HttpCrlFetcher implements CrlFetcher { protected X509CRL download(String url) throws CertificateValidationException { try { if (url != null && url.matches("http[s]{0,1}: { X509CRL crl = httpDownload(url); Optional<X509Certificate> signer = trustAnchors.stream() .filter(s -> s.getSubjectX500Principal() .equals(crl.getIssuerX500Principal())) .findAny(); if (signer.isPresent()) { crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME); return crl; } else { throw new CertificateValidationException("Could not verify CRL"); } } } catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e) { throw new CertificateValidationException("Could not verify CRL", e); } return null; } HttpCrlFetcher(Set<X509Certificate> trustAnchors); @Override X509CRL get(String url);  }
@Test @DisplayName("throws a CertificateValidationException when the signature cannot be validated") void crlFetcherThrowsCertValidationExceptionWhitFalseCertificate() throws Exception { X509Certificate certificate = (X509Certificate)cf.generateCertificate(CertificationRevocationListImplTest.class.getResourceAsStream("/wrong-signature-cert.cer")); HttpCrlFetcher crlFetcher = getCrlFetcher(certificate); CertificateValidationException certificateValidationException = Assertions.assertThrows(CertificateValidationException.class, () -> crlFetcher.download(HTTP_TEST_URL)); Assertions.assertEquals("Could not verify CRL", certificateValidationException.getMessage()); }
@Test @DisplayName("returns the downloaded crl on successful CRL signature validation") void returnCrlOnSuccessfulValidation() throws Exception { HttpCrlFetcher crlFetcher = getCrlFetcher(certificate); X509CRL x509CRL = crlFetcher.download(HTTP_TEST_URL); Assertions.assertEquals("C=DE,O=bund,OU=bsi,CN=TEST csca-germany", x509CRL.getIssuerDN().getName()); Assertions.assertEquals(2, x509CRL.getVersion()); }
@Test @DisplayName("returns null when the url is malformed") void crlFetcherReturnsNullWhenUrlMalformed() throws Exception { Set<X509Certificate> trustSet = new HashSet<>(); trustSet.add(certificate); HttpCrlFetcher crlFetcher = new HttpCrlFetcher(trustSet); X509CRL x509CRL = crlFetcher.download("malformedUrl"); Assertions.assertNull(x509CRL); }
@Test @DisplayName("returns null when the url is null") void crlFetcherReturnsNullWhenUrlIsNull() throws Exception { Set<X509Certificate> trustSet = new HashSet<>(); trustSet.add(certificate); HttpCrlFetcher crlFetcher = new HttpCrlFetcher(trustSet); X509CRL x509CRL = crlFetcher.download(null); Assertions.assertNull(x509CRL); }