Class OCSPValidator
- java.lang.Object
-
- com.itextpdf.signatures.validation.OCSPValidator
-
public class OCSPValidator extends java.lang.Object
Class that allows you to validate a single OCSP response.
-
-
Field Summary
Fields Modifier and Type Field Description private static IBouncyCastleFactory
BOUNCY_CASTLE_FACTORY
private ValidatorChainBuilder
builder
(package private) static java.lang.String
CERT_IS_EXPIRED
(package private) static java.lang.String
CERT_IS_REVOKED
(package private) static java.lang.String
CERT_STATUS_IS_UNKNOWN
private IssuingCertificateRetriever
certificateRetriever
(package private) static java.lang.String
FRESHNESS_CHECK
(package private) static java.lang.String
INVALID_OCSP
(package private) static java.lang.String
ISSUER_MISSING
(package private) static java.lang.String
ISSUERS_DO_NOT_MATCH
(package private) static java.lang.String
OCSP_CHECK
(package private) static java.lang.String
OCSP_COULD_NOT_BE_VERIFIED
(package private) static java.lang.String
OCSP_IS_NO_LONGER_VALID
(package private) static java.lang.String
OCSP_RESPONDER_DID_NOT_SIGN
(package private) static java.lang.String
OCSP_RESPONDER_IS_CA
(package private) static java.lang.String
OCSP_RESPONDER_NOT_RETRIEVED
(package private) static java.lang.String
OCSP_RESPONDER_NOT_VERIFIED
(package private) static java.lang.String
OCSP_RESPONDER_TRUST_NOT_RETRIEVED
(package private) static java.lang.String
OCSP_RESPONDER_TRUSTED
private SignatureValidationProperties
properties
(package private) static java.lang.String
SERIAL_NUMBERS_DO_NOT_MATCH
(package private) static java.lang.String
UNABLE_TO_CHECK_IF_ISSUERS_MATCH
(package private) static java.lang.String
UNABLE_TO_RETRIEVE_ISSUER
-
Constructor Summary
Constructors Modifier Constructor Description protected
OCSPValidator(ValidatorChainBuilder builder)
Creates newOCSPValidator
instance.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description private static void
addResponderValidationReport(ValidationReport report, ValidationReport responderReport)
private java.util.Date
getArchiveCutoffExtension(IBasicOCSPResp ocspResp)
void
validate(ValidationReport report, ValidationContext context, java.security.cert.X509Certificate certificate, ISingleResp singleResp, IBasicOCSPResp ocspResp, java.util.Date validationDate, java.util.Date responseGenerationDate)
Validates a certificate against single OCSP Response.private void
verifyOcspResponder(ValidationReport report, ValidationContext context, IBasicOCSPResp ocspResp, java.security.cert.X509Certificate issuerCert, java.util.Date responseGenerationDate)
Verifies if an OCSP response is genuine.
