Package io.netty.handler.ssl.ocsp

Class OcspClient

java.lang.Object

io.netty.handler.ssl.ocsp.OcspClient

final class OcspClient
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
(package private) static final class	OcspClient.Initializer

Field Summary

Fields

Modifier and Type	Field	Description
private static final InternalLogger	logger
private static final int	OCSP_RESPONSE_MAX_SIZE
private static final SecureRandom	SECURE_RANDOM

Constructor Summary

Constructors

Modifier	Constructor	Description
private	OcspClient()

Method Summary

Modifier and Type	Method	Description
private static String	parseOcspUrlFromCertificate(X509Certificate cert)	Parse OCSP endpoint URL from Certificate
private static Promise<org.bouncycastle.cert.ocsp.OCSPResp>	query(EventLoop eventLoop, ByteBuf ocspRequest, String host, int port, String path, IoTransport ioTransport, DnsNameResolver dnsNameResolver)	Query the OCSP responder for certificate status using HTTP/1.1
(package private) static void	query(X509Certificate x509Certificate, X509Certificate issuer, boolean validateResponseNonce, IoTransport ioTransport, DnsNameResolver dnsNameResolver, Promise<org.bouncycastle.cert.ocsp.BasicOCSPResp> responsePromise)	Query the certificate status using OCSP
private static void	validateCertificateChain(org.bouncycastle.cert.X509CertificateHolder responderCert, org.bouncycastle.cert.X509CertificateHolder[] allCerts, X509Certificate issuerCertificate)	Validates that a certificate chain can be built from the responder certificate to the issuer.
private static void	validateNonce(org.bouncycastle.cert.ocsp.BasicOCSPResp basicResponse, org.bouncycastle.asn1.DEROctetString encodedNonce)	Validate OCSP response nonce
private static void	validateResponse(X509Certificate x509Certificate, org.bouncycastle.operator.DigestCalculatorProvider digestCalculatorProvider, Promise<org.bouncycastle.cert.ocsp.BasicOCSPResp> responsePromise, org.bouncycastle.cert.ocsp.BasicOCSPResp basicResponse, org.bouncycastle.asn1.DEROctetString derNonce, X509Certificate issuer, boolean validateNonce)
(package private) static void	validateSignature(org.bouncycastle.cert.ocsp.BasicOCSPResp resp, X509Certificate issuerCertificate)	Validate OCSP response signature

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

logger

private static final InternalLogger logger

SECURE_RANDOM

private static final SecureRandom SECURE_RANDOM

OCSP_RESPONSE_MAX_SIZE

private static final int OCSP_RESPONSE_MAX_SIZE

Constructor Details

OcspClient

private OcspClient()

Method Details

query

static void query(X509Certificate x509Certificate,
 X509Certificate issuer,
 boolean validateResponseNonce,
 IoTransport ioTransport,
 DnsNameResolver dnsNameResolver,
 Promise<org.bouncycastle.cert.ocsp.BasicOCSPResp> responsePromise)

Query the certificate status using OCSP

Parameters:

x509Certificate - Client X509Certificate to validate

issuer - X509Certificate issuer of client certificate

validateResponseNonce - Set to true to enable OCSP response validation

ioTransport - IoTransport to use

responsePromise - Promise of BasicOCSPResp

query

private static Promise<org.bouncycastle.cert.ocsp.OCSPResp> query(EventLoop eventLoop,
 ByteBuf ocspRequest,
 String host,
 int port,
 String path,
 IoTransport ioTransport,
 DnsNameResolver dnsNameResolver)

Query the OCSP responder for certificate status using HTTP/1.1

Parameters:

eventLoop - EventLoop for HTTP request execution

ocspRequest - ByteBuf containing OCSP request data

host - OCSP responder hostname

port - OCSP responder port

path - OCSP responder path

ioTransport - IoTransport to use

Returns:

Returns Promise containing OCSPResp

validateResponse

private static void validateResponse(X509Certificate x509Certificate,
 org.bouncycastle.operator.DigestCalculatorProvider digestCalculatorProvider,
 Promise<org.bouncycastle.cert.ocsp.BasicOCSPResp> responsePromise,
 org.bouncycastle.cert.ocsp.BasicOCSPResp basicResponse,
 org.bouncycastle.asn1.DEROctetString derNonce,
 X509Certificate issuer,
 boolean validateNonce)

validateNonce

private static void validateNonce(org.bouncycastle.cert.ocsp.BasicOCSPResp basicResponse,
 org.bouncycastle.asn1.DEROctetString encodedNonce)
                           throws org.bouncycastle.cert.ocsp.OCSPException

Validate OCSP response nonce

Throws:

org.bouncycastle.cert.ocsp.OCSPException

validateSignature

static void validateSignature(org.bouncycastle.cert.ocsp.BasicOCSPResp resp,
 X509Certificate issuerCertificate)
                       throws org.bouncycastle.cert.ocsp.OCSPException

Validate OCSP response signature

Throws:

org.bouncycastle.cert.ocsp.OCSPException

validateCertificateChain

private static void validateCertificateChain(org.bouncycastle.cert.X509CertificateHolder responderCert,
 org.bouncycastle.cert.X509CertificateHolder[] allCerts,
 X509Certificate issuerCertificate)
                                      throws org.bouncycastle.cert.ocsp.OCSPException

Validates that a certificate chain can be built from the responder certificate to the issuer. Uses Java's CertPathBuilder to construct and validate the chain.

Throws:

org.bouncycastle.cert.ocsp.OCSPException

parseOcspUrlFromCertificate

private static String parseOcspUrlFromCertificate(X509Certificate cert)

Parse OCSP endpoint URL from Certificate

Parameters:

cert - Certificate to be parsed

Returns:

OCSP endpoint URL

Throws:

NullPointerException - If we couldn't locate OCSP responder URL

IllegalArgumentException - If we couldn't parse X509Certificate into JcaX509CertificateHolder