OCSPValidator.java

  1. /*
  2.  * GovWay - A customizable API Gateway 
  3.  * https://govway.org
  4.  * 
  5.  * Copyright (c) 2005-2025 Link.it srl (https://link.it). 
  6.  * 
  7.  * This program is free software: you can redistribute it and/or modify
  8.  * it under the terms of the GNU General Public License version 3, as published by
  9.  * the Free Software Foundation.
  10.  *
  11.  * This program is distributed in the hope that it will be useful,
  12.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14.  * GNU General Public License for more details.
  15.  *
  16.  * You should have received a copy of the GNU General Public License
  17.  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18.  *
  19.  */
  20. package org.openspcoop2.utils.certificate.ocsp;

  22. import java.math.BigInteger;
  23. import java.security.cert.CRLReason;
  24. import java.security.cert.CertificateExpiredException;
  25. import java.security.cert.CertificateNotYetValidException;
  26. import java.security.cert.X509Certificate;
  27. import java.util.ArrayList;
  28. import java.util.Arrays;
  29. import java.util.Date;
  30. import java.util.HashMap;
  31. import java.util.List;
  32. import java.util.Map;

  34. import org.apache.commons.lang.StringUtils;
  35. import org.bouncycastle.asn1.DEROctetString;
  36. import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
  37. import org.bouncycastle.asn1.ocsp.ResponderID;
  38. import org.bouncycastle.asn1.x500.X500Name;
  39. import org.bouncycastle.asn1.x509.Extension;
  40. import org.bouncycastle.asn1.x509.Extensions;
  41. import org.bouncycastle.asn1.x509.SubjectKeyIdentifier;
  42. import org.bouncycastle.cert.X509CertificateHolder;
  43. import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
  44. import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
  45. import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
  46. import org.bouncycastle.cert.ocsp.BasicOCSPResp;
  47. import org.bouncycastle.cert.ocsp.CertificateID;
  48. import org.bouncycastle.cert.ocsp.OCSPReq;
  49. import org.bouncycastle.cert.ocsp.OCSPReqBuilder;
  50. import org.bouncycastle.cert.ocsp.OCSPResp;
  51. import org.bouncycastle.cert.ocsp.RevokedStatus;
  52. import org.bouncycastle.cert.ocsp.SingleResp;
  53. import org.bouncycastle.cert.ocsp.UnknownStatus;
  54. import org.bouncycastle.cert.ocsp.jcajce.JcaCertificateID;
  55. import org.bouncycastle.operator.ContentVerifierProvider;
  56. import org.bouncycastle.operator.DigestCalculator;
  57. import org.bouncycastle.operator.DigestCalculatorProvider;
  58. import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
  59. import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
  60. import org.openspcoop2.utils.LoggerBuffer;
  61. import org.openspcoop2.utils.Utilities;
  62. import org.openspcoop2.utils.UtilsException;
  63. import org.openspcoop2.utils.UtilsMultiException;
  64. import org.openspcoop2.utils.certificate.CRLDistributionPoint;
  65. import org.openspcoop2.utils.certificate.CertificateInfo;
  66. import org.openspcoop2.utils.certificate.ExtendedKeyUsage;
  67. import org.openspcoop2.utils.certificate.KeyStore;
  68. import org.openspcoop2.utils.date.DateManager;
  69. import org.openspcoop2.utils.date.DateUtils;
  70. import org.openspcoop2.utils.io.Base64Utilities;
  71. import org.openspcoop2.utils.random.RandomGenerator;
  72. import org.openspcoop2.utils.random.SecureRandomAlgorithm;
  73. import org.openspcoop2.utils.transport.TransportUtils;
  74. import org.openspcoop2.utils.transport.http.HttpConstants;
  75. import org.openspcoop2.utils.transport.http.HttpRequest;
  76. import org.openspcoop2.utils.transport.http.HttpRequestMethod;
  77. import org.openspcoop2.utils.transport.http.HttpResponse;
  78. import org.openspcoop2.utils.transport.http.HttpUtilities;
  79. import org.slf4j.Logger;

  81. /**
  82.  * OCSPValidator
  83.  *
  84.  * @author Poli Andrea (apoli@link.it)
  85.  * @author $Author$
  86.  * @version $Rev$, $Date$
  87.  */
  88. public class OCSPValidator {

  90.     private OCSPValidator() {}
  91.     
  92.     public static CertificateStatus check(Logger log, OCSPRequestParams params) throws UtilsException {
  93.         LoggerBuffer lb = new LoggerBuffer();
  94.         lb.setLogDebug(log);
  95.         lb.setLogError(log);
  96.         return check(lb, params, null);
  97.     }
  98.     public static CertificateStatus check(Logger log, OCSPRequestParams params, String crlInput) throws UtilsException {
  99.         LoggerBuffer lb = new LoggerBuffer();
  100.         lb.setLogDebug(log);
  101.         lb.setLogError(log);
  102.         return check(lb, params, crlInput);
  103.     }
  104.     public static CertificateStatus check(LoggerBuffer log, OCSPRequestParams params) throws UtilsException {
  105.         return check(log, params, null);
  106.     }
  107.     public static CertificateStatus check(LoggerBuffer log, OCSPRequestParams params, String crlInput) throws UtilsException {
  108.     
  109.         if(params==null) {
  110.             throw new UtilsException("Params is null");
  111.         }
  112.         if(params.getCertificate()==null) {
  113.             throw new UtilsException("Certificate not provided");
  114.         }
  115.         if(params.getConfig()==null) {
  116.             throw new UtilsException("OCSP config not provided");
  117.         }
  118.         if(params.isSelfSigned()) {
  119.             return CertificateStatus.SELF_SIGNED();
  120.         }

  122.         int indexLimit = 1000;
  123.         int index = 0;
  124.         OCSPRequestParams req = params;
  125.         CertificateStatus principalStatus = null;
  126.         while(index<indexLimit) {

  128.             CertificateStatus status = checkEngine(log, req, crlInput);
  129.             if(principalStatus==null) {
  130.                 principalStatus = status;
  131.             }
  132.             
  133.             if(status.isREVOKED() || status.isEXPIRED() || status.isUNKNOWN()) {
  134.                 return status;
  135.             }
  136.             else {
  137.                 if(params.getConfig().isCertificateChainVerify() 
  138.                         &&
  139.                         !req.isSelfSigned() // altrimenti sono arrivato alla ca radice
  140.                         ) {
  141.                     OCSPRequestParams newReq = OCSPRequestParams.build(log, req.getIssuerCertificate(), params.getConfigTrustStore(), 
  142.                             params.getConfig(), params.getReader());
  143.                     req = newReq;
  144.                 }
  145.                 else {
  146.                     return principalStatus; // ritorno lo stato di verifica del certificato principale
  147.                 }
  148.             }           

  150.             index++;
  151.         }

  153.         throw new UtilsException("Certificate chain too big");
  154.     }

  156.     private static CertificateStatus checkEngine(LoggerBuffer log, OCSPRequestParams params, String crlInput) throws UtilsException {

