Java BasicReason.UNDETERMINED_REVOCATION_STATUS属性代码示例

/**
 * When a failure happens during certificate checking from an
 * {@link X509TrustManager}, determine what TLS alert description to use.
 *
 * @param cexc The exception thrown by the {@link X509TrustManager}
 *
 * @return A byte value corresponding to a TLS alert description number.
 */
private byte getCertificateAlert(CertificateException cexc) {
    // The specific reason for the failure will determine how to
    // set the alert description value
    byte alertDesc = Alerts.alert_certificate_unknown;

    Throwable baseCause = cexc.getCause();
    if (baseCause instanceof CertPathValidatorException) {
        CertPathValidatorException cpve =
                (CertPathValidatorException)baseCause;
        Reason reason = cpve.getReason();
        if (reason == BasicReason.REVOKED) {
            alertDesc = staplingActive ?
                    Alerts.alert_bad_certificate_status_response :
                    Alerts.alert_certificate_revoked;
        } else if (reason == BasicReason.UNDETERMINED_REVOCATION_STATUS) {
            alertDesc = staplingActive ?
                    Alerts.alert_bad_certificate_status_response :
                    Alerts.alert_certificate_unknown;
        }
    }

    return alertDesc;
}
 

private boolean isSoftFailException(CertPathValidatorException e) {
    if (softFail &&
        e.getReason() == BasicReason.UNDETERMINED_REVOCATION_STATUS)
    {
        // recreate exception with correct index
        CertPathValidatorException e2 = new CertPathValidatorException(
            e.getMessage(), e.getCause(), params.certPath(), certIndex,
            e.getReason());
        softFailExceptions.addFirst(e2);
        return true;
    }
    return false;
}
 

/**
 * We have a cert whose revocation status couldn't be verified by
 * a CRL issued by the cert that issued the CRL. See if we can
 * find a valid CRL issued by a separate key that can verify the
 * revocation status of this certificate.
 * <p>
 * Note that this does not provide support for indirect CRLs,
 * only CRLs signed with a different key (but the same issuer
 * name) as the certificate being checked.
 *
 * @param currCert the <code>X509Certificate</code> to be checked
 * @param prevKey the <code>PublicKey</code> that failed
 * @param signFlag <code>true</code> if that key was trusted to sign CRLs
 * @param stackedCerts a <code>Set</code> of <code>X509Certificate</code>s>
 *                     whose revocation status depends on the
 *                     non-revoked status of this cert. To avoid
 *                     circular dependencies, we assume they're
 *                     revoked while checking the revocation
 *                     status of this cert.
 * @throws CertPathValidatorException if the cert's revocation status
 *         cannot be verified successfully with another key
 */
private void verifyWithSeparateSigningKey(X509Certificate cert,
                                          PublicKey prevKey,
                                          boolean signFlag,
                                          Set<X509Certificate> stackedCerts)
    throws CertPathValidatorException
{
    String msg = "revocation status";
    if (debug != null) {
        debug.println(
            "RevocationChecker.verifyWithSeparateSigningKey()" +
            " ---checking " + msg + "...");
    }

    // reject circular dependencies - RFC 3280 is not explicit on how
    // to handle this, so we feel it is safest to reject them until
    // the issue is resolved in the PKIX WG.
    if ((stackedCerts != null) && stackedCerts.contains(cert)) {
        if (debug != null) {
            debug.println(
                "RevocationChecker.verifyWithSeparateSigningKey()" +
                " circular dependency");
        }
        throw new CertPathValidatorException
            ("Could not determine revocation status", null, null, -1,
             BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }

    // Try to find another key that might be able to sign
    // CRLs vouching for this cert.
    // If prevKey wasn't trusted, maybe we just didn't have the right
    // path to it. Don't rule that key out.
    if (!signFlag) {
        buildToNewKey(cert, null, stackedCerts);
    } else {
        buildToNewKey(cert, prevKey, stackedCerts);
    }
}
 

/**
 * Checks the revocation status of a list of certificates using OCSP.
 *
 * @param certIds the CertIds to be checked
 * @param responderURI the URI of the OCSP responder
 * @param issuerInfo the issuer's certificate and/or subject and public key
 * @param responderCert the OCSP responder's certificate
 * @param date the time the validity of the OCSP responder's certificate
 *    should be checked against. If null, the current time is used.
 * @param extensions zero or more OCSP extensions to be included in the
 *    request.  If no extensions are requested, an empty {@code List} must
 *    be used.  A {@code null} value is not allowed.
 * @return the OCSPResponse
 * @throws IOException if there is an exception connecting to or
 *    communicating with the OCSP responder
 * @throws CertPathValidatorException if an exception occurs while
 *    encoding the OCSP Request or validating the OCSP Response
 */
static OCSPResponse check(List<CertId> certIds, URI responderURI,
                          OCSPResponse.IssuerInfo issuerInfo,
                          X509Certificate responderCert, Date date,
                          List<Extension> extensions, String variant)
    throws IOException, CertPathValidatorException
{
    byte[] nonce = null;
    for (Extension ext : extensions) {
        if (ext.getId().equals(PKIXExtensions.OCSPNonce_Id.toString())) {
            nonce = ext.getValue();
        }
    }

