Example usage for org.bouncycastle.cert.ocsp SingleResp getCertStatus

List of usage examples for org.bouncycastle.cert.ocsp SingleResp getCertStatus

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.cert.ocsp.*
  5. SingleResp
  6. getCertStatus

Introduction

In this page you can find the example usage for org.bouncycastle.cert.ocsp SingleResp getCertStatus.

Prototype

public CertificateStatus getCertStatus()

Source Link

Document

Return the status object for the response - null indicates good.

Usage

From source file:be.fedict.trust.ocsp.OcspTrustLinker.java

License:Open Source License

@Override
public TrustLinkerResult hasTrustLink(X509Certificate childCertificate, X509Certificate certificate,
        Date validationDate, RevocationData revocationData, AlgorithmPolicy algorithmPolicy)
        throws TrustLinkerResultException, Exception {
    URI ocspUri = getOcspUri(childCertificate);
    if (null == ocspUri) {
        return TrustLinkerResult.UNDECIDED;
    }//from  w w w.j av  a2s  .  c o m
    LOG.debug("OCSP URI: " + ocspUri);

    OCSPResp ocspResp = this.ocspRepository.findOcspResponse(ocspUri, childCertificate, certificate,
            validationDate);
    if (null == ocspResp) {
        LOG.debug("OCSP response not found");
        return TrustLinkerResult.UNDECIDED;
    }

    int ocspRespStatus = ocspResp.getStatus();
    if (OCSPResponseStatus.SUCCESSFUL != ocspRespStatus) {
        LOG.debug("OCSP response status: " + ocspRespStatus);
        return TrustLinkerResult.UNDECIDED;
    }

    Object responseObject = ocspResp.getResponseObject();
    BasicOCSPResp basicOCSPResp = (BasicOCSPResp) responseObject;

    X509CertificateHolder[] responseCertificates = basicOCSPResp.getCerts();
    for (X509CertificateHolder responseCertificate : responseCertificates) {
        LOG.debug("OCSP response cert: " + responseCertificate.getSubject());
        LOG.debug("OCSP response cert issuer: " + responseCertificate.getIssuer());
    }

    algorithmPolicy.checkSignatureAlgorithm(basicOCSPResp.getSignatureAlgOID().getId(), validationDate);

    if (0 == responseCertificates.length) {
        /*
         * This means that the OCSP response has been signed by the issuing
         * CA itself.
         */
        ContentVerifierProvider contentVerifierProvider = new JcaContentVerifierProviderBuilder()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(certificate.getPublicKey());
        boolean verificationResult = basicOCSPResp.isSignatureValid(contentVerifierProvider);
        if (false == verificationResult) {
            LOG.debug("OCSP response signature invalid");
            return TrustLinkerResult.UNDECIDED;
        }
    } else {
        /*
         * We're dealing with a dedicated authorized OCSP Responder
         * certificate, or of course with a CA that issues the OCSP
         * Responses itself.
         */

        X509CertificateHolder ocspResponderCertificate = responseCertificates[0];
        ContentVerifierProvider contentVerifierProvider = new JcaContentVerifierProviderBuilder()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(ocspResponderCertificate);

        boolean verificationResult = basicOCSPResp.isSignatureValid(contentVerifierProvider);
        if (false == verificationResult) {
            LOG.debug("OCSP Responser response signature invalid");
            return TrustLinkerResult.UNDECIDED;
        }
        if (false == Arrays.equals(certificate.getEncoded(), ocspResponderCertificate.getEncoded())) {
            // check certificate signature algorithm
            algorithmPolicy.checkSignatureAlgorithm(
                    ocspResponderCertificate.getSignatureAlgorithm().getAlgorithm().getId(), validationDate);