  158.         if(params==null) {
  159.             throw new UtilsException("Params is null");
  160.         }

  162.         if(params.getCertificate()==null) {
  163.             throw new UtilsException("Certificate not provided");
  164.         }
  165.         if(params.getConfig()==null) {
  166.             throw new UtilsException("OCSP config not provided");
  167.         }

  169.         String prefixCert = "OCSP [certificate: "+params.getCertificate().getSubjectDN()+"] ";

  171.         CertificateInfo certificateInfo = new CertificateInfo(params.getCertificate(), "certificate");
  172.         log.debug(prefixCert+"issuer: "+params.getCertificate().getIssuerDN());
  173.         try {
  174.             log.debug(prefixCert+"CAissuer: "+(certificateInfo.getAuthorityInformationAccess()!=null ? certificateInfo.getAuthorityInformationAccess().getCAIssuers() : null));
  175.         }catch(Exception t) {
  176.             log.debug(prefixCert+"CAissuer: read error: "+t.getMessage(),t);
  177.         }
  178.         try {
  179.             log.debug(prefixCert+"OCSP: "+(certificateInfo.getAuthorityInformationAccess()!=null ? certificateInfo.getAuthorityInformationAccess().getOCSPs() : null));
  180.         }catch(Exception t) {
  181.             log.debug(prefixCert+"OCSP: read error: "+t.getMessage(),t);
  182.         }
  183.         try {
  184.             if(certificateInfo.getCRLDistributionPoints()!=null && 
  185.                     certificateInfo.getCRLDistributionPoints().getCRLDistributionPoints()!=null && 
  186.                     !certificateInfo.getCRLDistributionPoints().getCRLDistributionPoints().isEmpty()) {
  187.                 int indexCRL = 0;
  188.                 for (CRLDistributionPoint point : certificateInfo.getCRLDistributionPoints().getCRLDistributionPoints()) {
  189.                     log.debug(prefixCert+"CRL-"+indexCRL+"-Issuer: "+point.getCRLIssuers());
  190.                     log.debug(prefixCert+"CRL-"+indexCRL+": "+point.getDistributionPointNames());
  191.                     indexCRL++;
  192.                 }
  193.             }
  194.             else {
  195.                 log.debug(prefixCert+"CRL: null");
  196.             }
  197.         }catch(Exception t) {
  198.             log.debug(prefixCert+"CRL: read error: "+t.getMessage(),t);
  199.         }
  200.         
  201.         Date date = DateManager.getDate();

  203.         boolean isCA = false;
  204.         try {
  205.             isCA = certificateInfo.isCA();
  206.         }catch(Exception e) {
  207.             throw new UtilsException(e.getMessage(),e);
  208.         }
  209.         
  210.         // controllo validità temporale
  211.         try {
  212.             if(isCA) {
  213.                 if(params.getConfig().isCheckCAValidity()) {
  214.                     log.debug(prefixCert+"Check validity ..."); // la faccio sempre per avere l'errore puntuale
  215.                     certificateInfo.checkValid(date);
  216.                 }
  217.             }
  218.             else {
  219.                 if(params.getConfig().isCheckValidity()) {
  220.                     log.debug(prefixCert+"Check validity ..."); // la faccio sempre per avere l'errore puntuale
  221.                     certificateInfo.checkValid(date);       
  222.                 }
  223.             }
  224.         }catch(CertificateExpiredException t) {
  225.             return CertificateStatus.EXPIRED(prefixCert+t.getMessage(), certificateInfo.getNotAfter());
  226.         }catch(CertificateNotYetValidException t) {
  227.             return CertificateStatus.EXPIRED(prefixCert+t.getMessage(), certificateInfo.getNotBefore());
  228.         }catch(Exception t) {
  229.             return CertificateStatus.EXPIRED(prefixCert+t.getMessage(), certificateInfo.getNotAfter());
  230.         }
  231.         
  232.         if(certificateInfo.isSelfSigned()) {
  233.             log.debug(prefixCert+"Self signed");            
  234.             return CertificateStatus.SELF_SIGNED();
  235.         }
  236.         
  237.         if(params.getIssuerCertificate()==null) {
  238.             if(params.getConfig().isRejectsCertificateWithoutCA()) {
  239.                 throw new UtilsException(prefixCert+"IssuerCertificate not provided");
  240.             }
  241.             else {
  242.                 return CertificateStatus.ISSUER_NOT_FOUND();
  243.             }
  244.         }
  245.         
  246.         if(params.getConfig().isCrl()) {
  247.             // viene richiesta una validazione CRL alternativa al OCSP
  248.             return checkCRLEngine(log, params, crlInput, date, prefixCert);
  249.         }

  251.         if (params.getResponderURIs() == null || params.getResponderURIs().isEmpty()) {
  252.             boolean reject = true;
  253.             if(isCA) {
  254.                 reject = params.getConfig().isRejectsCAWithoutResponderUrl();
  255.             }
  256.             else {
  257.                 reject = params.getConfig().isRejectsCertificateWithoutResponderUrl();
  258.             }
  259.             if(reject) {
  260.                 throw new UtilsException(prefixCert+"At least one OCSP responder required");
  261.             }
  262.             else {
  263.                 if(isCA && params.getConfig().isCrlCaCheck()) {
  264.                     return checkCRLEngine(log, params, crlInput, date, prefixCert);
  265.                 }
  266.                 else {
  267.                     return CertificateStatus.OCSP_RESPONDER_NOT_FOUND();
  268.                 }
  269.             }
  270.         }

  272.         StringBuilder sbError = new StringBuilder();
  273.         
  274.         for (String responderURI : params.getResponderURIs()) {

