@Test @DisplayName("returns the downloaded crl on successful CRL signature validation") void returnCrlOnSuccessfulValidation() throws Exception { HttpCrlFetcher crlFetcher = getCrlFetcher(certificate); X509CRL x509CRL = crlFetcher.download(HTTP_TEST_URL); Assertions.assertEquals("C=DE,O=bund,OU=bsi,CN=TEST csca-germany", x509CRL.getIssuerDN().getName()); Assertions.assertEquals(2, x509CRL.getVersion()); }
protected X509CRL download(String url) throws CertificateValidationException { try { if (url != null && url.matches("http[s]{0,1}: { X509CRL crl = httpDownload(url); Optional<X509Certificate> signer = trustAnchors.stream() .filter(s -> s.getSubjectX500Principal() .equals(crl.getIssuerX500Principal())) .findAny(); if (signer.isPresent()) { crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME); return crl; } else { throw new CertificateValidationException("Could not verify CRL"); } } } catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e) { throw new CertificateValidationException("Could not verify CRL", e); } return null; }
HttpCrlFetcher implements CrlFetcher { protected X509CRL download(String url) throws CertificateValidationException { try { if (url != null && url.matches("http[s]{0,1}: { X509CRL crl = httpDownload(url); Optional<X509Certificate> signer = trustAnchors.stream() .filter(s -> s.getSubjectX500Principal() .equals(crl.getIssuerX500Principal())) .findAny(); if (signer.isPresent()) { crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME); return crl; } else { throw new CertificateValidationException("Could not verify CRL"); } } } catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e) { throw new CertificateValidationException("Could not verify CRL", e); } return null; } }
HttpCrlFetcher implements CrlFetcher { protected X509CRL download(String url) throws CertificateValidationException { try { if (url != null && url.matches("http[s]{0,1}: { X509CRL crl = httpDownload(url); Optional<X509Certificate> signer = trustAnchors.stream() .filter(s -> s.getSubjectX500Principal() .equals(crl.getIssuerX500Principal())) .findAny(); if (signer.isPresent()) { crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME); return crl; } else { throw new CertificateValidationException("Could not verify CRL"); } } } catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e) { throw new CertificateValidationException("Could not verify CRL", e); } return null; } HttpCrlFetcher(Set<X509Certificate> trustAnchors); }
HttpCrlFetcher implements CrlFetcher { protected X509CRL download(String url) throws CertificateValidationException { try { if (url != null && url.matches("http[s]{0,1}: { X509CRL crl = httpDownload(url); Optional<X509Certificate> signer = trustAnchors.stream() .filter(s -> s.getSubjectX500Principal() .equals(crl.getIssuerX500Principal())) .findAny(); if (signer.isPresent()) { crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME); return crl; } else { throw new CertificateValidationException("Could not verify CRL"); } } } catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e) { throw new CertificateValidationException("Could not verify CRL", e); } return null; } HttpCrlFetcher(Set<X509Certificate> trustAnchors); @Override X509CRL get(String url); }
HttpCrlFetcher implements CrlFetcher { protected X509CRL download(String url) throws CertificateValidationException { try { if (url != null && url.matches("http[s]{0,1}: { X509CRL crl = httpDownload(url); Optional<X509Certificate> signer = trustAnchors.stream() .filter(s -> s.getSubjectX500Principal() .equals(crl.getIssuerX500Principal())) .findAny(); if (signer.isPresent()) { crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME); return crl; } else { throw new CertificateValidationException("Could not verify CRL"); } } } catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException e) { throw new CertificateValidationException("Could not verify CRL", e); } return null; } HttpCrlFetcher(Set<X509Certificate> trustAnchors); @Override X509CRL get(String url);  }