            X509Certificate issuingCaCertificate;
            if (responseCertificates.length < 2) {
                // so the OCSP certificate chain only contains a single
                // entry
                LOG.debug("OCSP responder complete certificate chain missing");
                /*
                 * Here we assume that the OCSP Responder is directly signed
                 * by the CA.
                 */
                issuingCaCertificate = certificate;
            } else {
                CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
                issuingCaCertificate = (X509Certificate) certificateFactory
                        .generateCertificate(new ByteArrayInputStream(responseCertificates[1].getEncoded()));
                /*
                 * Is next check really required?
                 */
                if (false == certificate.equals(issuingCaCertificate)) {
                    LOG.debug("OCSP responder certificate not issued by CA");
                    return TrustLinkerResult.UNDECIDED;
                }
            }
            // check certificate signature
            algorithmPolicy.checkSignatureAlgorithm(issuingCaCertificate.getSigAlgOID(), validationDate);

            PublicKeyTrustLinker publicKeyTrustLinker = new PublicKeyTrustLinker();
            CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
            X509Certificate x509OcspResponderCertificate = (X509Certificate) certificateFactory
                    .generateCertificate(new ByteArrayInputStream(ocspResponderCertificate.getEncoded()));
            LOG.debug("OCSP Responder public key fingerprint: "
                    + DigestUtils.sha1Hex(x509OcspResponderCertificate.getPublicKey().getEncoded()));
            publicKeyTrustLinker.hasTrustLink(x509OcspResponderCertificate, issuingCaCertificate,
                    validationDate, revocationData, algorithmPolicy);
            if (null == x509OcspResponderCertificate
                    .getExtensionValue(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck.getId())) {
                LOG.debug("OCSP Responder certificate should have id-pkix-ocsp-nocheck");
                /*
                 * TODO: perform CRL validation on the OCSP Responder
                 * certificate. On the other hand, do we really want to
                 * check the checker?
                 */
                return TrustLinkerResult.UNDECIDED;
            }
            List<String> extendedKeyUsage = x509OcspResponderCertificate.getExtendedKeyUsage();
            if (null == extendedKeyUsage) {
                LOG.debug("OCSP Responder certificate has no extended key usage extension");
                return TrustLinkerResult.UNDECIDED;
            }
            if (false == extendedKeyUsage.contains(KeyPurposeId.id_kp_OCSPSigning.getId())) {
                LOG.debug("OCSP Responder certificate should have a OCSPSigning extended key usage");
                return TrustLinkerResult.UNDECIDED;
            }
        } else {
            LOG.debug("OCSP Responder certificate equals the CA certificate");
            // and the CA certificate is already trusted at this point
        }
    }

    DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder()
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build();
    CertificateID certificateId = new CertificateID(digCalcProv.get(CertificateID.HASH_SHA1),
            new JcaX509CertificateHolder(certificate), childCertificate.getSerialNumber());

    SingleResp[] singleResps = basicOCSPResp.getResponses();
    for (SingleResp singleResp : singleResps) {
        CertificateID responseCertificateId = singleResp.getCertID();
        if (false == certificateId.equals(responseCertificateId)) {
            continue;
        }
        DateTime thisUpdate = new DateTime(singleResp.getThisUpdate());
        DateTime nextUpdate;
        if (null != singleResp.getNextUpdate()) {
            nextUpdate = new DateTime(singleResp.getNextUpdate());
        } else {
            LOG.debug("no OCSP nextUpdate");
            nextUpdate = thisUpdate;
        }
        LOG.debug("OCSP thisUpdate: " + thisUpdate);
        LOG.debug("(OCSP) nextUpdate: " + nextUpdate);
        DateTime beginValidity = thisUpdate.minus(this.freshnessInterval);
        DateTime endValidity = nextUpdate.plus(this.freshnessInterval);
        DateTime validationDateTime = new DateTime(validationDate);
        if (validationDateTime.isBefore(beginValidity)) {
            LOG.warn("OCSP response not yet valid");
            continue;
        }
        if (validationDateTime.isAfter(endValidity)) {
            LOG.warn("OCSP response expired");
            continue;
        }
        if (null == singleResp.getCertStatus()) {
            LOG.debug("OCSP OK for: " + childCertificate.getSubjectX500Principal());
            addRevocationData(revocationData, ocspResp, ocspUri);
            return TrustLinkerResult.TRUSTED;
        } else {
            LOG.debug("OCSP certificate status: " + singleResp.getCertStatus().getClass().getName());
            if (singleResp.getCertStatus() instanceof RevokedStatus) {
                LOG.debug("OCSP status revoked");
            }
            addRevocationData(revocationData, ocspResp, ocspUri);
            throw new TrustLinkerResultException(TrustLinkerResultReason.INVALID_REVOCATION_STATUS,
                    "certificate revoked by OCSP");
        }
    }