  276.             String prefix =prefixCert+ "["+responderURI+"] ";

  278.             OCSPResponseCode responseCode = null;
  279.             UtilsException error = null;
  280.             
  281.             OCSPRequestSigned ocspRequest = null;
  282.             try {
  283.                 log.debug(prefix+"Build request ...");
  284.                 ocspRequest = buildOCSPReq(log, prefix, params);
  285.             }catch(Exception t) {
  286.                 responseCode = OCSPResponseCode.OCSP_BUILD_REQUEST_FAILED;
  287.                 error = new UtilsException(prefixCert+"(url: "+responderURI+"): "+t.getMessage(),t);
  288.                 log.error(prefix+"costruzione richiesta fallita: "+t.getMessage(),t);
  289.                 /** gestito sotto con gli stati throw error; */
  290.             }
  291.                 
  292.             BasicOCSPResp ocspResp = null;
  293.             if(ocspRequest!=null) {
  294.                 try {
  295.                     log.debug(prefix+"Invoke ocsp ...");
  296.                     OCSPResp ocspResponse = invokeOCSP(log, ocspRequest, responderURI, params);
  297.     
  298.                     log.debug(prefix+"Analyze response ...");
  299.                     responseCode = OCSPResponseCode.toOCSPResponseCode(ocspResponse.getStatus());
  300.     
  301.                     if(OCSPResponseCode.SUCCESSFUL.equals(responseCode)) {
  302.                         if(ocspResponse.getResponseObject()==null) {
  303.                             throw new UtilsException("OCSP response object not found");
  304.                         }
  305.                         else if (ocspResponse.getResponseObject() instanceof BasicOCSPResp) {
  306.                             ocspResp = (BasicOCSPResp) ocspResponse.getResponseObject();
  307.                         } else {
  308.                             throw new UtilsException("Invalid or unknown OCSP response");
  309.                         }
  310.                     }
  311.                     
  312.                 }catch(Exception t) {
  313.                     responseCode = OCSPResponseCode.OCSP_INVOKE_FAILED;
  314.                     error = new UtilsException(prefixCert+"(url: "+responderURI+"): "+t.getMessage(),t);
  315.                     log.error(prefix+"invocazione servizio ocsp fallita: "+t.getMessage(),t);
  316.                     /** gestito sotto con gli stati throw error; */
  317.                 }
  318.             }
  319.                 
  320.             try {
  321.                 if(OCSPResponseCode.SUCCESSFUL.equals(responseCode) && ocspResp!=null) {
  322.                     return analyzeResponse(log, prefix, params, date, ocspRequest, ocspResp);
  323.                 }
  324.                 else {
  325.                     
  326.                     String msgFailed = responseCode.getMessage();
  327.                     if(error!=null) {
  328.                         msgFailed = msgFailed+"; "+error.getMessage();
  329.                     }
  330.                     String exceptionMessage = "OCSP response error ("+responseCode.getCode()+" - "+responseCode.name()+"): "+msgFailed;
  331.                     
  332.                     if(params.getConfig().getResponderBreakStatus()==null || 
  333.                             params.getConfig().getResponderBreakStatus().isEmpty() ||
  334.                             params.getConfig().getResponderBreakStatus().contains(responseCode)) {
  335.                         throw new UtilsException(exceptionMessage);
  336.                     }
  337.                     else {
  338.                         // continue verso il prossimo responder url
  339.                         // salvo la prima risposta, e se dopo aver provato tutte le url non ho trovato una risposta valido ritorna la prima
  340.                         if(sbError.length()>0) {
  341.                             sbError.append("\n");
  342.                         }
  343.                         sbError.append("[").append(responderURI).append("] ");
  344.                         sbError.append(exceptionMessage);
  345.                     }
  346.                 }

  348.             }catch(Exception t) {
  349.                 log.error(prefix+"analisi fallita: "+t.getMessage(),t);
  350.                 throw new UtilsException(prefixCert+"OCSP analysis failed (url: "+responderURI+"): "+t.getMessage(),t);
  351.             }

  353.         }
  354.         
  355.         throw new UtilsException("OCSP analysis failed.\n"+sbError.toString());
  356.     }

  358.     private static OCSPRequestSigned buildOCSPReq(LoggerBuffer log, String prefix, OCSPRequestParams params) throws UtilsException {

  360.         try {

  362.             OCSPRequestSigned ocspRequestSigned = new OCSPRequestSigned();

  364.             DigestCalculatorProvider digestCalculatorProvider = new JcaDigestCalculatorProviderBuilder().build();
  365.             DigestCalculator digestCalculator = digestCalculatorProvider.get(CertificateID.HASH_SHA1);

  367.             JcaCertificateID certificateID = new JcaCertificateID(digestCalculator, params.getIssuerCertificate(), params.getCertificate().getSerialNumber());

  369.             // Nounce extension (evitare reply attacks)
  370.             SecureRandomAlgorithm secureRandomAlgorithm = params.getConfig().getSecureRandomAlgorithm();
  371.             if(secureRandomAlgorithm==null) {
  372.                 secureRandomAlgorithm = SecureRandomAlgorithm.SHA1PRNG;
  373.             }
  374.             RandomGenerator randomGenerator = new RandomGenerator(true, secureRandomAlgorithm);
  375.             BigInteger nounce = BigInteger.valueOf(Math.abs(randomGenerator.nextInt()));

  377.             DEROctetString derNounceString = new DEROctetString(nounce.toByteArray());
  378.             Extension nounceExtension = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, derNounceString);
  379.             Extensions extensions = new Extensions(nounceExtension);

  381.             OCSPReqBuilder builder = new OCSPReqBuilder();
  382.             if(params.getConfig().isNonce()) {
  383.                 log.debug(prefix+"Build nonce value '"+derNounceString+"' ...");
  384.                 builder.addRequest(certificateID, extensions); // l'estensione nonce viene aggiunta come 'Request Single Extensions' dentro 'Requestor List'
  385.                 builder.setRequestExtensions(extensions); // l'estensione nonce viene aggiunta come 'Request Extensions' nel livello principale
  386.             }
  387.             else {
  388.                 builder.addRequest(certificateID);
  389.             }
  390.             OCSPReq ocspRequest = builder.build();

  392.             ocspRequestSigned.request = ocspRequest;
  393.             ocspRequestSigned.certificateID = certificateID;
  394.             ocspRequestSigned.nounce = nounce;

  396.             return ocspRequestSigned;

  398.         }catch(Exception t) {
  399.             throw new UtilsException("Build OCSP Request failed: "+t.getMessage(),t);
  400.         }

  402.     }

  404.     private static OCSPResp invokeOCSP(LoggerBuffer log, OCSPRequestSigned ocspRequest, String responderURI, OCSPRequestParams params) throws UtilsException {

