespBuilder();
    OCSPResp ocspResp = ocspRespBuilder.build(OCSPRespBuilder.SUCCESSFUL, basicOCSPResp);

    return ocspResp;
}

---

From source file:Controllers.OCSPController.java

License:Apache License

/**
 * Method to do OCSP response to client.
 *
 * @param requestBytes/* w  w w .  j a va2s. c o m*/
 * @param mode
 *
 * @return
 *
 * @throws NotImplementedException
 */
private byte[] processOcspRequest(byte[] requestBytes, OCSP_PROCESS_MODE mode) throws NotImplementedException {
    try {
        // get request info
        OCSPReq ocspRequest = new OCSPReq(requestBytes);
        X509CertificateHolder[] requestCerts = ocspRequest.getCerts();
        Req[] requestList = ocspRequest.getRequestList();
        // setup response
        BasicOCSPRespBuilder responseBuilder = new BasicOCSPRespBuilder(
                new RespID(x509CertificateHolder.getSubject()));
        LOG.info("OCSP request version: " + ocspRequest.getVersionNumber() + ", Requester name: "
                + ocspRequest.getRequestorName() + ", is signed: " + ocspRequest.isSigned()
                + ", has extensions: " + ocspRequest.hasExtensions() + ", number of additional certificates: "
                + requestCerts.length + ", number of certificate ids to verify: " + requestList.length);
        int ocspResult = OCSPRespBuilder.SUCCESSFUL;
        switch (mode) {
        case AUTO:
            LOG.error("Auto OCSP server is not implemented in this version.");
            throw new NotImplementedException();
        case GOOD:
            LOG.warn("Mocked mode, server will always return Good ocsp response");
            for (Req req : requestList) {
                CertificateID certId = req.getCertID();
                String serialNumber = "0x" + certId.getSerialNumber().toString(16);
                LOG.debug(String.format("Processing request for cert serial number:[%s]", serialNumber));
                CertificateStatus certificateStatus = CertificateStatus.GOOD;
                Calendar thisUpdate = new GregorianCalendar();
                Date now = thisUpdate.getTime();
                thisUpdate.add(Calendar.DAY_OF_MONTH, 7);
                Date nexUpdate = thisUpdate.getTime();
                responseBuilder.addResponse(certId, certificateStatus, now, nexUpdate, null);
            }
            break;
        case REVOKED:
            LOG.warn("Mocked mode, server will always return REVOKED ocsp response");
            for (Req req : requestList) {
                CertificateID certId = req.getCertID();
                String serialNumber = "0x" + certId.getSerialNumber().toString(16);
                LOG.debug(String.format("Processing request for cert serial number:[%s]", serialNumber));
                Calendar cal = new GregorianCalendar();
                cal.add(Calendar.DAY_OF_MONTH, -7);//Set revoked 7 days ago.
                CertificateStatus certificateStatus = new RevokedStatus(cal.getTime(), 16);
                Calendar thisUpdate = new GregorianCalendar();
                Date now = thisUpdate.getTime();
                thisUpdate.add(Calendar.DAY_OF_MONTH, 7);
                Date nexUpdate = thisUpdate.getTime();
                responseBuilder.addResponse(certId, certificateStatus, now, nexUpdate, null);
            }
            break;
        case UNKNOWN:
            LOG.warn("Mocked mode, server will always return Known ocsp response");
            for (Req req : requestList) {
                CertificateID certId = req.getCertID();
                String serialNumber = "0x" + certId.getSerialNumber().toString(16);
                LOG.debug(String.format("Processing request for cert serial number:[%s]", serialNumber));
                CertificateStatus certificateStatus = new UnknownStatus();
                Calendar thisUpdate = new GregorianCalendar();
                Date now = thisUpdate.getTime();
                thisUpdate.add(Calendar.DAY_OF_MONTH, 7);
                Date nexUpdate = thisUpdate.getTime();
                responseBuilder.addResponse(certId, certificateStatus, now, nexUpdate, null);
            }
            break;
        }
        // process nonce
        Extension extNonce = ocspRequest.getExtension(new ASN1ObjectIdentifier("1.3.6.1.5.5.7.48.1.2"));
        if (extNonce != null) {
            LOG.debug("Nonce is present in the request");
            responseBuilder.setResponseExtensions(new Extensions(extNonce));
        } else {
            LOG.info("Nonce is not present in the request");
            if (bRequireNonce) {
                LOG.info("Nonce is required, fail the request");
                ocspResult = OCSPRespBuilder.UNAUTHORIZED;
            }
        }
        X509CertificateHolder[] chain = { x509CertificateHolder };
        ContentSigner signer = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC").build(privateKey);
        BasicOCSPResp ocspResponse = responseBuilder.build(signer, chain, Calendar.getInstance().getTime());
        OCSPRespBuilder ocspResponseBuilder = new OCSPRespBuilder();
        byte[] encoded = ocspResponseBuilder.build(ocspResult, ocspResponse).getEncoded();
        LOG.info("Sending OCSP response to client, size: " + encoded.length);
        return encoded;

