Class OCSPVerifier


  • public class OCSPVerifier
    extends RootStoreVerifier
    Class that allows you to verify a certificate against one or more OCSP responses.
    • Field Detail

      • LOGGER

        protected static final Logger LOGGER
        The Logger instance
      • ocsps

        protected List<org.bouncycastle.cert.ocsp.BasicOCSPResp> ocsps
        The list of OCSP responses.
    • Constructor Detail

      • OCSPVerifier

        public OCSPVerifier​(CertificateVerifier verifier,
                            List<org.bouncycastle.cert.ocsp.BasicOCSPResp> ocsps)
        Creates an OCSPVerifier instance.
        Parameters:
        verifier - the next verifier in the chain
        ocsps - a list of OCSP responses
    • Method Detail

      • isValidResponse

        public void isValidResponse​(org.bouncycastle.cert.ocsp.BasicOCSPResp ocspResp,
                                    X509Certificate issuerCert)
                             throws GeneralSecurityException,
                                    IOException
        Verifies if an OCSP response is genuine If it doesn't verify against the issuer certificate and response's certificates, it may verify using a trusted anchor or cert.
        Parameters:
        ocspResp - the OCSP response
        issuerCert - the issuer certificate
        Throws:
        GeneralSecurityException
        IOException
      • verifyResponse

        @Deprecated
        public boolean verifyResponse​(org.bouncycastle.cert.ocsp.BasicOCSPResp ocspResp,
                                      X509Certificate issuerCert)
        Deprecated.
        Verifies if the response is valid. If it doesn't verify against the issuer certificate and response's certificates, it may verify using a trusted anchor or cert. NOTE. Use isValidResponse() instead.
        Parameters:
        ocspResp - the response object
        issuerCert - the issuer certificate
        Returns:
        true if the response can be trusted
      • isSignatureValid

        public boolean isSignatureValid​(org.bouncycastle.cert.ocsp.BasicOCSPResp ocspResp,
                                        Certificate responderCert)
        Checks if an OCSP response is genuine
        Parameters:
        ocspResp - the OCSP response
        responderCert - the responder certificate
        Returns:
        true if the OCSP response verifies against the responder certificate
      • getOcspResponse

        public org.bouncycastle.cert.ocsp.BasicOCSPResp getOcspResponse​(X509Certificate signCert,
                                                                        X509Certificate issuerCert)
        Gets an OCSP response online and returns it if the status is GOOD (without further checking).
        Parameters:
        signCert - the signing certificate
        issuerCert - the issuer certificate
        Returns:
        an OCSP response