  406.         try {
  407.             
  408.             /**java.io.File f = new java.io.File("/tmp/ocsp.request");
  409.             org.openspcoop2.utils.resources.FileSystemUtilities.writeFile(f, ocspRequest.request.getEncoded());*/
  410.             // Per verificare serializzare response su file e usare il comando: openssl ocsp -reqin /tmp/ocsp.request -noverify -text
  411.             
  412.             if(!responderURI.trim().startsWith("http") && !responderURI.trim().startsWith("file")) {
  413.                 throw new UtilsException("Unsupported protocol");
  414.             }
  415.             
  416.             HttpRequest req = new HttpRequest();
  417.             req.setMethod(HttpRequestMethod.POST);
  418.             req.setContentType(HttpConstants.CONTENT_TYPE_OCSP_REQUEST);
  419.             req.setContent(ocspRequest.request.getEncoded());
  420.             
  421.             responderURI = responderURI.trim();
  422.             if(params.getConfig().getForwardProxyUrl()!=null && StringUtils.isNotEmpty(params.getConfig().getForwardProxyUrl())) {
  423.                 String forwardProxyUrl = params.getConfig().getForwardProxyUrl();
  424.                 String remoteLocation = params.getConfig().isForwardProxyBase64() ? Base64Utilities.encodeAsString(responderURI.getBytes()) : responderURI;
  425.                 if(params.getConfig().getForwardProxyHeader()!=null && StringUtils.isNotEmpty(params.getConfig().getForwardProxyHeader())) {
  426.                     req.addHeader(params.getConfig().getForwardProxyHeader(), remoteLocation);
  427.                 }
  428.                 else if(params.getConfig().getForwardProxyQueryParameter()!=null && StringUtils.isNotEmpty(params.getConfig().getForwardProxyQueryParameter())) {
  429.                     Map<String, List<String>> queryParameters = new HashMap<>();
  430.                     TransportUtils.addParameter(queryParameters,params.getConfig().getForwardProxyQueryParameter(), remoteLocation);
  431.                     forwardProxyUrl = TransportUtils.buildUrlWithParameters(queryParameters, forwardProxyUrl, false, log.getLogDebug());
  432.                 }
  433.                 else {
  434.                     throw new UtilsException("Forward Proxy configuration error: header and query parameter not found");
  435.                 }
  436.                 req.setUrl(forwardProxyUrl);
  437.             }
  438.             else {
  439.                 req.setUrl(responderURI);
  440.             }
  441.             
  442.             if(req.getUrl().startsWith("https")) {
  443.                 req.setHostnameVerifier(params.getConfig().isExternalResourcesHostnameVerifier());
  444.                 req.setTrustAllCerts(params.getConfig().isExternalResourcesTrustAllCerts());
  445.                 if(params.getHttpsTrustStore()!=null) {
  446.                     req.setTrustStore(params.getHttpsTrustStore().getKeystore());
  447.                 }
  448.                 if(params.getHttpsKeyStore()!=null) {
  449.                     req.setKeyStore(params.getHttpsKeyStore().getKeystore());
  450.                     req.setKeyAlias(params.getConfig().getExternalResourcesKeyAlias());
  451.                     req.setKeyPassword(params.getConfig().getExternalResourcesKeyPassword());
  452.                 }
  453.             }
  454.             req.setConnectTimeout(params.getConfig().getConnectTimeout());
  455.             req.setReadTimeout(params.getConfig().getReadTimeout());

  457.             HttpResponse res = HttpUtilities.httpInvoke(req);

  459.             List<Integer> returnCodeValid = params.getConfig().getResponderReturnCodeOk();
  460.             if(returnCodeValid==null) {
  461.                 returnCodeValid = new ArrayList<>();
  462.             }
  463.             if(returnCodeValid.isEmpty()) {
  464.                 returnCodeValid.add(200);
  465.             }
  466.             boolean isValid = false;
  467.             for (Integer rt : returnCodeValid) {
  468.                 if(rt!=null && rt.intValue() == res.getResultHTTPOperation()) {
  469.                     isValid = true;
  470.                     break;
  471.                 }
  472.             }

  474.             byte[] response = res.getContent();
  475.             
  476.             /**java.io.File f = new java.io.File("/tmp/ocsp.response");
  477.             org.openspcoop2.utils.resources.FileSystemUtilities.writeFile(f, response);*/
  478.             // Per verificare serializzare response su file e usare il comando:  openssl ocsp -respin /tmp/ocsp.response -noverify -text

  480.             if(isValid) {
  481.                 if(response!=null && response.length>0) {
  482.                     return new OCSPResp(res.getContent());
  483.                 }
  484.                 else {
  485.                     throw new UtilsException("OCSP empty response (http code: "+res.getResultHTTPOperation()+")");
  486.                 }
  487.             }
  488.             else {
  489.                 String error = null;
  490.                 if(response.length<=(2048)) {
  491.                     error = Utilities.convertToPrintableText(response, 2048);
  492.                     if(error!=null && error.contains("Visualizzazione non riuscita")) {
  493.                         error = null;
  494.                     }
  495.                 }
  496.                 if(error==null) {
  497.                     error="";
  498.                 }
  499.                 else {
  500.                     error = ": "+error;
  501.                 }
  502.                 throw new UtilsException("OCSP response error (http code: "+res.getResultHTTPOperation()+")"+error);
  503.             }

  505.         }catch(Exception t) {
  506.             throw new UtilsException("Invoke OCSP '"+responderURI+"' failed: "+t.getMessage(),t);
  507.         }

  509.     }

  511.     private static CertificateStatus analyzeResponse(LoggerBuffer log, String prefix, OCSPRequestParams params, Date date, OCSPRequestSigned requestSigned, BasicOCSPResp basicOcspResponse)
  512.             throws UtilsException {

  514.         // Verifico la risposta ottenuta dal OCSP
  515.         verifyResponse(log, prefix, params, date, requestSigned, basicOcspResponse);
  516.         
  517.         // Analizzo la risposta, la quale potrebbe contenere informazioni anche per altri certificati.
  518.         SingleResp expectedResponseForCertificate = null;
  519.         for (SingleResp resp : basicOcspResponse.getResponses()) {
  520.             if (isEquals(requestSigned.certificateID, resp.getCertID())) {
  521.                 expectedResponseForCertificate = resp;
  522.                 break;
  523.             }
  524.         }
  525.         if (expectedResponseForCertificate == null) {
  526.             throw new UtilsException("OSPC Response does not contain info for certificate supplied in the OCSP request");
  527.         }
  528.         org.bouncycastle.cert.ocsp.CertificateStatus certStatus = expectedResponseForCertificate.getCertStatus();
  529.         
  530.         // NO! lo stato null è proprio il GOOD. GOOD è un alias a null
  531.         /**if(certStatus==null) {
  532.             throw new UtilsException("OSPC Response does not contain status info for certificate supplied in the OCSP request");
  533.         }*/
  534.         if (certStatus == org.bouncycastle.cert.ocsp.CertificateStatus.GOOD) {
  535.              return CertificateStatus.GOOD();
  536.         }
  537.         else if (certStatus instanceof RevokedStatus) {
  538.             RevokedStatus revoked = (RevokedStatus)certStatus;
  539.             CRLReason reason = null;
  540.             if (revoked.hasRevocationReason()) {
  541.                 reason = CRLReason.values()[revoked.getRevocationReason()];
  542.             }
  543.             return CertificateStatus.REVOKED(reason, revoked.getRevocationTime());
  544.         }
  545.         else if (certStatus instanceof UnknownStatus) {
  546.             return CertificateStatus.UNKNOWN();
  547.         }
  548.         else {
  549.             throw new UtilsException("OSPC Response contain unknown revocation status ("+certStatus+")");
  550.         }
  551.         
  552.     }

