You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2021/06/03 16:03:24 UTC
svn commit: r1890435 -
/pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
Author: tilman
Date: Thu Jun 3 16:03:24 2021
New Revision: 1890435
URL: http://svn.apache.org/viewvc?rev=1890435&view=rev
Log:
PDFBOX-5203: expect more than one issuer
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
Modified: pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
URL: http://svn.apache.org/viewvc/pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java?rev=1890435&r1=1890434&r2=1890435&view=diff
==============================================================================
--- pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java (original)
+++ pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java Thu Jun 3 16:03:24 2021
@@ -207,23 +207,26 @@ public final class CertificateVerifier
// root, we're done
return;
}
- X509Certificate issuerCert = null;
for (X509Certificate additionalCert : additionalCerts)
{
try
{
cert.verify(additionalCert.getPublicKey(), SecurityProvider.getProvider());
- issuerCert = additionalCert;
- break;
+ checkRevocationsWithIssuer(cert, additionalCert, additionalCerts, signDate);
+ // there can be several issuers
}
catch (GeneralSecurityException ex)
{
// not the issuer
}
- }
- // issuerCert is never null here. If it hadn't been found, then there wouldn't be a
- // verifiedCertChain earlier.
+ }
+ }
+ private static void checkRevocationsWithIssuer(X509Certificate cert, X509Certificate issuerCert,
+ Set<X509Certificate> additionalCerts, Date signDate)
+ throws OCSPException, CertificateVerificationException, RevokedCertificateException,
+ GeneralSecurityException, IOException
+ {
// Try checking the certificate through OCSP (faster than CRL)
String ocspURL = extractOCSPURL(cert);
if (ocspURL != null)