    LOG.debug("no matching OCSP response entry");
    return TrustLinkerResult.UNDECIDED;
}

From source file:com.itextpdf.signatures.OcspClientBouncyCastle.java

License:Open Source License

/**
 * Gets an encoded byte array with OCSP validation. The method should not throw an exception.
 *
 * @param checkCert to certificate to check
 * @param rootCert  the parent certificate
 * @param url       to get the verification. It it's null it will be taken
 *                  from the check cert or from other implementation specific source
 * @return a byte array with the validation or null if the validation could not be obtained
 *//*w w w.  j  a v a 2  s.  com*/
public byte[] getEncoded(X509Certificate checkCert, X509Certificate rootCert, String url) {
    try {
        BasicOCSPResp basicResponse = getBasicOCSPResp(checkCert, rootCert, url);
        if (basicResponse != null) {
            SingleResp[] responses = basicResponse.getResponses();
            if (responses.length == 1) {
                SingleResp resp = responses[0];
                Object status = resp.getCertStatus();
                if (status == CertificateStatus.GOOD) {
                    return basicResponse.getEncoded();
                } else if (status instanceof org.bouncycastle.ocsp.RevokedStatus) {
                    throw new java.io.IOException(LogMessageConstant.OCSP_STATUS_IS_REVOKED);
                } else {
                    throw new java.io.IOException(LogMessageConstant.OCSP_STATUS_IS_UNKNOWN);
                }
            }
        }
    } catch (Exception ex) {
        LOGGER.error(ex.getMessage());
    }
    return null;
}

From source file:com.itextpdf.signatures.OCSPVerifier.java

License:Open Source License

/**
 * Gets an OCSP response online and returns it if the status is GOOD
 * (without further checking!).// w  ww . j  a  va  2  s.  c  om
 * @param signCert   the signing certificate
 * @param issuerCert   the issuer certificate
 * @return an OCSP response
 */
public BasicOCSPResp getOcspResponse(X509Certificate signCert, X509Certificate issuerCert) {
    if (signCert == null && issuerCert == null) {
        return null;
    }
    OcspClientBouncyCastle ocsp = new OcspClientBouncyCastle(null);
    BasicOCSPResp ocspResp = ocsp.getBasicOCSPResp(signCert, issuerCert, null);
    if (ocspResp == null) {
        return null;
    }
    SingleResp[] resps = ocspResp.getResponses();
    for (SingleResp resp : resps) {
        Object status = resp.getCertStatus();
        if (status == CertificateStatus.GOOD) {
            return ocspResp;
        }
    }
    return null;
}