  554.     private static boolean isEquals(JcaCertificateID ocspRequestCertificateId, CertificateID ocspResponseCertificateId) {
  555.         if (ocspRequestCertificateId == null || ocspResponseCertificateId == null)
  556.             return false;
  557.         if (ocspRequestCertificateId == ocspResponseCertificateId)
  558.             return true;        
  559.         boolean serialNumberEquals = ocspRequestCertificateId.getSerialNumber()!=null && ocspResponseCertificateId.getSerialNumber()!=null && ocspRequestCertificateId.getSerialNumber().equals(ocspResponseCertificateId.getSerialNumber());
  560.         boolean nameHashEquals = ocspRequestCertificateId.getIssuerNameHash()!=null && ocspResponseCertificateId.getIssuerNameHash()!=null && Arrays.equals(ocspRequestCertificateId.getIssuerNameHash(), ocspResponseCertificateId.getIssuerNameHash());
  561.         boolean keyHashEquals = ocspRequestCertificateId.getIssuerKeyHash()!=null && ocspResponseCertificateId.getIssuerKeyHash()!=null && Arrays.equals(ocspRequestCertificateId.getIssuerKeyHash(), ocspResponseCertificateId.getIssuerKeyHash());
  562.         return serialNumberEquals && nameHashEquals && keyHashEquals;

  564.     }

  566.     private static void verifyResponse(LoggerBuffer log, String prefix, OCSPRequestParams params, Date date, OCSPRequestSigned requestSigned, BasicOCSPResp basicOcspResponse) throws UtilsException {

  568.         List<X509CertificateHolder> certs = new ArrayList<>(Arrays.asList(basicOcspResponse.getCerts())); 
  569.         try {
  570.             // certificati ritornati con la risposta ocsp
  571.             X509CertificateHolder[] ospcCerts = basicOcspResponse.getCerts();
  572.             if(ospcCerts!=null && ospcCerts.length>0) {
  573.                 certs.addAll(Arrays.asList(ospcCerts));
  574.             }
  575.             
  576.             // certificato dell'issuer
  577.             certs.add(new JcaX509CertificateHolder(params.getIssuerCertificate())); 
  578.             
  579.             // eventuale certificato di firma del responder OCSP autorizzato puntualmente
  580.             if (params.getSignerCertificate() != null) {
  581.                 certs.add(new JcaX509CertificateHolder(params.getSignerCertificate()));
  582.             }
  583.         } catch (Exception e) {
  584.             throw new UtilsException("OCSP Response signature unverifiable; read certs failed: "+e.getMessage(),e);
  585.         }
  586.         
  587.         // Ottengo il certificato utilizzato per firmare la risposta
  588.         X509Certificate signingCert = readSigningCertByResponderId(log, certs, basicOcspResponse);
  589.         if (signingCert == null) {
  590.             throw new UtilsException("OCSP Response signature unverifiable: signing cert not found");
  591.         }

  593.         // Valido il certificato
  594.         verifySigningCert(log, prefix, signingCert, params, date);
  595.         
  596.         // Verifico la risposta rispetto al certificato
  597.         try {
  598.             log.debug(prefix+"Verify OCSP Response ...");
  599.             JcaContentVerifierProviderBuilder builder = new JcaContentVerifierProviderBuilder();
  600.             builder.setProvider(org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME);
  601.             ContentVerifierProvider contentVerifier = builder.build(signingCert.getPublicKey());
  602.             boolean valid = basicOcspResponse.isSignatureValid(contentVerifier);
  603.             if(!valid) {
  604.                 throw new UtilsException("invalid signature");
  605.             }
  606.         } catch(Exception t) {
  607.             throw new UtilsException("Verifying OCSP Response's signature failed: "+t.getMessage(),t);
  608.         }

  610.         // Verifico validità risposta rispetto a nonce o data
  611.         verifyNonceOrDates(log, prefix, params, requestSigned, basicOcspResponse, date);
  612.     }
  613.     
  614.     private static X509Certificate readSigningCertByResponderId(LoggerBuffer log, List<X509CertificateHolder> certs, BasicOCSPResp basicOcspResponse) throws UtilsException {
  615.         
  616.         if(basicOcspResponse.getResponderId()==null) {
  617.             throw new UtilsException("OSPC Response does not contain responder id");
  618.         }
  619.         ResponderID responderId = basicOcspResponse.getResponderId().toASN1Primitive();
  620.         if(responderId==null) {
  621.             throw new UtilsException("OSPC Response does not contain responder id (asn1)");
  622.         }
  623.         
  624.         List<Throwable> listThrowable = new ArrayList<>();
  625.         
  626.         if (certs!=null && !certs.isEmpty()) {

  628.             X500Name responderName = responderId.getName();
  629.             byte[] responderKey = responderId.getKeyHash();

  631.             if (responderName != null) {
  632.                 for (X509CertificateHolder certHolder : certs) {
  633.                     try {
  634.                         JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
  635.                         converter.setProvider(org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME);
  636.                         X509Certificate certCheck = converter.getCertificate(certHolder);
  637.                         X500Name nameCheck = new X500Name(certCheck.getSubjectX500Principal().getName());
  638.                         if (responderName.equals(nameCheck)) {
  639.                             return certCheck;
  640.                         }
  641.                     } catch (Exception t) {
  642.                         log.debug("check (responderName) failed: "+t.getMessage(),t);
  643.                         listThrowable.add(t);
  644.                     }
  645.                 }
  646.             } else if (responderKey != null) {
  647.                 SubjectKeyIdentifier responderSubjectKey = new SubjectKeyIdentifier(responderKey);
  648.                 for (X509CertificateHolder certHolder : certs) {
  649.                     try {
  650.                         JcaX509CertificateConverter converter = new JcaX509CertificateConverter();
  651.                         converter.setProvider(org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME);
  652.                         X509Certificate certCheck = converter.getCertificate(certHolder);
  653.                         
  654.                         // verifico per subject key identifier
  655.                         SubjectKeyIdentifier subjectKeyIdentifierCheck = null;
  656.                         if (certHolder.getExtensions() != null) {
  657.                             subjectKeyIdentifierCheck = SubjectKeyIdentifier.fromExtensions(certHolder.getExtensions());
  658.                         }
  659.                         if (subjectKeyIdentifierCheck != null && responderSubjectKey.equals(subjectKeyIdentifierCheck)) {
  660.                             return certCheck;
  661.                         }