    } catch (Exception e) {
        LOG.error("Exception during processing OCSP request: " + e.getMessage());
        e.printStackTrace();
    }
    return null;
}

---

From source file:ee.ria.xroad.common.cert.CertChainTest.java

License:Open Source License

/**
 * Tests that verifying a chain with invalid OCSP responses fails.
 * @throws Exception if an error occurs/* w ww  . jav  a 2s.  c  o m*/
 */
@Test
public void invalidOcspResponse() throws Exception {
    X509Certificate rootCa = TestCertUtil.getCertChainCert("root_ca.p12");
    X509Certificate interCa1 = TestCertUtil.getCertChainCert("ca_1.p12");
    X509Certificate interCa2 = TestCertUtil.getCertChainCert("ca_2.p12");
    X509Certificate interCa3 = TestCertUtil.getCertChainCert("ca_3.p12");
    X509Certificate userCert = TestCertUtil.getCertChainCert("user_3.p12");

    List<OCSPResp> ocsp = generateOcspResponses(Arrays.asList(interCa1, interCa2, interCa3, userCert),
            new RevokedStatus(new Date(), 0));

    CertChain chain = new CertChain("EE", userCert, rootCa, Arrays.asList(interCa1, interCa2, interCa3));
    try {
        verify(chain, ocsp, makeDate(rootCa.getNotBefore(), 1));
        fail("OCSP verification should fail");
    } catch (CodedException e) {
        assertTrue(e.getFaultCode().startsWith(ErrorCodes.X_INVALID_CERT_PATH_X));
    }
}

---

From source file:ee.ria.xroad.common.ocsp.OcspVerifierTest.java

License:Open Source License

/**
 * Tests that verifying succeeds if certificate status is revoked.
 * @throws Exception if an error occurs/* w ww .ja v a2s. c  om*/
 */
@Test
public void certStatusRevoked() throws Exception {
    Date thisUpdate = new DateTime().plusDays(1).toDate();
    OCSPResp ocsp = OcspTestUtils.createOCSPResponse(subject, issuer, signer, signerKey,
            new RevokedStatus(new Date(), CRLReason.unspecified), thisUpdate, null);

    thrown.expectError(X_CERT_VALIDATION);
    OcspVerifier verifier = new OcspVerifier(GlobalConf.getOcspFreshnessSeconds(true),
            new OcspVerifierOptions(true));
    verifier.verifyValidityAndStatus(ocsp, subject, issuer);
}

