org.xdi.oxauth.cert.validation.OCSPCertificateVerifier クラス

org.xdi.oxauth.cert.validation.OCSPCertificateVerifier の継承関係図

org.xdi.oxauth.cert.validation.OCSPCertificateVerifier 連携図

公開メンバ関数
	OCSPCertificateVerifier ()
ValidationStatus	validate (X509Certificate certificate, List< X509Certificate > issuers, Date validationDate)
OCSPResp	requestOCSPResponse (String url, OCSPReq ocspReq) throws IOException, MalformedURLException
void	destroy ()

非公開メンバ関数
OCSPReq	generateOCSPRequest (CertificateID certificateId) throws OCSPException, OperatorCreationException, CertificateEncodingException
String	getOCSPUrl (X509Certificate certificate) throws IOException

静的非公開メンバ関数
static ASN1Primitive	getExtensionValue (X509Certificate certificate, String oid) throws IOException

静的非公開変数類
static final Logger	log = LoggerFactory.getLogger(OCSPCertificateVerifier.class)

詳解

Certificate verifier based on OCSP

著者

Yuriy Movchan

バージョン

March 10, 2016

構築子と解体子

OCSPCertificateVerifier()

org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.OCSPCertificateVerifier ( )

inline

                                         {
                SecurityProviderUtility.installBCProvider(true);
        }

関数詳解

destroy()

void org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.destroy ( )

inline

org.xdi.oxauth.cert.validation.CertificateVerifierを実装しています。

                              {
        }

generateOCSPRequest()

OCSPReq org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.generateOCSPRequest ( CertificateID  certificateId ) throws OCSPException, OperatorCreationException, CertificateEncodingException

inlineprivate

                                                                                                                                                       {
                OCSPReqBuilder ocspReqGenerator = new OCSPReqBuilder();

                ocspReqGenerator.addRequest(certificateId);

                OCSPReq ocspReq = ocspReqGenerator.build();
                return ocspReq;
        }

getExtensionValue()

static ASN1Primitive org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.getExtensionValue ( X509Certificate  certificate, String  oid  ) throws IOException

inlinestaticprivate

引数

certificate	the certificate from which we need the ExtensionValue
oid	the Object Identifier value for the extension.

戻り値

the extension value as an ASN1Primitive object

例外

IOException

                                                                                                                   {
                byte[] bytes = certificate.getExtensionValue(oid);
                if (bytes == null) {
                        return null;
                }
                ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(bytes));
                ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
                aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
                return aIn.readObject();
        }

getOCSPUrl()

String org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.getOCSPUrl ( X509Certificate  certificate ) throws IOException

inlineprivate

                                                                                  {
                ASN1Primitive obj;
                try {
                        obj = getExtensionValue(certificate, Extension.authorityInfoAccess.getId());
                } catch (IOException ex) {
                        log.error("Failed to get OCSP URL", ex);
                        return null;
                }

                if (obj == null) {
                        return null;
                }

                AuthorityInformationAccess authorityInformationAccess = AuthorityInformationAccess.getInstance(obj);

                AccessDescription[] accessDescriptions = authorityInformationAccess.getAccessDescriptions();
                for (AccessDescription accessDescription : accessDescriptions) {
                        boolean correctAccessMethod = accessDescription.getAccessMethod().equals(X509ObjectIdentifiers.ocspAccessMethod);
                        if (!correctAccessMethod) {
                                continue;
                        }

                        GeneralName name = accessDescription.getAccessLocation();
                        if (name.getTagNo() != GeneralName.uniformResourceIdentifier) {
                                continue;
                        }

                        DERIA5String derStr = DERIA5String.getInstance((ASN1TaggedObject) name.toASN1Primitive(), false);
                        return derStr.getString();
                }

                return null;

        }

requestOCSPResponse()

OCSPResp org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.requestOCSPResponse ( String  url, OCSPReq  ocspReq  ) throws IOException, MalformedURLException

inline

                                                                                                                   {
                byte[] ocspReqData = ocspReq.getEncoded();

                HttpURLConnection con = (HttpURLConnection) new URL(url).openConnection();
                try {
                        con.setRequestProperty("Content-Type", "application/ocsp-request");
                        con.setRequestProperty("Accept", "application/ocsp-response");

                        con.setDoInput(true);
                        con.setDoOutput(true);
                        con.setUseCaches(false);