  663.                         // verifico per chiave pubblica
  664.                         subjectKeyIdentifierCheck = new JcaX509ExtensionUtils().createSubjectKeyIdentifier(certCheck.getPublicKey());
  665.                         if (responderSubjectKey.equals(subjectKeyIdentifierCheck)) {
  666.                             return certCheck;
  667.                         }
  668.                     } catch (Exception t) {
  669.                         log.debug("check (responderKey) failed: "+t.getMessage(),t);
  670.                         listThrowable.add(t);
  671.                     }
  672.                 }
  673.             }
  674.         }
  675.         
  676.         if(!listThrowable.isEmpty()) {
  677.             if(listThrowable.size()==1) {
  678.                 Throwable t = listThrowable.get(0);
  679.                 throw new UtilsException("OCSP Response signature unverifiable: signing cert not found; "+t.getMessage(),t);
  680.             }
  681.             else {
  682.                 UtilsMultiException multi = new UtilsMultiException("OCSP Response signature unverifiable: signing cert not found; multiple exception",listThrowable.toArray(new Throwable[1]));
  683.                 throw new UtilsException(multi.getMessage(),multi);
  684.             }
  685.         }
  686.         
  687.         return null;
  688.     }
  689.     
  690.     private static void verifySigningCert(LoggerBuffer log, String prefix, X509Certificate signingCert, OCSPRequestParams params, Date date) throws UtilsException {
  691.         
  692.         // Un responder OCSP può firmare le risposte in 3 modi (https://www.rfc-editor.org/rfc/rfc6960#section-2.6):
  693.         // 1) La risposta viene firmata utilizzando lo stesso certificato della CA che ha emesso i certificati che si controlla.
  694.         //    In questo caso, nella risposta non viene ritornato alcun certificato.
  695.         //    Questo caso non richiede altri controlli al di fuori delle normali verifiche previste nella connessione TLS o gestione della sicurezza messaggio da cui il certificato proviene.
  696.         // 2) La risposta viene firmata utilizzando un altro certificato firmato dalla stessa CA che ha emesso i certificati che si controlla.
  697.         //    In questo caso nella risposta viene ritornato il certificato di firma utilizzato.
  698.         //    Deve essere controllato che il certificato abbia una 'Extended Key Usage Extension' impostata a 'id-kp-OCSPSigning' così che possa essere considerato affidabile per questo scopo.
  699.         //    Il controllo è fondamentale per prevenire attacchi "man in the middle" (siamo in http durante la comunicazione con OCSP) 
  700.         //    dove la risposta intercettata viene alterata firmandola con un altro certificato rilasciato sempre dalla CA, ma non adibito a firmare risposte OCSP.
  701.         // 3) La risposta viene firmata usando un altro certificato che non è in relazione con il certificato che si sta controllando.
  702.         //    Deve quindi essere verificato ulteriormente il certificato ritornato dal responder per assicurarsi che sia "trusted"
  703.             
  704.         if(signingCert==null) {
  705.             throw new UtilsException("Signing certificate not found");
  706.         }

  708.         if (signingCert.equals(params.getIssuerCertificate())) {

  710.             /** System.out.println("*** [Case 1] OCSP response is signed by the certificate's Issuing CA ***"); */
  711.             // Non sono richiesti altri controlli
  712.             
  713.             log.debug(prefix+"[Case 1] OCSP response is signed by the certificate's Issuing CA");
  714.             
  715.         } else if (params.getSignerCertificate() != null && signingCert.equals(params.getSignerCertificate())) {
  716.             
  717.             /** System.out.println("*** [Case 3] OCSP response is signed by an authorized responder certificate manually configured***"); */
  718.             // Essendo un certificato fornito manualmente non servono altri controlli
  719.             // NOTA: essendo fornito puntualmente, è compito di chi lo configura assicurarsi che abbia l'extension key usage corretto o ne accetta il fatto che non le abbia

  721.             log.debug(prefix+"[Case 3] OCSP response is signed by an authorized responder certificate manually configured: "+signingCert.getSubjectDN());
  722.             
  723.         } else {

  725.             /** System.out.println("*** [Case 2 e 3] OCSP response is signed by an responder certificate readed in ocsp response ***"); */

