title: CRL check in Java
body: <p>I have set CertStore configured with locally stored CRLs. I want to carry out certificate validation using these locally stored CRLs only. In case if incoming connection's certificate does not match against any of these CRLs, it should not try to fetch the CRL from CDP point and just softfail. Is there any way to achieve this ?</p>
  
  <pre><code>        System.setProperty("com.sun.security.enableCRLDP", "false");
          KeyManagerFactory keyManagerFactory = null;
          KeyStore keyStore = null;
          keyManagerFactory = KeyManagerFactory.getInstance(keyAlgorithm);
          keyStore = KeyStore.getInstance(keyStoreType);
          ksFile = new FileInputStream(keyStoreFile);
          keyStore.load(ksFile,password);
          keyManagerFactory.init (keyStore,password);
  
          TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX", "SunJSSE");
          CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
          List&lt;CertStore&gt; certStores =  new ArrayList&lt;&gt;();
          Collection&lt;CRL&gt; crls = new HashSet&lt;&gt;();
         crls.add(CertificateFactory.getInstance("X.509").generateCRL( new java.io.FileInputStream("crl path")));
         crls.add(CertificateFactory.getInstance("X.509").generateCRL( new java.io.FileInputStream("crl path2")));
         certStores.add(CertStore.getInstance("Collection", new CollectionCertStoreParameters(crls)));
        PKIXRevocationChecker rc = (PKIXRevocationChecker)cpb.getRevocationChecker();
          rc.setOptions(EnumSet.of(
              PKIXRevocationChecker.Option.PREFER_CRLS, // prefer CLR over OCSP 
                          // handshake should not fail when CRL is not available
              PKIXRevocationChecker.Option.NO_FALLBACK));
  
          CertPathParameters pkixParams = new PKIXBuilderParameters(keyStore, new X509CertSelector());
         // PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(keyStore, new X509CertSelector());
          ((PKIXParameters) pkixParams).setRevocationEnabled(true);
          ((PKIXParameters) pkixParams).setCertStores(certStores);
          ((PKIXParameters) pkixParams).addCertPathChecker(rc);
  
          tmf.init( new CertPathTrustManagerParameters(pkixParams) );
  
          SSLContext context = SSLContext.getInstance(protocol);
                      context.init (keyManagerFactory.getKeyManagers (), tmf.getTrustManagers(), null);
  </code></pre>