From source file:com.itextpdf.text.pdf.security.OcspClientBouncyCastle.java

License:Open Source License

/**
 * Gets an encoded byte array with OCSP validation. The method should not throw an exception.
  * @param checkCert to certificate to check
  * @param rootCert the parent certificate
  * @param the url to get the verification. It it's null it will be taken
  * from the check cert or from other implementation specific source
 * @return   a byte array with the validation or null if the validation could not be obtained
 *//* ww  w. j a v  a2  s.c o m*/
public byte[] getEncoded(X509Certificate checkCert, X509Certificate rootCert, String url) {
    try {
        BasicOCSPResp basicResponse = getBasicOCSPResp(checkCert, rootCert, url);
        if (basicResponse != null) {
            SingleResp[] responses = basicResponse.getResponses();
            if (responses.length == 1) {
                SingleResp resp = responses[0];
                Object status = resp.getCertStatus();
                if (status == CertificateStatus.GOOD) {
                    return basicResponse.getEncoded();
                } else if (status instanceof org.bouncycastle.ocsp.RevokedStatus) {
                    throw new IOException(MessageLocalization.getComposedMessage("ocsp.status.is.revoked"));
                } else {
                    throw new IOException(MessageLocalization.getComposedMessage("ocsp.status.is.unknown"));
                }
            }
        }
    } catch (Exception ex) {
        if (LOGGER.isLogging(Level.ERROR))
            LOGGER.error(ex.getMessage());
    }
    return null;
}

From source file:controller.CCInstance.java

License:Open Source License

public final ArrayList<SignatureValidation> validatePDF(final String file, final ValidationListener vl)
        throws IOException, DocumentException, GeneralSecurityException {
    this.validating = true;

    final PdfReader reader = new PdfReader(file);
    final AcroFields af = reader.getAcroFields();
    final ArrayList names = af.getSignatureNames();
    final ArrayList<SignatureValidation> validateList = new ArrayList<>();
    X509Certificate x509c = null;

    Security.setProperty("ocsp.enable", "true");
    System.setProperty("com.sun.security.enableCRLDP", "true");

    boolean nextValid = true;

    for (Object o : names) {
        if (!validating) {
            return null;
        }//from w w w .  ja va 2s . com

        final String name = (String) o;
        final PdfPKCS7 pk = af.verifySignature(name, "BC");
        final Certificate pkc[] = pk.getCertificates();
        x509c = (X509Certificate) pkc[pkc.length - 1];

        final Certificate[] aL = pkc;//getCompleteCertificateChain(x509c);

        if (null == aL || 0 == aL.length) {
            return null;
        }

        CertificateStatus ocspCertificateStatus = CertificateStatus.UNCHECKED;

        BasicOCSPResp ocspResp = pk.getOcsp();
        if (null != ocspResp && pk.isRevocationValid()) {
            for (SingleResp singleResp : ocspResp.getResponses()) {
                if (null == singleResp.getCertStatus()) {
                    ocspCertificateStatus = CertificateStatus.OK;
                } else if (singleResp.getCertStatus() instanceof RevokedStatus) {
                    if (ocspResp.getProducedAt()
                            .before(((RevokedStatus) singleResp.getCertStatus()).getRevocationTime())) {
                        ocspCertificateStatus = CertificateStatus.OK;
                    } else {
                        ocspCertificateStatus = CertificateStatus.REVOKED;
                    }
                } else if (singleResp.getCertStatus() instanceof UnknownStatus) {
                    ocspCertificateStatus = CertificateStatus.UNKNOWN;
                }
            }
        }

        CertificateStatus crlCertificateStatus = CertificateStatus.UNCHECKED;
        Collection<CRL> crlResp = pk.getCRLs();
        if (null != crlResp) {
            boolean revoked = false;
            for (CRL crl : crlResp) {
                if (crl.isRevoked(x509c)) {
                    revoked = true;
                }
            }
            crlCertificateStatus = revoked ? CertificateStatus.REVOKED : CertificateStatus.OK;
        }

        if (ocspCertificateStatus.equals(CertificateStatus.UNCHECKED)
                && crlCertificateStatus.equals(CertificateStatus.UNCHECKED)) {
            if (pkc.length == 1) {
                Certificate[] completeChain = getCompleteTrustedCertificateChain(x509c);
                if (completeChain.length == 1) {
                    ocspCertificateStatus = CertificateStatus.UNCHAINED;
                } else {
                    ocspCertificateStatus = CertificateStatus.CHAINED_LOCALLY;
                }
            }
        }

        final TimeStampToken tst = pk.getTimeStampToken();
        boolean validTimestamp = false;
        if (null != tst) {
            final boolean hasTimestamp = pk.verifyTimestampImprint();
            validTimestamp = hasTimestamp && CertificateVerification.verifyTimestampCertificates(tst, ks, null);
        }