                        OutputStream out = con.getOutputStream();
                        try {
                                IOUtils.write(ocspReqData, out);
                                out.flush();
                        } finally {
                                IOUtils.closeQuietly(out);
                        }

                        byte[] responseBytes = IOUtils.toByteArray(con.getInputStream());
                        OCSPResp ocspResp = new OCSPResp(responseBytes);

                        return ocspResp;
                } finally {
                        if (con != null) {
                                con.disconnect();
                        }
                }
        }

validate()

ValidationStatus org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.validate ( X509Certificate  certificate, List< X509Certificate >  issuers, Date  validationDate  )

inline

org.xdi.oxauth.cert.validation.CertificateVerifierを実装しています。

                                                                                                                          {
                X509Certificate issuer = issuers.get(0);
                ValidationStatus status = new ValidationStatus(certificate, issuer, validationDate, ValidatorSourceType.OCSP, CertificateValidity.UNKNOWN);

                try {
                        Principal subjectX500Principal = certificate.getSubjectX500Principal();

                        String ocspUrl = getOCSPUrl(certificate);
                        if (ocspUrl == null) {
                                log.error("OCSP URL for '" + subjectX500Principal + "' is empty");
                                return status;
                        }

                        log.debug("OCSP URL for '" + subjectX500Principal + "' is '" + ocspUrl + "'");

                        DigestCalculator digestCalculator = new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1);
                        CertificateID certificateId = new CertificateID(digestCalculator, new JcaX509CertificateHolder(certificate), certificate.getSerialNumber());

                        // Generate OCSP request
                        OCSPReq ocspReq = generateOCSPRequest(certificateId);

                        // Get OCSP response from server
                        OCSPResp ocspResp = requestOCSPResponse(ocspUrl, ocspReq);
                        if (ocspResp.getStatus() != OCSPRespBuilder.SUCCESSFUL) {
                                log.error("OCSP response is invalid!");
                                status.setValidity(CertificateValidity.INVALID);
                                return status;
                        }

                        boolean foundResponse = false;
                        BasicOCSPResp basicOCSPResp = (BasicOCSPResp) ocspResp.getResponseObject();
                        SingleResp[] singleResps = basicOCSPResp.getResponses();
                        for (SingleResp singleResp : singleResps) {
                                CertificateID responseCertificateId = singleResp.getCertID();
                                if (!certificateId.equals(responseCertificateId)) {
                                        continue;
                                }

                                foundResponse = true;

                                log.debug("OCSP validationDate: " + validationDate);
                                log.debug("OCSP thisUpdate: " + singleResp.getThisUpdate());
                                log.debug("OCSP nextUpdate: " + singleResp.getNextUpdate());

                                status.setRevocationObjectIssuingTime(basicOCSPResp.getProducedAt());

                                Object certStatus = singleResp.getCertStatus();
                                if (certStatus == CertificateStatus.GOOD) {
                                        log.debug("OCSP status is valid for '" + certificate.getSubjectX500Principal() + "'");
                                        status.setValidity(CertificateValidity.VALID);
                                } else {
                                        if (singleResp.getCertStatus() instanceof RevokedStatus) {
                                                log.warn("OCSP status is revoked for: " + subjectX500Principal);
                                                if (validationDate.before(((RevokedStatus) singleResp.getCertStatus()).getRevocationTime())) {
                                                        log.warn("OCSP revocation time after the validation date, the certificate '" + subjectX500Principal + "' was valid at " + validationDate);
                                                        status.setValidity(CertificateValidity.VALID);
                                                } else {
                                                        Date revocationDate = ((RevokedStatus) singleResp.getCertStatus()).getRevocationTime();
                                                        log.info("OCSP for certificate '" + subjectX500Principal + "' is revoked since " + revocationDate);
                                                        status.setRevocationDate(revocationDate);
                                                        status.setRevocationObjectIssuingTime(singleResp.getThisUpdate());
                                                        status.setValidity(CertificateValidity.REVOKED);
                                                }
                                        }
                                }
                        }

                        if (!foundResponse) {
                                log.error("There is no matching OCSP response entries");
                        }
                } catch (Exception ex) {
                        log.error("OCSP exception: ", ex);
                }

                return status;
        }

メンバ詳解

log

final Logger org.xdi.oxauth.cert.validation.OCSPCertificateVerifier.log = LoggerFactory.getLogger(OCSPCertificateVerifier.class)

staticprivate

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/gluu/src/oxAuth/Server/src/main/java/org/xdi/oxauth/cert/validation/OCSPCertificateVerifier.java