  727.             // Estratto da https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2
  728.             // - OCSP signing delegation SHALL be designated by the inclusion of  id-kp-OCSPSigning in an extended key usage certificate extension included in the OCSP response signer's certificate.  
  729.             //   This certificate MUST be issued directly by the CA that is identified in the request.
  730.             
  731.             boolean responderCertificateManuallyAuthorized = false;
  732.             X509Certificate differentIssuerResponderCertificateCA = null;
  733.             KeyStore differentIssuerResponderCertificateTrustStore = null;
  734.             
  735.             if (!signingCert.getIssuerX500Principal().equals(params.getIssuerCertificate().getSubjectX500Principal())) {
  736.                 // Case 3: La risposta viene firmata usando un altro certificato che non è in relazione con il certificato che si sta controllando.
  737.                 
  738.                 log.debug(prefix+"[Case 3] OCSP response is signed by an responder certificate readed in ocsp response (different CA '"+signingCert.getIssuerDN()+"'): "+signingCert.getSubjectDN());
  739.                 
  740.                 if(params.getSignerTrustStore()!=null) {
  741.                     X509Certificate tmp = (X509Certificate) params.getSignerTrustStore().getCertificateBySubject(signingCert.getSubjectX500Principal());
  742.                     if(tmp!=null && tmp.equals(signingCert)) {
  743.                         responderCertificateManuallyAuthorized = true; // autorizzato puntualmente il certificato
  744.                     }
  745.                     else {
  746.                         differentIssuerResponderCertificateCA = (X509Certificate) params.getSignerTrustStore().getCertificateBySubject(signingCert.getIssuerX500Principal());
  747.                     }
  748.                     
  749.                     differentIssuerResponderCertificateTrustStore = params.getSignerTrustStore();
  750.                 }
  751.                 
  752.                 if(!responderCertificateManuallyAuthorized && differentIssuerResponderCertificateCA==null) {
  753.                     throw new UtilsException("Signing certificate is not authorized to sign OCSP responses: unauthorized different issuer certificate '"+signingCert.getIssuerDN()+"'");
  754.                 }
  755.             }
  756.             else {
  757.                 log.debug(prefix+"[Case 2] OCSP response is signed by an responder certificate readed in ocsp response (same CA): "+signingCert.getSubjectDN());
  758.             }
  759.             
  760.             // Controllo Extended Key Usage
  761.             
  762.             CertificateInfo certificateInfo = new CertificateInfo(signingCert, "signingCert");
  763.             List<ExtendedKeyUsage> requiredExtendedKeyUsages = params.getConfig().getExtendedKeyUsageRequired(); // consente di disabilitare il controllo per ambienti di test
  764.             if(requiredExtendedKeyUsages!=null && !requiredExtendedKeyUsages.isEmpty()) {
  765.                 for (ExtendedKeyUsage extendedKeyUsage : requiredExtendedKeyUsages) {
  766.                     boolean hasExtendedKeyUsage = false;
  767.                     try {
  768.                         log.debug(prefix+"Check ExtendedKeyUsage '"+extendedKeyUsage+"' ...");
  769.                         hasExtendedKeyUsage = certificateInfo.hasExtendedKeyUsage(extendedKeyUsage);
  770.                     }catch(Exception t) {
  771.                         throw new UtilsException("Signing certificate not valid for signing OCSP responses: extended key usage '"+extendedKeyUsage+"' not found; "+t.getMessage(),t);
  772.                     }
  773.                     if(!hasExtendedKeyUsage) {
  774.                         throw new UtilsException("Signing certificate not valid for signing OCSP responses: extended key usage '"+extendedKeyUsage+"' not found");
  775.                     }
  776.                 }
  777.             }
  778.             else {
  779.                 log.debug(prefix+"Check ExtendedKeyUsage disable");
  780.             }
  781.             
  782.             // Verifica del certificato di firma
  783.             
  784.             // https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2.1
  785.             
  786.             // Revocation Checking of an Authorized Responder
  787.             //    Since an authorized OCSP responder provides status information for one or more CAs, OCSP clients need to know how to check that an Authorized Responder's certificate has not been revoked.  
  788.             //    CAs may  choose to deal with this problem in one of three ways:
  789.             //
  790.             //    1) A CA may specify that an OCSP client can trust a responder for the lifetime of the responder's certificate.  
  791.             //       The CA does so by including the extension id-pkix-ocsp-nocheck.  
  792.             //       This SHOULD be a non-critical extension.  The value of the extension SHALL be NULL.
  793.             //       CAs issuing such a certificate should realize that a compromise of the responder's key is as serious as the compromise of a CA key used to sign CRLs, 
  794.             //       at least for the validity period of this certificate.  
  795.             //       CAs may choose to issue this type of certificate with a very short lifetime and renew it frequently.
  796.             /**       Identificativo: id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 } */
  797.             //
  798.             //    2) A CA may specify how the responder's certificate is to be checked for revocation.  
  799.             //        This can be done by using CRL Distribution Points if the check should be done using CRLs, 
  800.             //        or by using Authority Information Access if the check should be done in some other way.
  801.             //        Details for specifying either of these two mechanisms are available in [RFC5280].
  802.             //    
  803.             //    3) A CA may choose not to specify any method of revocation checking for the responder's certificate, 
  804.             //       in which case it would be up to the OCSP client's local security policy to decide whether that certificate should be checked for revocation or not.
  805.             
  806.             org.openspcoop2.utils.certificate.Extensions exts = null;
  807.             try {
  808.                 exts = certificateInfo.getExtensions();
  809.             }catch(Exception t) {
  810.                 log.debug("Extension read failed: "+t.getMessage(),t);
  811.             }
  812.             boolean ocspNoCheck = exts!=null && exts.hasExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nocheck);
  813.             
  814.             log.debug(prefix+"ocsp_nocheck:"+ocspNoCheck);
  815.             
  816.             // Caso 1 e 3 vengono gestiti in ugual maniera
  817.             // Il caso 2 viene gestito con CRL, mentre non si gestisce un eventuale loop verso un altro servizio OCSP
  818.             
  819.             CRLParams crlParams = null;
  820.             if(!ocspNoCheck &&
  821.                 params.getConfig().isCrlSigningCertCheck()) {
  822.                 log.debug(prefix+"(SigningCert:"+signingCert.getSubjectDN()+") Build CRL params...");
  823.                 KeyStore trustStoreConfig = differentIssuerResponderCertificateTrustStore!=null ? differentIssuerResponderCertificateTrustStore : params.getIssuerTrustStore();
  824.                 try {
  825.                     crlParams = CRLParams.build(log, signingCert, null, trustStoreConfig, params.getConfig(), params.getReader());
  826.                 }catch(Exception t) {
  827.                     throw new UtilsException(t.getMessage(),t);
  828.                 }
  829.             }
  830.             
  831.             if(crlParams==null || crlParams.getCrlCertstore()==null) { // altrimenti la validita' viene verificata insieme alle CRL)
  832.                 // Controllo che non sia scaduto
  833.                 try {
  834.                     log.debug(prefix+" (SigningCert:"+signingCert.getSubjectDN()+") Check valid...");
  835.                     certificateInfo.checkValid(date);
  836.                 }catch(CertificateNotYetValidException t) {
  837.                     throw new UtilsException("Signing certificate not yet valid: "+t.getMessage(),t);
  838.                 }catch(CertificateExpiredException t) {
  839.                     throw new UtilsException("Signing certificate expired: "+t.getMessage(),t);
  840.                 }catch(Exception t) {
  841.                     throw new UtilsException("Signing certificate not valid: "+t.getMessage(),t);
  842.                 }
  843.             }
  844.             
  845.             String ca = "n.d.";
  846.             try {
  847.                 if(responderCertificateManuallyAuthorized) {
  848.                     // non devo verificarlo, è stato inserito nel truststore dedicato il certificato del responder puntualmente
  849.                 }
  850.                 else if(differentIssuerResponderCertificateCA!=null) {
  851.                     if(differentIssuerResponderCertificateCA.getSubjectDN()!=null) {
  852.                         ca = differentIssuerResponderCertificateCA.getSubjectDN().toString();
  853.                     }
  854.                     log.debug(prefix+"(SigningCert:"+signingCert.getSubjectDN()+") verify against ca '"+ca+"'...");
  855.                     certificateInfo.verify(differentIssuerResponderCertificateCA);
  856.                 }
  857.                 else {
  858.                     if(params.getIssuerCertificate().getSubjectDN()!=null) {
  859.                         ca = params.getIssuerCertificate().getSubjectDN().toString();
  860.                     }
  861.                     log.debug(prefix+"(SigningCert:"+signingCert.getSubjectDN()+") verify against ca '"+ca+"'...");
  862.                     certificateInfo.verify(params.getIssuerCertificate());
  863.                 }
  864.             } catch (Exception t) {
  865.                 throw new UtilsException("Signing certificate not valid (CA: "+ca+"): "+t.getMessage(),t);
  866.             }
  867.             
  868.             if(crlParams!=null && crlParams.getCrlCertstore()!=null) {
  869.                 try {
  870.                     log.debug(prefix+"(SigningCert:"+signingCert.getSubjectDN()+") CRL check...");
  871.                     certificateInfo.checkValid(crlParams.getCrlCertstore(), crlParams.getCrlTrustStore(), date);
  872.                 }catch(Exception t) {
  873.                     throw new UtilsException("Signing certificate not valid (CRL): "+t.getMessage(),t);
  874.                 }
  875.             }

  877.         }
  878.         
  879.     }
  880.     
  881.     private static void verifyNonceOrDates(LoggerBuffer log, String prefix, OCSPRequestParams params, OCSPRequestSigned requestSigned, BasicOCSPResp basicOcspResponse, Date date) throws UtilsException {
  882.         // https://www.rfc-editor.org/rfc/rfc6960#section-4.4.1
  883.         
  884.         // The nonce cryptographically binds a request and a response to prevent replay attacks.  
  885.         // The nonce is included as one of the requestExtensions in requests, while in responses it would be included as one of the responseExtensions.  
  886.         // In both the request and the response, the nonce will be identified by the object identifier id-pkix-ocsp-nonce, while the extnValue is the value of the nonce.
  887.         byte[] requestNonce = requestSigned.nounce!=null ? requestSigned.nounce.toByteArray() : null;
  888.         Extension responseNonce = basicOcspResponse.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
  889.         if (responseNonce != null && requestNonce != null) {
  890.             log.debug(prefix+"Verify nonce request-response...");
  891.             if(!Arrays.equals(requestNonce, responseNonce.getExtnValue().getOctets())) {
  892.                 throw new UtilsException("OCSP Response not valid: nonces do not match");
  893.             }
  894.         }
  895.         else {
  896.             log.debug(prefix+"Verify nonce dates...");
  897.             
  898.             // https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.1
  899.             
  900.             // Responses can contain four times -- thisUpdate, nextUpdate, producedAt, and revocationTime.  
  901.             // The semantics of these fields are defined in Section 2.4.  The format for GeneralizedTime is as specified in Section 4.1.2.5.2 of [RFC5280].