---

From source file:eu.europa.esig.dss.cookbook.sources.AlwaysValidOCSPSource.java

License:Open Source License

/**
 * This method allows to set the status of the cert to REVOKED.
 *
 * unspecified = 0; keyCompromise = 1; cACompromise = 2; affiliationChanged = 3; superseded = 4;
 * cessationOfOperation = 5; certificateHold = 6; // 7 -> unknown removeFromCRL = 8; privilegeWithdrawn = 9;
 * aACompromise = 10;//from   w  ww .j a v a2  s . c  o m
 *
 * @param revocationDate
 * @param revocationReasonId
 */
public void setRevokedStatus(final Date revocationDate, final int revocationReasonId) {

    this.expectedResponse = new RevokedStatus(revocationDate, revocationReasonId);
}

---

From source file:eu.europa.esig.dss.cookbook.sources.AlwaysValidOCSPSource.java

License:Open Source License

@Override
public OCSPToken getOCSPToken(CertificateToken certificateToken, CertificateToken issuerCertificateToken) {

    try {/*  www .  j av a2s.c  o  m*/

        final X509Certificate cert = certificateToken.getCertificate();
        final BigInteger serialNumber = cert.getSerialNumber();
        X509Certificate issuerCert = issuerCertificateToken.getCertificate();
        final OCSPReq ocspReq = generateOCSPRequest(issuerCert, serialNumber);

        final DigestCalculator digestCalculator = DSSRevocationUtils.getSHA1DigestCalculator();
        final BasicOCSPRespBuilder basicOCSPRespBuilder = new JcaBasicOCSPRespBuilder(issuerCert.getPublicKey(),
                digestCalculator);
        final Extension extension = ocspReq.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
        if (extension != null) {

            basicOCSPRespBuilder.setResponseExtensions(new Extensions(new Extension[] { extension }));
        }
        final Req[] requests = ocspReq.getRequestList();
        for (int ii = 0; ii != requests.length; ii++) {

            final Req req = requests[ii];
            final CertificateID certID = req.getCertID();

            boolean isOK = true;

            if (isOK) {

                basicOCSPRespBuilder.addResponse(certID, CertificateStatus.GOOD, ocspDate, null, null);
            } else {

                Date revocationDate = DSSUtils.getDate(ocspDate, -1);
                basicOCSPRespBuilder.addResponse(certID,
                        new RevokedStatus(revocationDate, CRLReason.privilegeWithdrawn));
            }
        }

        final ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
                .build(privateKey);
        final X509CertificateHolder x509CertificateHolder = new X509CertificateHolder(issuerCert.getEncoded());
        final X509CertificateHolder[] chain = { x509CertificateHolder };
        BasicOCSPResp basicResp = basicOCSPRespBuilder.build(contentSigner, chain, ocspDate);
        final SingleResp[] responses = basicResp.getResponses();

        final OCSPToken ocspToken = new OCSPToken();
        ocspToken.setBasicOCSPResp(basicResp);
        ocspToken.setBestSingleResp(responses[0]);
        return ocspToken;
    } catch (OCSPException e) {
        throw new DSSException(e);
    } catch (IOException e) {
        throw new DSSException(e);
    } catch (CertificateEncodingException e) {
        throw new DSSException(e);
    } catch (OperatorCreationException e) {
        throw new DSSException(e);
    }
}

---

From source file:net.maritimecloud.identityregistry.controllers.CertificateController.java

License:Apache License

protected byte[] handleOCSP(byte[] input, String certAlias) throws IOException {
    OCSPReq ocspreq = new OCSPReq(input);
    /* TODO: verify signature - needed?
    if (ocspreq.isSigned()) {//from  w ww. ja v  a2s .  c  om
    }*/
    BasicOCSPRespBuilder respBuilder = Revocation.initOCSPRespBuilder(ocspreq,
            certUtil.getKeystoreHandler().getMCCertificate(certAlias).getPublicKey());
    Req[] requests = ocspreq.getRequestList();
    for (Req req : requests) {
        BigInteger sn = req.getCertID().getSerialNumber();
        Certificate cert = this.certificateService.getCertificateBySerialNumber(sn);

        if (cert == null) {
            respBuilder.addResponse(req.getCertID(), new UnknownStatus());

            // Check if the certificate is even signed by this CA
        } else if (!certAlias.equals(cert.getCertificateAuthority())) {
            respBuilder.addResponse(req.getCertID(), new UnknownStatus());

            // Check if certificate has been revoked
        } else if (cert.isRevoked()) {
            respBuilder.addResponse(req.getCertID(), new RevokedStatus(cert.getRevokedAt(),
                    Revocation.getCRLReasonFromString(cert.getRevokeReason())));

