Здравствуйте. Проблема в следующем: Взял код из примеров для Ejbca, добавил чтение сертификатов и получил: | Код |
import java.io.File;
import java.io.IOException;
import java.net.URI;
import java.security.Security;
import java.security.cert.CertPath;
import java.security.cert.CertPathValidator;
import java.security.cert.CertPathValidatorException;
import java.security.cert.CertStore;
import java.security.cert.CertStoreParameters;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.CollectionCertStoreParameters;
import java.security.cert.PKIXCertPathValidatorResult;
import java.security.cert.X509Certificate;
import java.security.cert.PKIXParameters;
import java.security.cert.TrustAnchor;
import java.util.HashSet;
import java.util.Set;
import java.util.Vector;
/**
* Check the revocation status of a public key certificate using OCSP.
*/
public class ValidateCertUseOCSP {
/*
* Filename that contains the root CA cert of the OCSP server's cert.
*/
private static final String ROOT_CA_CERT = "AdminCA.pem";
/*
* Filename that contains the OCSP server's cert.
*/
private static final String OCSP_SERVER_CERT = "OCSPServer.pem";
/**
* Checks the revocation status of a public key certificate using OCSP.
*
* Usage: java ValidateCert <cert-file> [<OCSP-server>]
* <cert-file> is the filename of the certificate to be checked.
* The certificate must be in PEM format.
* <OCSP-server> is the URL of the OCSP server to use.
* If not supplied then the certificate must identify an OCSP
* server by means of its AuthorityInfoAccess extension.
* If supplied then it overrides any URL which may be present
* in the certificate's AuthorityInfoAccess extension.
*
* Example: java /
* -Dhttp.proxyHost=proxy.example.net /
* -Dhttp.proxyPort=8080 /
* ValidateCert /
* mycert.pem /
* http://ocsp.openvalidation.org:80
*/
public static void main(String[] args) {
try {
// args[0] = certstore file name
// args[1] = OCSP responder url
CertPath cp = null;
Vector certs = new Vector();
URI ocspServer = null;
if (args.length == 0 || args.length > 2) {
System.out.println(
"Usage: java ValidateCert <cert-file> [<OCSP-server>]");
System.exit(-1);
}
// load the cert to be checked
for (Certificate cert : getCertFromFile(args[0])) {
X509Certificate crt = (X509Certificate) cert;
System.out.println(crt.getNotAfter());
System.out.println(crt.getNotBefore());
System.out.println("");
certs.add(cert);
}
// handle location of OCSP server
if (args.length == 2) {
ocspServer = new URI(args[1]);
System.out.println("Using the OCSP server at: " + args[1]);
System.out.println("to check the revocation status of: " +
certs.elementAt(0));
System.out.println();
} else {
System.out.println("Using the OCSP server specified in the " +
"cert to check the revocation status of: " +
certs.elementAt(0));
System.out.println();
}
// init cert path
CertificateFactory cf = CertificateFactory.getInstance("X509");
cp = (CertPath) cf.generateCertPath(certs);
// load the root CA cert for the OCSP server cert
X509Certificate rootCACert = (X509Certificate) getCertFromFile(ROOT_CA_CERT)[0];
// init trusted certs
TrustAnchor ta = new TrustAnchor(rootCACert, null);
Set trustedCertsSet = new HashSet();
trustedCertsSet.add(ta);
// init cert store
Set certSet = new HashSet();
X509Certificate ocspCert = (X509Certificate) getCertFromFile(OCSP_SERVER_CERT)[0];
certSet.add(ocspCert);
CertStoreParameters storeParams =
new CollectionCertStoreParameters(certSet);
CertStore store = CertStore.getInstance("Collection", storeParams);
// init PKIX parameters
PKIXParameters params = null;
params = new PKIXParameters(trustedCertsSet);
params.setRevocationEnabled(true);
// params.addCertStore(null);
params.addCertStore(store);
// enable OCSP
Security.setProperty("ocsp.enable", "true");
if (ocspServer != null) {
Security.setProperty("ocsp.responderURL", args[1]);
Security.setProperty("ocsp.responderCertSubjectName",
ocspCert.getSubjectX500Principal().getName());
}
// perform validation
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
PKIXCertPathValidatorResult cpv_result =
(PKIXCertPathValidatorResult) cpv.validate(cp, params);
X509Certificate trustedCert = (X509Certificate) cpv_result.getTrustAnchor().getTrustedCert();
if (trustedCert == null) {
System.out.println("Trsuted Cert = NULL");
} else {
System.out.println("Trusted CA DN = " +
trustedCert.getSubjectDN());
}
} catch (CertPathValidatorException e) {
e.printStackTrace();
System.exit(1);
} catch (Exception e) {
e.printStackTrace();
System.exit(-1);
}
System.out.println("CERTIFICATE VALIDATION SUCCEEDED");
System.exit(0);
}
/*
* Read a certificate from the specified filepath.
*/
private static Certificate[] getCertFromFile(String path) {
Certificate cert[] = null;
try {
File certFile = new File(path);
if (!certFile.canRead()) {
throw new IOException(" File " + certFile.toString() +
" is unreadable");
}
cert = KeyStoreUtil.getCertificateFromFile(
path, "password", "Certificate Entry Name");
} catch (Exception e) {
System.out.println("Can't construct X509 Certificate. " +
e.getMessage());
}
return cert;
}
}
|
Доходит до получения PKIXCertPathValidatorResult и падает: | Код |
java.security.cert.CertPathValidatorException: java.io.IOException: Response is unreliable: its validity interval is out-of-date
at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:139)
at sun.security.provider.certpath.PKIXCertPathValidator.doValidate(PKIXCertPathValidator.java:316)
at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:178)
at java.security.cert.CertPathValidator.validate(CertPathValidator.java:250)
at pmx.ValidateCertUseOCSP.main(ValidateCertUseOCSP.java:138)
Caused by: java.io.IOException: Response is unreliable: its validity interval is out-of-date
at sun.security.provider.certpath.OCSPResponse$SingleResponse.<init>(OCSPResponse.java:541)
at sun.security.provider.certpath.OCSPResponse$SingleResponse.<init>(OCSPResponse.java:471)
at sun.security.provider.certpath.OCSPResponse.<init>(OCSPResponse.java:258)
at sun.security.provider.certpath.OCSPChecker.check(OCSPChecker.java:346)
at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:117)
... 4 more
|
Читаю на SUNовском форуме, что дело может быть в простроченности сертификата и перевыпускаю все 3 сертификата. Ничего не изменилось... Лезу в лог и вижу, что CertificateAuthority(Ejbca) шлет нормальный ответ со статусом сертификата GOOD. На сколько я смог понять, проблема в проверке подписи ответа. Подскажите, пожалуйста, что нужно сделать, чтобы это все заработало. Заранее спасибо. |
Error in OCSP Validatator 
Загрузка ...
