tr.gov.tubitak.uekae.esya.api.infra.ocsp

Class OCSPClient

java.lang.Object

tr.gov.tubitak.uekae.esya.api.infra.ocsp.OCSPClient

public class OCSPClient
extends java.lang.Object

Title: OCSP client

Description: RFC 2560 X.509 Internet Public Key Infrastructure Online Certificate Status Protocol standard is implemented

Copyright: Copyright (c) 2004

Company: TUBITAK/UEKAE

Version:

1.0

Author:

IH

Field Summary

Fields

Modifier and Type	Field and Description
static tr.gov.tubitak.uekae.esya.api.crypto.alg.DigestAlg	digestAlgForOcspRequest
protected static org.slf4j.Logger	logger
protected tr.gov.tubitak.uekae.esya.api.asn.ocsp.EBasicOCSPResponse	mBasicResponse
protected tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse	mOCSPResponce
static com.objsys.asn1j.runtime.Asn1ObjectIdentifier	NONCE_OID
static int	REASON_AA_COMPROMISE
static int	REASON_AFFILIATION_CHANGED
static int	REASON_CA_COMPROMISE
static int	REASON_CERTIFICATE_HOLD
static int	REASON_CESSATION_OF_OPERATION
static int	REASON_KEY_COMPROMISE
static int	REASON_PRIVILEGE_WITHDRAWN
static int	REASON_SUPERSEDED
static int	REASON_UNSPECIFIED
protected tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate	signingCertificate
protected HashMultiMap<java.math.BigInteger,tr.gov.tubitak.uekae.esya.api.asn.ocsp.ESingleResponse>	singleResponses
static int	STATUS_RESPONCE_INVALID_NONCE
static int	STATUS_RESPONSE_CANT_BE_RECEIVED
static int	STATUS_RESPONSE_HAS_INVALID_SIGNATURE

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	OCSPClient()
	OCSPClient(java.lang.String aConnectionAddress)

Method Summary

Modifier and Type	Method and Description
boolean	checkDate(tr.gov.tubitak.uekae.esya.api.asn.ocsp.ESingleResponse aResponse, java.util.Calendar aDate) Checks thisUpdate and nextUpdate in OCSP response agains given date.
boolean	checkNonce() Check nonce value of response.
void	checkResponse()
boolean	checkResponseStatus() Check Response status.
boolean	checkSignature() Check signature value for response.
void	closeConnection() Closes connection
tr.gov.tubitak.uekae.esya.api.asn.ocsp.EBasicOCSPResponse	getBasicResponse()
byte[]	getNonce() Returns the nonce value in the request
tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse	getOCSPResponse()
java.util.Calendar	getProducedAt() Creation time of ocsp response
int	getResponseStatus() ResponseStatus.
tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate	getSigningCertificate() Get the certificate that signs OCSP response, which should be validated.
tr.gov.tubitak.uekae.esya.api.asn.ocsp.ESingleResponse	getSingleResponse(tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aCertificateToQuery, tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aIssuerCertificate)
int	getStatus()
static boolean	isEqual(tr.gov.tubitak.uekae.esya.api.asn.ocsp.ECertID certID, tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aCertificateToQuery, tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aIssuerCertificate) Checks whether certID is generated for the aCertificateToQuery and the aIssuerCertificate.
void	openConnection() Opens connection with default timeout
void	openConnection(java.lang.String aTimeOut) Open connection with defined timeout
tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse	queryCertificate(java.math.BigInteger aSertifikaSeriNo, byte[] aSMSubjectHashDegeri, byte[] aSMAcikAnahtarHashDegeri)
tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse	queryCertificate(tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate[] aCertificatesToQuery, tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate[] aIssuerCertificates) Make multiple query at once.
void	queryCertificate(tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aCertificateToQuery, tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aIssuerCertificate) Make single query.
void	setCheckDate(boolean aCheckDate) Checks thisUpdate and nextUpdate interval in OCSP response covers now Default: false
void	setCheckNonce(boolean aCheckNonce) Defines whether ocsp response nonce will be checked Default: true
void	setCheckResponseStatus(boolean aCheckResponseStatus) Defines whether ocsp response status will be checked
void	setCheckSignature(boolean aCheckSignature) Defines whether ocsp response signature will be checked Default: true
void	setDigestAlgForOcspRequest(tr.gov.tubitak.uekae.esya.api.crypto.alg.DigestAlg digestAlg)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

protected static org.slf4j.Logger logger

REASON_UNSPECIFIED

public static final int REASON_UNSPECIFIED

See Also:

Constant Field Values

REASON_KEY_COMPROMISE

public static final int REASON_KEY_COMPROMISE

See Also:

Constant Field Values

REASON_CA_COMPROMISE

public static final int REASON_CA_COMPROMISE

See Also:

Constant Field Values

REASON_AFFILIATION_CHANGED

public static final int REASON_AFFILIATION_CHANGED

See Also:

Constant Field Values

REASON_SUPERSEDED

public static final int REASON_SUPERSEDED

See Also:

Constant Field Values

REASON_CESSATION_OF_OPERATION

public static final int REASON_CESSATION_OF_OPERATION

See Also:

Constant Field Values

REASON_CERTIFICATE_HOLD

public static final int REASON_CERTIFICATE_HOLD

See Also:

Constant Field Values

REASON_PRIVILEGE_WITHDRAWN

public static final int REASON_PRIVILEGE_WITHDRAWN

See Also:

Constant Field Values

REASON_AA_COMPROMISE

public static final int REASON_AA_COMPROMISE

See Also:

Constant Field Values

STATUS_RESPONSE_HAS_INVALID_SIGNATURE

public static final int STATUS_RESPONSE_HAS_INVALID_SIGNATURE

See Also:

Constant Field Values

STATUS_RESPONSE_CANT_BE_RECEIVED

public static final int STATUS_RESPONSE_CANT_BE_RECEIVED

See Also:

Constant Field Values

STATUS_RESPONCE_INVALID_NONCE

public static final int STATUS_RESPONCE_INVALID_NONCE

See Also:

Constant Field Values

NONCE_OID

public static final com.objsys.asn1j.runtime.Asn1ObjectIdentifier NONCE_OID

singleResponses

protected HashMultiMap<java.math.BigInteger,tr.gov.tubitak.uekae.esya.api.asn.ocsp.ESingleResponse> singleResponses

signingCertificate

protected tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate signingCertificate

mBasicResponse

protected tr.gov.tubitak.uekae.esya.api.asn.ocsp.EBasicOCSPResponse mBasicResponse

mOCSPResponce

protected tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse mOCSPResponce

digestAlgForOcspRequest

public static tr.gov.tubitak.uekae.esya.api.crypto.alg.DigestAlg digestAlgForOcspRequest

Constructor Detail

OCSPClient

protected OCSPClient()

OCSPClient

public OCSPClient(java.lang.String aConnectionAddress)
           throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Parameters:

aConnectionAddress - Adress to the OCSP server ECertificate object getOCSPAdresses() function gives addresses.

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

Method Detail

setCheckSignature

public void setCheckSignature(boolean aCheckSignature)

Defines whether ocsp response signature will be checked Default: true

Parameters:

aCheckSignature -

setCheckNonce

public void setCheckNonce(boolean aCheckNonce)

Defines whether ocsp response nonce will be checked Default: true

Parameters:

aCheckNonce -

setCheckResponseStatus

public void setCheckResponseStatus(boolean aCheckResponseStatus)

Defines whether ocsp response status will be checked

Parameters:

aCheckResponseStatus -

setCheckDate

public void setCheckDate(boolean aCheckDate)

Checks thisUpdate and nextUpdate interval in OCSP response covers now Default: false

Parameters:

aCheckDate -

openConnection

public void openConnection()
                    throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Opens connection with default timeout

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

closeConnection

public void closeConnection()
                     throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Closes connection

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

openConnection

public void openConnection(java.lang.String aTimeOut)
                    throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Open connection with defined timeout

Parameters:

aTimeOut - timeout in miliseconds. If it is null, default value is used. A timeout of zero is intreped as an infinite timeout. If

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

getProducedAt

public java.util.Calendar getProducedAt()

Creation time of ocsp response

Returns:

queryCertificate

public void queryCertificate(tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aCertificateToQuery,
                             tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aIssuerCertificate)
                      throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Make single query.

Parameters:

aCertificateToQuery - Certificate

aIssuerCertificate - Certificate

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

queryCertificate

public tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse queryCertificate(tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate[] aCertificatesToQuery,
                                                                             tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate[] aIssuerCertificates)
                                                                      throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Make multiple query at once.

Parameters:

aCertificatesToQuery - Certificate[]

aIssuerCertificates - Certificate[]

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

queryCertificate

public tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse queryCertificate(java.math.BigInteger aSertifikaSeriNo,
                                                                             byte[] aSMSubjectHashDegeri,
                                                                             byte[] aSMAcikAnahtarHashDegeri)
                                                                      throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

getStatus

public int getStatus()

getResponseStatus

public int getResponseStatus()

ResponseStatus. 0:successful

Returns:

response status

getSingleResponse

public tr.gov.tubitak.uekae.esya.api.asn.ocsp.ESingleResponse getSingleResponse(tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aCertificateToQuery,
                                                                                tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aIssuerCertificate)
                                                                         throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

isEqual

public static boolean isEqual(tr.gov.tubitak.uekae.esya.api.asn.ocsp.ECertID certID,
                              tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aCertificateToQuery,
                              tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate aIssuerCertificate)

Checks whether certID is generated for the aCertificateToQuery and the aIssuerCertificate.

Parameters:

certID -

aCertificateToQuery -

aIssuerCertificate -

Returns:

getBasicResponse

public tr.gov.tubitak.uekae.esya.api.asn.ocsp.EBasicOCSPResponse getBasicResponse()

getOCSPResponse

public tr.gov.tubitak.uekae.esya.api.asn.ocsp.EOCSPResponse getOCSPResponse()

checkResponseStatus

public boolean checkResponseStatus()

Check Response status.

Returns:

checkResponse

public void checkResponse()
                   throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

checkDate

public boolean checkDate(tr.gov.tubitak.uekae.esya.api.asn.ocsp.ESingleResponse aResponse,
                         java.util.Calendar aDate)

Checks thisUpdate and nextUpdate in OCSP response agains given date.

Parameters:

aResponse - to be checked

aDate - to check

Returns:

getNonce

public byte[] getNonce()

Returns the nonce value in the request

Returns:

nonce

checkNonce

public boolean checkNonce()

Check nonce value of response.

Returns:

nonce check result

checkSignature

public boolean checkSignature()

Check signature value for response. Note that signing certificate is not checked. To check certificate get it by getSigningCertificate and use certificate validation API

Returns:

boolean

getSigningCertificate

public tr.gov.tubitak.uekae.esya.api.asn.x509.ECertificate getSigningCertificate()
                                                                          throws tr.gov.tubitak.uekae.esya.api.common.ESYAException

Get the certificate that signs OCSP response, which should be validated.

Returns:

Certificate

Throws:

tr.gov.tubitak.uekae.esya.api.common.ESYAException

setDigestAlgForOcspRequest

public void setDigestAlgForOcspRequest(tr.gov.tubitak.uekae.esya.api.crypto.alg.DigestAlg digestAlg)