        PdfDictionary pdfDic = reader.getAcroFields().getSignatureDictionary(name);
        SignaturePermissions sp = new SignaturePermissions(pdfDic, null);

        boolean isValid;
        if (nextValid) {
            isValid = pk.verify();
        } else {
            isValid = false;
        }

        List<AcroFields.FieldPosition> posList = af.getFieldPositions(name);
        final SignatureValidation signature = new SignatureValidation(file, name, pk, !pk.verify(),
                af.signatureCoversWholeDocument(name), af.getRevision(name), af.getTotalRevisions(),
                reader.getCertificationLevel(), ocspCertificateStatus, crlCertificateStatus, validTimestamp,
                posList, sp, isValid);
        validateList.add(signature);

        if (null != vl) {
            vl.onValidationComplete(signature);
        }
        if (!sp.isFillInAllowed()) {
            nextValid = false;
        }
    }
    return validateList;
}

From source file:ec.rubrica.ocsp.ValidadorOCSP.java

License:Open Source License

public static void check(X509Certificate issuerCert, X509Certificate x509Cert)
        throws OcspValidationException, OcspTimeoutException {
    try {/*from  ww  w .  j  a v  a  2s  .  co m*/
        BigInteger serialNumber = x509Cert.getSerialNumber();
        X509CertificateHolder holder;

        try {
            holder = new X509CertificateHolder(issuerCert.getEncoded());
        } catch (IOException e) {
            throw new RuntimeException(e);
        }

        CertificateID id = new CertificateID(new JcaDigestCalculatorProviderBuilder()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).build().get(CertificateID.HASH_SHA1), holder,
                serialNumber);

        OCSPReqBuilder ocspGen = new OCSPReqBuilder();
        ocspGen.addRequest(id);
        OCSPReq ocspReq = ocspGen.build();

        // Ir al OCSP
        String ocspUrl = CertificateUtil.getOCSPURL(x509Cert);

        if (ocspUrl == null) {
            logger.info("URL de OCSP is null");
            return;
        }

        URL url;

        try {
            url = new URL(ocspUrl);
        } catch (MalformedURLException e) {
            throw new RuntimeException(e);
        }

        HttpURLConnection con;
        OCSPResp ocspResponse;

        try {
            con = (HttpURLConnection) url.openConnection();

            con.setRequestProperty("Content-Type", "application/ocsp-request");
            con.setRequestProperty("Accept", "application/ocsp-response");
            con.setDoOutput(true);

            OutputStream out = con.getOutputStream();
            DataOutputStream dataOut = new DataOutputStream(new BufferedOutputStream(out));
            dataOut.write(ocspReq.getEncoded());

            dataOut.flush();
            dataOut.close();

            /*
             * Se parsea la respuesta y se obtiene el estado del certificado
             * retornado por el OCSP
             */
            InputStream in = (InputStream) con.getContent();
            byte[] resp = read(in); // Read the reponse
            ocspResponse = new OCSPResp(resp);
        } catch (IOException e) {
            throw new OcspTimeoutException(url);
        }

        int status = ocspResponse.getStatus();
        System.out.println("status=" + status);

        BasicOCSPResp basicResponse = (BasicOCSPResp) ocspResponse.getResponseObject();

        if (basicResponse != null) {
            SingleResp[] responses = basicResponse.getResponses();
            SingleResp response = responses[0];
            CertificateStatus certStatus = response.getCertStatus();

            if (certStatus instanceof RevokedStatus) {
                System.out.println("REVOKED");
                RevokedStatus revokedStatus = (RevokedStatus) certStatus;
                System.out.println("Reason: " + revokedStatus.getRevocationReason());
                System.out.println("Date: " + revokedStatus.getRevocationTime());

                throw new OcspValidationException(revokedStatus.getRevocationReason(),
                        revokedStatus.getRevocationTime());
            }
        }
    } catch (OCSPException e) {
        throw new RuntimeException(e);
    } catch (CertificateEncodingException e) {
        throw new RuntimeException(e);
    } catch (OperatorCreationException e) {
        throw new RuntimeException(e);
    }
}

