You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2026/08/19 13:34:09 UTC
svn commit: r1937232 - in pdfbox/trunk/examples/src: main/java/org/apache/pdfbox/examples/signature main/java/org/apache/pdfbox/examples/signature/cert test/java/org/apache/pdfbox/examples/signature test/java/org/apache/pdfbox/examples/signature/cert
Author: tilman
Date: Wed Aug 19 13:34:09 2026
New Revision: 1937232
Log:
PDFBOX-6237: add LDAP download test; add some URIs
Added:
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java (contents, props changed)
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Modified: pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
==============================================================================
--- pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java Wed Aug 19 13:34:03 2026 (r1937231)
+++ pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java Wed Aug 19 13:34:09 2026 (r1937232)
@@ -93,7 +93,14 @@ public class SigUtils
"http://crl.adobe.com/cds.crl",
"http://subca.crl.certum.pl/ctsca2021.crl",
"http://subca.ocsp-certum.com",
- "http://crl.certum.pl/ctnca2.crl");
+ "http://crl.certum.pl/ctnca2.crl",
+ "http://www.freetsa.org/tsa.crt",
+ "http://www.freetsa.org:2560",
+ "http://www.freetsa.org/crl/root_ca.crl",
+ "http://www.gemboxsoftware.com/test/pki/cert/GemBoxCA.crt",
+ "http://www.gemboxsoftware.com/test/pki/cert/GemBoxRSA.crt",
+ "http://www.ca.gov.si/crt/si-trust-root.crt",
+ "ldap://x500.gov.si/cn=SI-TRUST%20Root,oi=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList");
private SigUtils()
{
Modified: pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
==============================================================================
--- pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java Wed Aug 19 13:34:03 2026 (r1937231)
+++ pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java Wed Aug 19 13:34:09 2026 (r1937232)
@@ -234,7 +234,7 @@ public final class CRLVerifier
/**
* Downloads CRL from given URL. Supports http, https and ldap based URLs.
*/
- private static X509CRL downloadCRL(String crlURL) throws IOException,
+ static X509CRL downloadCRL(String crlURL) throws IOException,
CertificateVerificationException, NamingException, URISyntaxException, GeneralSecurityException
{
if (crlURL.startsWith("http://") || crlURL.startsWith("https://"))
Added: pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java Wed Aug 19 13:34:09 2026 (r1937232)
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2026 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.pdfbox.examples.signature.cert;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import javax.naming.NamingException;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.Test;
+
+import org.apache.pdfbox.examples.signature.SigUtils;
+
+/**
+ * @author Tilman Hausherr
+ */
+class CRLVerifierTest
+{
+ /**
+ * Test downloadCRLFromLDAP(). Get a CRL through an LDAP URI and verify it with the root certificate.
+ *
+ * @throws IOException
+ * @throws CertificateVerificationException
+ * @throws NamingException
+ * @throws URISyntaxException
+ * @throws GeneralSecurityException
+ */
+ @Test
+ void testLDAP() throws IOException, CertificateVerificationException, NamingException, URISyntaxException, GeneralSecurityException
+ {
+ // ChatGPT prompt if the LDAP URI no longer works:
+ // Find me a certificate that has a CRL that must be downloaded through LDAP.
+ // This gets
+ // https://www.si-trust.gov.si/assets/Politike/si-pass-ca/verzija-2-7/SI-PASS-CA-politika-v2.7-2025.pdf
+ // which include the LDAP URL and the root certificate.
+ // Note that "%20" is needed for the spaces.
+ // ChatGPT wasn't able to find a certificate where the CRL Distribution Points extension contains an LDAP URI and no HTTP/HTTPS URI.
+ X509CRL crl = CRLVerifier.downloadCRL("ldap://x500.gov.si/cn=SI-TRUST%20Root,oi=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList");
+ try (InputStream is = SigUtils.openURL("http://www.ca.gov.si/crt/si-trust-root.crt"))
+ {
+ CertificateFactory factory = CertificateFactory.getInstance("X.509");
+ X509Certificate cert = (X509Certificate) factory.generateCertificate(is);
+ assertTrue(CertificateVerifier.isSelfSigned(cert));
+ assertDoesNotThrow(() -> crl.verify(cert.getPublicKey()));
+ }
+ }
+
+}