    OCSPResponse ocspResponse = null;
    try {
        byte[] response = getOCSPBytes(certIds, responderURI, extensions);
        ocspResponse = new OCSPResponse(response);

        // verify the response
        ocspResponse.verify(certIds, issuerInfo, responderCert, date,
                nonce, variant);
    } catch (IOException ioe) {
        throw new CertPathValidatorException(
            "Unable to determine revocation status due to network error",
            ioe, null, -1, BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }

    return ocspResponse;
}
 

/**
 * We have a cert whose revocation status couldn't be verified by
 * a CRL issued by the cert that issued the CRL. See if we can
 * find a valid CRL issued by a separate key that can verify the
 * revocation status of this certificate.
 * <p>
 * Note that this does not provide support for indirect CRLs,
 * only CRLs signed with a different key (but the same issuer
 * name) as the certificate being checked.
 *
 * @param currCert the <code>X509Certificate</code> to be checked
 * @param prevKey the <code>PublicKey</code> that failed
 * @param signFlag <code>true</code> if that key was trusted to sign CRLs
 * @param stackedCerts a <code>Set</code> of <code>X509Certificate</code>s>
 *                     whose revocation status depends on the
 *                     non-revoked status of this cert. To avoid
 *                     circular dependencies, we assume they're
 *                     revoked while checking the revocation
 *                     status of this cert.
 * @throws CertPathValidatorException if the cert's revocation status
 *         cannot be verified successfully with another key
 */
private void verifyWithSeparateSigningKey(X509Certificate cert,
                                          PublicKey prevKey,
                                          boolean signFlag,
                                          Set<X509Certificate> stackedCerts)
    throws CertPathValidatorException
{
    String msg = "revocation status";
    if (debug != null) {
        debug.println(
            "RevocationChecker.verifyWithSeparateSigningKey()" +
            " ---checking " + msg + "...");
    }

    // Reject circular dependencies - RFC 5280 is not explicit on how
    // to handle this, but does suggest that they can be a security
    // risk and can create unresolvable dependencies
    if ((stackedCerts != null) && stackedCerts.contains(cert)) {
        if (debug != null) {
            debug.println(
                "RevocationChecker.verifyWithSeparateSigningKey()" +
                " circular dependency");
        }
        throw new CertPathValidatorException
            ("Could not determine revocation status", null, null, -1,
             BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }

    // Try to find another key that might be able to sign
    // CRLs vouching for this cert.
    // If prevKey wasn't trusted, maybe we just didn't have the right
    // path to it. Don't rule that key out.
    if (!signFlag) {
        buildToNewKey(cert, null, stackedCerts);
    } else {
        buildToNewKey(cert, prevKey, stackedCerts);
    }
}
 

/**
 * Checks the revocation status of a list of certificates using OCSP.
 *
 * @param certIds the CertIds to be checked
 * @param responderURI the URI of the OCSP responder
 * @param issuerCert the issuer's certificate
 * @param responderCert the OCSP responder's certificate
 * @param date the time the validity of the OCSP responder's certificate
 *    should be checked against. If null, the current time is used.
 * @param extensions zero or more OCSP extensions to be included in the
 *    request.  If no extensions are requested, an empty {@code List} must
 *    be used.  A {@code null} value is not allowed.
 * @return the OCSPResponse
 * @throws IOException if there is an exception connecting to or
 *    communicating with the OCSP responder
 * @throws CertPathValidatorException if an exception occurs while
 *    encoding the OCSP Request or validating the OCSP Response
 */
static OCSPResponse check(List<CertId> certIds, URI responderURI,
                          X509Certificate issuerCert,
                          X509Certificate responderCert, Date date,
                          List<Extension> extensions)
    throws IOException, CertPathValidatorException
{
    byte[] nonce = null;
    for (Extension ext : extensions) {
        if (ext.getId().equals(PKIXExtensions.OCSPNonce_Id.toString())) {
            nonce = ext.getValue();
        }
    }

    OCSPResponse ocspResponse = null;
    try {
        byte[] response = getOCSPBytes(certIds, responderURI, extensions);
        ocspResponse = new OCSPResponse(response);