From source file:ee.ria.xroad.common.ocsp.OcspVerifier.java

License:Open Source License

/**
 * Verifies the status of the OCSP response.
 * @param response the OCSP response//from  w w w .  j a va2 s. c  om
 * @throws Exception CodedException with error code X_CERT_VALIDATION
 * if status is not good.
 */
public static void verifyStatus(OCSPResp response) throws Exception {
    BasicOCSPResp basicResp = (BasicOCSPResp) response.getResponseObject();
    SingleResp singleResp = basicResp.getResponses()[0];

    CertificateStatus status = singleResp.getCertStatus();
    if (status != null) { // null indicates GOOD.
        throw new CodedException(X_CERT_VALIDATION, "OCSP response indicates certificate status is %s",
                getStatusString(status));
    }
}

From source file:ee.ria.xroad.signer.console.Utils.java

License:Open Source License

@SneakyThrows
static String getOcspStatus(byte[] ocspBytes) {
    if (ocspBytes == null) {
        return "<not available>";
    }// w  w  w  .  ja  v  a2 s. c o m

    OCSPResp response = new OCSPResp(ocspBytes);
    BasicOCSPResp basicResponse = (BasicOCSPResp) response.getResponseObject();
    SingleResp resp = basicResponse.getResponses()[0];
    CertificateStatus status = resp.getCertStatus();

    if (status == CertificateStatus.GOOD) {
        return "GOOD";
    } else if (status instanceof org.bouncycastle.cert.ocsp.RevokedStatus) {
        return "REVOKED";
    } else if (status instanceof org.bouncycastle.cert.ocsp.UnknownStatus) {
        return "UNKNOWN";
    } else {
        return "{" + status.getClass() + "}";
    }
}

From source file:eu.europa.ec.markt.dss.validation102853.OCSPCertificateVerifier.java

License:Open Source License

@Override
public RevocationToken check(final CertificateToken toCheckToken) {

    if (ocspSource == null) {

        LOG.warn("OCSPSource null");
        toCheckToken.extraInfo().infoOCSPSourceIsNull();
        return null;
    }/*from  www  .j a  va 2 s .  com*/
    try {

        final X509Certificate issuerCert = toCheckToken.getIssuerToken().getCertificate();
        final X509Certificate toCheckCert = toCheckToken.getCertificate();
        final BasicOCSPResp basicOCSPResp = ocspSource.getOCSPResponse(toCheckCert, issuerCert);
        if (basicOCSPResp == null) {

            String uri = "";
            if (ocspSource instanceof OnlineOCSPSource) {

                uri = ((OnlineOCSPSource) ocspSource).getAccessLocation(toCheckCert);
                toCheckToken.extraInfo().infoNoOCSPResponse(uri);
            }

            if (LOG.isInfoEnabled()) {
                LOG.info("OCSP response not found for " + toCheckToken.getDSSIdAsString() + " [" + uri + "]");
            }
            return null;
        }
        final BigInteger serialNumber = toCheckCert.getSerialNumber();
        final X509CertificateHolder x509CertificateHolder = new X509CertificateHolder(
                DSSUtils.getEncoded(issuerCert));
        final DigestCalculator digestCalculator = DSSUtils.getSHA1DigestCalculator();
        final CertificateID certificateId = new CertificateID(digestCalculator, x509CertificateHolder,
                serialNumber);
        final SingleResp[] singleResps = basicOCSPResp.getResponses();
        for (final SingleResp singleResp : singleResps) {
            if (!DSSRevocationUtils.matches(certificateId, singleResp)) {