  903.             // The thisUpdate and nextUpdate fields define a recommended validity interval.  This interval corresponds to the {thisUpdate, nextUpdate} interval in CRLs.  
  904.             // Responses whose nextUpdate value is earlier than the local system time value SHOULD be considered unreliable.
  905.             // Responses whose thisUpdate time is later than the local system time SHOULD be considered unreliable.
  906.             // If nextUpdate is not set, the responder is indicating that newer  revocation information is available all the time.
  907.             
  908.             // The semantics of these fields are:

  910.             // thisUpdate      The most recent time at which the status being indicated is known by the responder to have been correct.

  912.             // nextUpdate      The time at or before which newer information will be available about the status of the certificate.

  914.             // producedAt      The time at which the OCSP responder signed this response.

  916.             // revocationTime  The time at which the certificate was revoked or placed on hold.
  917.             
  918.             long current = date.getTime();
  919.             int toleranceMilliseconds = params.getConfig().getResponseCheckDateToleranceMilliseconds();
  920.             Date rightInterval = new Date(current + toleranceMilliseconds);
  921.             Date leftInterval = new Date(current - toleranceMilliseconds);

  923.             SingleResp[] resp = basicOcspResponse.getResponses();
  924.             if(resp!=null && resp.length>0) {
  925.                 // una risposta ci deve essere, se non c'è è già stata sollevata una eccezione in precedenza
  926.                 for (SingleResp singleResp : resp) {
  927.                     
  928.                     // Responses whose thisUpdate time is later than the local system time SHOULD be considered unreliable.
  929.                     if(rightInterval.before(singleResp.getThisUpdate())){
  930.                         throw new UtilsException("OCSP Response is unreliable: this update time '"+DateUtils.getSimpleDateFormatMs().format(singleResp.getThisUpdate())+"' is later than the local system time");
  931.                     }
  932.                     
  933.                     // Responses whose nextUpdate value is earlier than the local system time value SHOULD be considered unreliable.
  934.                     // If nextUpdate is not set, the responder is indicating that newer  revocation information is available all the time.
  935.                     Date dateCheck = singleResp.getNextUpdate() != null ? singleResp.getNextUpdate() : singleResp.getThisUpdate();
  936.                     if(leftInterval.after(dateCheck)) {
  937.                         throw new UtilsException("OCSP Response is unreliable: next update time '"+DateUtils.getSimpleDateFormatMs().format(dateCheck)+"' is earlier than the local system time");
  938.                     }
  939.                 }
  940.             }

  942.         }
  943.         
  944.     }
  945.     
  946.     private static CertificateStatus checkCRLEngine(LoggerBuffer log, OCSPRequestParams params, String crlInput, Date date, String prefix) throws UtilsException {
  947.         
  948.         log.debug(prefix+"Build CRL request ...");
  949.         
  950.         CRLParams crlParams = null;
  951.         try {
  952.             crlParams = CRLParams.build(log, params.getCertificate(), crlInput, params.getIssuerTrustStore(), params.getConfig(), params.getReader());
  953.         }catch(Exception t) {
  954.             throw new UtilsException(t.getMessage(),t);
  955.         }
  956.                 
  957.         CertificateInfo certificateInfo = new CertificateInfo(params.getCertificate(), "certificateCrlCheck");
  958.         
  959.         if(!certificateInfo.isSelfSigned()) {
  960.             log.debug(prefix+"Verify against CA ...");
  961.             
  962.             String ca = "n.d.";
  963.             try {
  964.                 if(params.getIssuerCertificate().getSubjectDN()!=null) {
  965.                     ca = params.getIssuerCertificate().getSubjectDN().toString();
  966.                 }
  967.                 certificateInfo.verify(params.getIssuerCertificate());
  968.             } catch (Exception t) {
  969.                 CertificateStatus cs = CertificateStatus.REVOKED(CRLReason.UNSPECIFIED, null);
  970.                 String eMessage = t.getMessage();
  971.                 String msgError = "Certificate not valid (CA: "+ca+"): "+eMessage;
  972.                 log.error(msgError, t);
  973.                 cs.setDetails(msgError);
  974.                 return cs;
  975.             }
  976.         }
  977.         else {
  978.             log.debug(prefix+"Certificate self-signed");
  979.         }
  980.         
  981.         CertificateStatus status = CertificateStatus.GOOD();
  982.         
  983.         try {
  984.             if(crlParams.getCrlCertstore()!=null) {
  985.                 
  986.                 log.debug(prefix+"Verify CRL ...");
  987.                 
  988.                 certificateInfo.checkValid(crlParams.getCrlCertstore(), crlParams.getCrlTrustStore(), date);
  989.             }
  990.             else {
  991.                 log.debug(prefix+"CRL undefined");
  992.                 
  993.                 status = CertificateStatus.CRL_NOT_FOUND();
  994.             }
  995.         }catch(Exception t) {
  996.             CertificateStatus cs = CertificateStatus.REVOKED(CRLReason.UNSPECIFIED, null);
  997.             String eMessage = t.getMessage();
  998.             if(Utilities.existsInnerException(t, java.security.cert.CertificateExpiredException.class)) {
  999.                 Throwable inner = Utilities.getInnerException(t, java.security.cert.CertificateExpiredException.class);
  1000.                 if(inner!=null && inner.getMessage()!=null) {
  1001.                     eMessage = inner.getMessage();
  1002.                 }
  1003.             }
  1004.             else if (Utilities.existsInnerException(t, java.security.cert.CertificateRevokedException.class)) {
  1005.                 Throwable inner = Utilities.getInnerException(t, java.security.cert.CertificateRevokedException.class);
  1006.                 if(inner instanceof java.security.cert.CertificateRevokedException) {
  1007.                     java.security.cert.CertificateRevokedException cre = (java.security.cert.CertificateRevokedException) inner;
  1008.                     if(cre.getRevocationReason()!=null) {
  1009.                         cs = CertificateStatus.REVOKED(cre.getRevocationReason(), cre.getRevocationDate());
  1010.                     }
  1011.                 }
  1012.             }
  1013.             String msgError = "Certificate not valid (CRL): "+eMessage;
  1014.             log.error(msgError, t);
  1015.             cs.setDetails(msgError);
  1016.             return cs;
  1017.         }
  1018.         
  1019.         return status;
  1020.     }
  1021. }

  1023. class OCSPRequestSigned {
  1024.     OCSPReq request;
  1025.     BigInteger nounce;
  1026.     JcaCertificateID certificateID;
  1027. }
Created with JaCoCo 0.8.8.202204050719