        } else {
            // Certificate is valid
            respBuilder.addResponse(req.getCertID(), CertificateStatus.GOOD);
        }
    }
    OCSPResp response = Revocation.generateOCSPResponse(respBuilder,
            certUtil.getKeystoreHandler().getSigningCertEntry(certAlias));
    return response.getEncoded();
}

---

From source file:org.apache.poi.poifs.crypt.PkiTestUtils.java

License:Apache License

public static OCSPResp createOcspResp(X509Certificate certificate, boolean revoked,
        X509Certificate issuerCertificate, X509Certificate ocspResponderCertificate,
        PrivateKey ocspResponderPrivateKey, String signatureAlgorithm, long nonceTimeinMillis)
        throws Exception {
    DigestCalculator digestCalc = new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()
            .get(CertificateID.HASH_SHA1);
    X509CertificateHolder issuerHolder = new X509CertificateHolder(issuerCertificate.getEncoded());
    CertificateID certId = new CertificateID(digestCalc, issuerHolder, certificate.getSerialNumber());

    // request//from w  w w . j av  a  2  s .  co  m
    //create a nonce to avoid replay attack
    BigInteger nonce = BigInteger.valueOf(nonceTimeinMillis);
    DEROctetString nonceDer = new DEROctetString(nonce.toByteArray());
    Extension ext = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, true, nonceDer);
    Extensions exts = new Extensions(ext);

    OCSPReqBuilder ocspReqBuilder = new OCSPReqBuilder();
    ocspReqBuilder.addRequest(certId);
    ocspReqBuilder.setRequestExtensions(exts);
    OCSPReq ocspReq = ocspReqBuilder.build();

    SubjectPublicKeyInfo keyInfo = new SubjectPublicKeyInfo(CertificateID.HASH_SHA1,
            ocspResponderCertificate.getPublicKey().getEncoded());

    BasicOCSPRespBuilder basicOCSPRespBuilder = new BasicOCSPRespBuilder(keyInfo, digestCalc);
    basicOCSPRespBuilder.setResponseExtensions(exts);

    // request processing
    Req[] requestList = ocspReq.getRequestList();
    for (Req ocspRequest : requestList) {
        CertificateID certificateID = ocspRequest.getCertID();
        CertificateStatus certificateStatus = CertificateStatus.GOOD;
        if (revoked) {
            certificateStatus = new RevokedStatus(new Date(), CRLReason.privilegeWithdrawn);
        }
        basicOCSPRespBuilder.addResponse(certificateID, certificateStatus);
    }

    // basic response generation
    X509CertificateHolder[] chain = null;
    if (!ocspResponderCertificate.equals(issuerCertificate)) {
        // TODO: HorribleProxy can't convert array input params yet
        chain = new X509CertificateHolder[] { new X509CertificateHolder(ocspResponderCertificate.getEncoded()),
                issuerHolder };
    }

    ContentSigner contentSigner = new JcaContentSignerBuilder("SHA1withRSA").setProvider("BC")
            .build(ocspResponderPrivateKey);
    BasicOCSPResp basicOCSPResp = basicOCSPRespBuilder.build(contentSigner, chain, new Date(nonceTimeinMillis));

    OCSPRespBuilder ocspRespBuilder = new OCSPRespBuilder();
    OCSPResp ocspResp = ocspRespBuilder.build(OCSPRespBuilder.SUCCESSFUL, basicOCSPResp);

    return ocspResp;
}

---

From source file:org.conscrypt.java.security.TestKeyStore.java

License:Apache License

public static byte[] getOCSPResponseForRevoked(PrivateKeyEntry server, PrivateKeyEntry issuer)
        throws CertificateException {
    try {/*  w  w  w .  j  ava 2 s .  co  m*/
        return generateOCSPResponse(server, issuer, new RevokedStatus(new Date(), CRLReason.keyCompromise))
                .getEncoded();
    } catch (IOException e) {
        throw new CertificateException(e);
    }
}

---

• «
• 1
• 2
• »