You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2018/11/14 17:57:20 UTC
svn commit: r1846602 -
/pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
Author: tilman
Date: Wed Nov 14 17:57:20 2018
New Revision: 1846602
URL: http://svn.apache.org/viewvc?rev=1846602&view=rev
Log:
PDFBOX-3017: check the whole certificate chain for revocation
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
Modified: pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
URL: http://svn.apache.org/viewvc/pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java?rev=1846602&r1=1846601&r2=1846602&view=diff
==============================================================================
--- pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java (original)
+++ pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java Wed Nov 14 17:57:20 2018
@@ -105,7 +105,6 @@ public final class CertificateVerifier
// and a set of intermediate certificates
Set<X509Certificate> trustedRootCerts = new HashSet<X509Certificate>();
Set<X509Certificate> intermediateCerts = new HashSet<X509Certificate>();
- X509Certificate issuerCert = null;
for (X509Certificate additionalCert : additionalCerts)
{
if (isSelfSigned(additionalCert))
@@ -116,10 +115,6 @@ public final class CertificateVerifier
{
intermediateCerts.add(additionalCert);
}
- if (cert.getIssuerX500Principal().equals(additionalCert.getSubjectX500Principal()))
- {
- issuerCert = additionalCert;
- }
}
// Attempt to build the certification chain and verify it
@@ -128,22 +123,7 @@ public final class CertificateVerifier
LOG.info("Certification chain verified successfully");
- // Try checking the certificate through OCSP (faster than CRL)
- String ocspURL = extractOCSPURL(cert);
- if (ocspURL != null)
- {
- OcspHelper ocspHelper = new OcspHelper(cert, issuerCert, ocspURL);
- verifyOCSP(ocspHelper, signDate);
- return verifiedCertChain;
- }
- else
- {
- LOG.info("OCSP not available, will try CRL");
- }
-
- // Check whether the certificate is revoked by the CRL
- // given in its CRL distribution point extension
- CRLVerifier.verifyCertificateCRLs(cert, signDate, additionalCerts);
+ checkRevocations(cert, additionalCerts, signDate);
return verifiedCertChain;
}
@@ -165,6 +145,49 @@ public final class CertificateVerifier
}
}
+ private static void checkRevocations(X509Certificate cert,
+ Set<X509Certificate> additionalCerts,
+ Date signDate)
+ throws IOException, CertificateVerificationException, OCSPException,
+ RevokedCertificateException, GeneralSecurityException
+ {
+ if (isSelfSigned(cert))
+ {
+ // root, we're done
+ return;
+ }
+ X509Certificate issuerCert = null;
+ for (X509Certificate additionalCert : additionalCerts)
+ {
+ if (cert.getIssuerX500Principal().equals(additionalCert.getSubjectX500Principal()))
+ {
+ issuerCert = additionalCert;
+ break;
+ }
+ }
+ // issuerCert is never null here. If it hadn't been found, then there wouldn't be a
+ // verifiedCertChain earlier.
+
+ // Try checking the certificate through OCSP (faster than CRL)
+ String ocspURL = extractOCSPURL(cert);
+ if (ocspURL != null)
+ {
+ OcspHelper ocspHelper = new OcspHelper(cert, issuerCert, ocspURL);
+ verifyOCSP(ocspHelper, signDate);
+ }
+ else
+ {
+ LOG.info("OCSP not available, will try CRL");
+
+ // Check whether the certificate is revoked by the CRL
+ // given in its CRL distribution point extension
+ CRLVerifier.verifyCertificateCRLs(cert, signDate, additionalCerts);
+ }
+
+ // now check the issuer
+ checkRevocations(issuerCert, additionalCerts, signDate);
+ }
+
/**
* Checks whether given X.509 certificate is self-signed.
* @param cert The X.509 certificate to check.