                continue;
            }
            if (LOG.isDebugEnabled()) {

                LOG.debug("OCSP thisUpdate: " + singleResp.getThisUpdate());
                LOG.debug("OCSP nextUpdate: " + singleResp.getNextUpdate());
            }
            final OCSPToken ocspToken = new OCSPToken(basicOCSPResp, validationCertPool);
            if (ocspSource instanceof OnlineOCSPSource) {

                ocspToken.setSourceURI(((OnlineOCSPSource) ocspSource).getAccessLocation(toCheckCert));
            }

            ocspToken.setIssuingTime(basicOCSPResp.getProducedAt());
            toCheckToken.setRevocationToken(ocspToken);
            final Object certStatus = singleResp.getCertStatus();
            if (certStatus == null) {

                if (LOG.isInfoEnabled()) {
                    LOG.info("OCSP OK for: " + toCheckToken.getDSSIdAsString());
                    if (LOG.isTraceEnabled()) {
                        LOG.trace("CertificateToken:\n{}", toCheckToken.toString());
                    }
                }
                ocspToken.setStatus(true);
            } else {

                if (LOG.isInfoEnabled()) {
                    LOG.info("OCSP certificate status: " + certStatus.getClass().getName());
                }
                if (certStatus instanceof RevokedStatus) {

                    if (LOG.isInfoEnabled()) {
                        LOG.info("OCSP status revoked");
                    }
                    final RevokedStatus revokedStatus = (RevokedStatus) certStatus;
                    ocspToken.setStatus(false);
                    ocspToken.setRevocationDate(revokedStatus.getRevocationTime());
                    final int reasonId = revokedStatus.getRevocationReason();
                    final CRLReason crlReason = CRLReason.lookup(reasonId);
                    ocspToken.setReason(crlReason.toString());
                } else if (certStatus instanceof UnknownStatus) {

                    if (LOG.isInfoEnabled()) {
                        LOG.info("OCSP status unknown");
                    }
                    ocspToken.setReason("OCSP status: unknown");
                }
            }
            return ocspToken;
        }
    } catch (DSSException e) {

        LOG.error("OCSP DSS Exception: " + e.getMessage(), e);
        toCheckToken.extraInfo().infoOCSPException(e);
        return null;
    } catch (OCSPException e) {

        LOG.error("OCSP Exception: " + e.getMessage());
        toCheckToken.extraInfo().infoOCSPException(e);
        throw new DSSException(e);
    } catch (IOException e) {
        throw new DSSException(e);
    }
    if (LOG.isInfoEnabled()) {
        LOG.debug("No matching OCSP response entry");
    }
    toCheckToken.extraInfo().infoNoOCSPResponse(null);
    return null;
}

From source file:eu.europa.esig.dss.x509.OCSPToken.java

License:Open Source License

/**
 * The default constructor for OCSPToken.
 *
 * @param basicOCSPResp   The basic OCSP response.
 * @param singleResp/*ww w . jav  a2 s  .  c  o  m*/
 */
public OCSPToken(final BasicOCSPResp basicOCSPResp, final SingleResp singleResp) {

    if (basicOCSPResp == null) {
        throw new NullPointerException();
    }
    if (singleResp == null) {
        throw new NullPointerException();
    }
    this.basicOCSPResp = basicOCSPResp;
    this.singleResp = singleResp;
    this.issuingTime = basicOCSPResp.getProducedAt();
    setStatus(singleResp.getCertStatus());
    final ASN1ObjectIdentifier signatureAlgOID = basicOCSPResp.getSignatureAlgOID();
    final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.forOID(signatureAlgOID.getId());
    this.signatureAlgorithm = signatureAlgorithm;
    this.extraInfo = new TokenValidationExtraInfo();

    if (logger.isTraceEnabled()) {
        logger.trace("OCSP token, produced at '" + DSSUtils.formatInternal(issuingTime) + "' created.");
    }
}