-
-
-
Field Detail
-
CERT_IS_EXPIRED
static final java.lang.String CERT_IS_EXPIRED
- See Also:
- Constant Field Values
-
CERT_IS_REVOKED
static final java.lang.String CERT_IS_REVOKED
- See Also:
- Constant Field Values
-
CERT_STATUS_IS_UNKNOWN
static final java.lang.String CERT_STATUS_IS_UNKNOWN
- See Also:
- Constant Field Values
-
INVALID_OCSP
static final java.lang.String INVALID_OCSP
- See Also:
- Constant Field Values
-
ISSUERS_DO_NOT_MATCH
static final java.lang.String ISSUERS_DO_NOT_MATCH
- See Also:
- Constant Field Values
-
ISSUER_MISSING
static final java.lang.String ISSUER_MISSING
- See Also:
- Constant Field Values
-
FRESHNESS_CHECK
static final java.lang.String FRESHNESS_CHECK
- See Also:
- Constant Field Values
-
OCSP_COULD_NOT_BE_VERIFIED
static final java.lang.String OCSP_COULD_NOT_BE_VERIFIED
- See Also:
- Constant Field Values
-
OCSP_RESPONDER_NOT_RETRIEVED
static final java.lang.String OCSP_RESPONDER_NOT_RETRIEVED
- See Also:
- Constant Field Values
-
OCSP_RESPONDER_NOT_VERIFIED
static final java.lang.String OCSP_RESPONDER_NOT_VERIFIED
- See Also:
- Constant Field Values
-
OCSP_RESPONDER_DID_NOT_SIGN
static final java.lang.String OCSP_RESPONDER_DID_NOT_SIGN
- See Also:
- Constant Field Values
-
OCSP_RESPONDER_TRUST_NOT_RETRIEVED
static final java.lang.String OCSP_RESPONDER_TRUST_NOT_RETRIEVED
- See Also:
- Constant Field Values
-
OCSP_RESPONDER_TRUSTED
static final java.lang.String OCSP_RESPONDER_TRUSTED
- See Also:
- Constant Field Values
-
OCSP_RESPONDER_IS_CA
static final java.lang.String OCSP_RESPONDER_IS_CA
- See Also:
- Constant Field Values
-
OCSP_IS_NO_LONGER_VALID
static final java.lang.String OCSP_IS_NO_LONGER_VALID
- See Also:
- Constant Field Values
-
SERIAL_NUMBERS_DO_NOT_MATCH
static final java.lang.String SERIAL_NUMBERS_DO_NOT_MATCH
- See Also:
- Constant Field Values
-
UNABLE_TO_CHECK_IF_ISSUERS_MATCH
static final java.lang.String UNABLE_TO_CHECK_IF_ISSUERS_MATCH
- See Also:
- Constant Field Values
-
UNABLE_TO_RETRIEVE_ISSUER
static final java.lang.String UNABLE_TO_RETRIEVE_ISSUER
- See Also:
- Constant Field Values
-
OCSP_CHECK
static final java.lang.String OCSP_CHECK
- See Also:
- Constant Field Values
-
BOUNCY_CASTLE_FACTORY
private static final IBouncyCastleFactory BOUNCY_CASTLE_FACTORY
-
certificateRetriever
private final IssuingCertificateRetriever certificateRetriever
-
properties
private final SignatureValidationProperties properties
-
builder
private final ValidatorChainBuilder builder
-
-
Constructor Detail
-
OCSPValidator
protected OCSPValidator(ValidatorChainBuilder builder)
Creates newOCSPValidator
instance.- Parameters:
builder
- SeeValidatorChainBuilder
-
-
Method Detail
-
validate
public void validate(ValidationReport report, ValidationContext context, java.security.cert.X509Certificate certificate, ISingleResp singleResp, IBasicOCSPResp ocspResp, java.util.Date validationDate, java.util.Date responseGenerationDate)
Validates a certificate against single OCSP Response.- Parameters:
report
- to store all the chain verification resultscontext
- the context in which to perform the validationcertificate
- the certificate to check forsingleResp
- single response to checkocspResp
- basic OCSP response which contains single response to checkvalidationDate
- validation date to check forresponseGenerationDate
- trusted date at which response is generated
-
verifyOcspResponder
private void verifyOcspResponder(ValidationReport report, ValidationContext context, IBasicOCSPResp ocspResp, java.security.cert.X509Certificate issuerCert, java.util.Date responseGenerationDate)
Verifies if an OCSP response is genuine. If it doesn't verify against the issuer certificate and response's certificates, it may verify using a trusted anchor or cert.- Parameters:
report
- to store all the chain verification resultscontext
- the context in which to perform the validationocspResp
-IBasicOCSPResp
the OCSP response wrapperissuerCert
- the issuer of the certificate for which the OCSP is checked
-
addResponderValidationReport
private static void addResponderValidationReport(ValidationReport report, ValidationReport responderReport)
-
getArchiveCutoffExtension
private java.util.Date getArchiveCutoffExtension(IBasicOCSPResp ocspResp)
-
-