        // verify the response
        ocspResponse.verify(certIds, issuerCert, responderCert, date,
                nonce);
    } catch (IOException ioe) {
        throw new CertPathValidatorException(
            "Unable to determine revocation status due to network error",
            ioe, null, -1, BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }

    return ocspResponse;
}
 

/**
 * We have a cert whose revocation status couldn't be verified by
 * a CRL issued by the cert that issued the CRL. See if we can
 * find a valid CRL issued by a separate key that can verify the
 * revocation status of this certificate.
 * <p>
 * Note that this does not provide support for indirect CRLs,
 * only CRLs signed with a different key (but the same issuer
 * name) as the certificate being checked.
 *
 * @param currCert the <code>X509Certificate</code> to be checked
 * @param prevKey the <code>PublicKey</code> that failed
 * @param signFlag <code>true</code> if that key was trusted to sign CRLs
 * @param stackedCerts a <code>Set</code> of <code>X509Certificate</code>s>
 *                     whose revocation status depends on the
 *                     non-revoked status of this cert. To avoid
 *                     circular dependencies, we assume they're
 *                     revoked while checking the revocation
 *                     status of this cert.
 * @throws CertPathValidatorException if the cert's revocation status
 *         cannot be verified successfully with another key
 */
private void verifyWithSeparateSigningKey(X509Certificate currCert,
    PublicKey prevKey, boolean signFlag, Set<X509Certificate> stackedCerts)
    throws CertPathValidatorException {
    String msg = "revocation status";
    if (debug != null) {
        debug.println(
            "CrlRevocationChecker.verifyWithSeparateSigningKey()" +
            " ---checking " + msg + "...");
    }

    // reject circular dependencies - RFC 3280 is not explicit on how
    // to handle this, so we feel it is safest to reject them until
    // the issue is resolved in the PKIX WG.
    if ((stackedCerts != null) && stackedCerts.contains(currCert)) {
        if (debug != null) {
            debug.println(
                "CrlRevocationChecker.verifyWithSeparateSigningKey()" +
                " circular dependency");
        }
        throw new CertPathValidatorException
            ("Could not determine revocation status", null, null,
             -1, BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }

    // If prevKey wasn't trusted, maybe we just didn't have the right
    // path to it. Don't rule that key out.
    if (!signFlag) {
        prevKey = null;
    }

    // Try to find another key that might be able to sign
    // CRLs vouching for this cert.
    buildToNewKey(currCert, prevKey, stackedCerts);
}
 

private void checkOCSP(X509Certificate cert,
                       Collection<String> unresolvedCritExts)
    throws CertPathValidatorException
{
    X509CertImpl currCert = null;
    try {
        currCert = X509CertImpl.toImpl(cert);
    } catch (CertificateException ce) {
        throw new CertPathValidatorException(ce);
    }

    // The algorithm constraints of the OCSP trusted responder certificate
    // does not need to be checked in this code. The constraints will be
    // checked when the responder's certificate is validated.

    OCSPResponse response = null;
    CertId certId = null;
    try {
        certId = new CertId(issuerInfo.getName(), issuerInfo.getPublicKey(),
                currCert.getSerialNumberObject());

        // check if there is a cached OCSP response available
        byte[] responseBytes = ocspResponses.get(cert);
        if (responseBytes != null) {
            if (debug != null) {
                debug.println("Found cached OCSP response");
            }
            response = new OCSPResponse(responseBytes);

            // verify the response
            byte[] nonce = null;
            for (Extension ext : ocspExtensions) {
                if (ext.getId().equals("1.3.6.1.5.5.7.48.1.2")) {
                    nonce = ext.getValue();
                }
            }
            response.verify(Collections.singletonList(certId), issuerInfo,
                    responderCert, params.date(), nonce, params.variant());

        } else {
            URI responderURI = (this.responderURI != null)
                               ? this.responderURI
                               : OCSP.getResponderURI(currCert);
            if (responderURI == null) {
                throw new CertPathValidatorException(
                    "Certificate does not specify OCSP responder", null,
                    null, -1);
            }

            response = OCSP.check(Collections.singletonList(certId),
                    responderURI, issuerInfo, responderCert, null,
                    ocspExtensions, params.variant());
        }
    } catch (IOException e) {
        throw new CertPathValidatorException(
            "Unable to determine revocation status due to network error",
            e, null, -1, BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }

    RevocationStatus rs =
        (RevocationStatus)response.getSingleResponse(certId);
    RevocationStatus.CertStatus certStatus = rs.getCertStatus();
    if (certStatus == RevocationStatus.CertStatus.REVOKED) {
        Date revocationTime = rs.getRevocationTime();
        if (revocationTime.before(params.date())) {
            Throwable t = new CertificateRevokedException(
                revocationTime, rs.getRevocationReason(),
                response.getSignerCertificate().getSubjectX500Principal(),
                rs.getSingleExtensions());
            throw new CertPathValidatorException(t.getMessage(), t, null,
                                                 -1, BasicReason.REVOKED);
        }
    } else if (certStatus == RevocationStatus.CertStatus.UNKNOWN) {
        throw new CertPathValidatorException(
            "Certificate's revocation status is unknown", null,
            params.certPath(), -1,
            BasicReason.UNDETERMINED_REVOCATION_STATUS);
    }
}