Modifier and Type	Class and Description
private static class	OcspHelper.SHA1DigestCalculator Class to create SHA-1 Digest, used for creation of CertificateID.

Modifier and Type	Field and Description
private final Set<X509Certificate>	additionalCerts
private final JcaX509CertificateConverter	certificateConverter
private final X509Certificate	certificateToCheck
private DEROctetString	encodedNonce
private final X509Certificate	issuerCertificate
private static final Log	LOG
private X509Certificate	ocspResponderCertificate
private final String	ocspUrl
private static final Random	RANDOM
private final Date	signDate

Access	Constructor and Description
public	OcspHelper(X509Certificate Certificate to be OCSP-checked checkCertificate, Date the date when the signing took place signDate, X509Certificate Certificate of the issuer issuerCertificate, Set<X509Certificate> Set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain. All self-signed certificates are considered to be trusted root CA certificates. All the rest are considered to be intermediate CA certificates. additionalCerts, String where to fetch for OCSP ocspUrl)

Method Summary

Modifier and Type	Method and Description
private boolean	Returns: true if the nonce is present and matches, false if nonce is missing. checkNonce(BasicOCSPResp Response to be checked basicResponse) Checks if the nonce in the response matches.
private void	checkOcspResponseFresh(SingleResp resp)
private void	checkOcspSignature(X509Certificate the certificate to check the signature certificate, BasicOCSPResp OCSP response containing the signature basicResponse) Checks whether the OCSP response is signed by the given certificate.
private byte[]	create16BytesNonce()
private void	findResponderCertificateByKeyHash(BasicOCSPResp basicResponse, byte[] keyHash)
private void	findResponderCertificateByName(BasicOCSPResp basicResponse, X500Name name)
private OCSPReq	Returns: OCSP request, ready to fetch data generateOCSPRequest() Generates an OCSP request and generates the `CertificateID`.
pack-priv X509Certificate	Returns: The certificate to be OCSP-checked. getCertificateToCheck() Get the certificate to be OCSP-checked.
private byte[]	getKeyHashFromCertHolder(X509CertificateHolder certHolder)
public X509Certificate	Returns: The certificate of the responder. getOcspResponderCertificate() Get responder certificate.
public OCSPResp	Returns: the OCSPResp, when the request was successful, else a corresponding exception will be thrown. Never returns null. getResponseOcsp() Performs and verifies the OCSP-Request
private OCSPResp	Returns: the OCSPResp, that has been fetched from the ocspUrl performRequest(String URL of OCSP service. urlString) Performs the OCSP-Request, with given data.
private void	verifyOcspResponse(OCSPResp to be verified ocspResponse) Verifies the status and the response itself (including nonce), but not the signature.
public void	verifyRespStatus(OCSPResp OCSP response resp) Helper method to verify response status.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

additionalCerts	back to summary
private final Set<X509Certificate> additionalCerts

certificateConverter	back to summary
private final JcaX509CertificateConverter certificateConverter

certificateToCheck	back to summary
private final X509Certificate certificateToCheck

encodedNonce	back to summary
private DEROctetString encodedNonce

issuerCertificate	back to summary
private final X509Certificate issuerCertificate

LOG	back to summary
private static final Log LOG

ocspResponderCertificate	back to summary
private X509Certificate ocspResponderCertificate

ocspUrl	back to summary
private final String ocspUrl

RANDOM	back to summary
private static final Random RANDOM

signDate	back to summary
private final Date signDate

Constructor Detail

OcspHelper	back to summary
public OcspHelper(X509Certificate checkCertificate, Date signDate, X509Certificate issuerCertificate, Set<X509Certificate> additionalCerts, String ocspUrl) Parameters checkCertificate:X509Certificate Certificate to be OCSP-checked signDate:Date the date when the signing took place issuerCertificate:X509Certificate Certificate of the issuer additionalCerts:Set<X509Certificate> Set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain. All self-signed certificates are considered to be trusted root CA certificates. All the rest are considered to be intermediate CA certificates. ocspUrl:String where to fetch for OCSP

OcspHelper

back to summary

public OcspHelper(X509Certificate checkCertificate, Date signDate, X509Certificate issuerCertificate, Set<X509Certificate> additionalCerts, String ocspUrl)

Parameters

checkCertificate:X509Certificate: Certificate to be OCSP-checked
signDate:Date: the date when the signing took place
issuerCertificate:X509Certificate: Certificate of the issuer
additionalCerts:Set<X509Certificate>: Set of trusted root CA certificates that will be used as "trust anchors" and intermediate CA certificates that will be used as part of the certification chain. All self-signed certificates are considered to be trusted root CA certificates. All the rest are considered to be intermediate CA certificates.
ocspUrl:String: where to fetch for OCSP

Method Detail

checkNonce	back to summary
private boolean checkNonce(BasicOCSPResp basicResponse) throws OCSPException Checks if the nonce in the response matches. Parameters basicResponse:BasicOCSPResp Response to be checked Returns:boolean true if the nonce is present and matches, false if nonce is missing. Exceptions OCSPException: if the nonce is different

checkNonce

back to summary

private boolean checkNonce(BasicOCSPResp basicResponse) throws OCSPException

Checks if the nonce in the response matches.

Parameters

basicResponse:BasicOCSPResp: Response to be checked

Returns:boolean

true if the nonce is present and matches, false if nonce is missing.

Exceptions

OCSPException:: if the nonce is different

checkOcspResponseFresh	back to summary
private void checkOcspResponseFresh(SingleResp resp) throws OCSPException

checkOcspSignature	back to summary
private void checkOcspSignature(X509Certificate certificate, BasicOCSPResp basicResponse) throws OCSPException, IOException Checks whether the OCSP response is signed by the given certificate. Parameters certificate:X509Certificate the certificate to check the signature basicResponse:BasicOCSPResp OCSP response containing the signature Exceptions OCSPException: when the signature is invalid or could not be checked IOException: if the default security provider can't be instantiated

checkOcspSignature

back to summary

private void checkOcspSignature(X509Certificate certificate, BasicOCSPResp basicResponse) throws OCSPException, IOException

Checks whether the OCSP response is signed by the given certificate.

Parameters

certificate:X509Certificate: the certificate to check the signature
basicResponse:BasicOCSPResp: OCSP response containing the signature

Exceptions

OCSPException:: when the signature is invalid or could not be checked
IOException:: if the default security provider can't be instantiated

create16BytesNonce	back to summary
private byte[] create16BytesNonce()

findResponderCertificateByKeyHash	back to summary
private void findResponderCertificateByKeyHash(BasicOCSPResp basicResponse, byte[] keyHash) throws IOException

findResponderCertificateByName	back to summary
private void findResponderCertificateByName(BasicOCSPResp basicResponse, X500Name name)

generateOCSPRequest back to summary

generateOCSPRequest	back to summary
private OCSPReq generateOCSPRequest() throws OCSPException, IOException Generates an OCSP request and generates the `CertificateID`. Returns:OCSPReq OCSP request, ready to fetch data

private OCSPReq generateOCSPRequest() throws OCSPException, IOException

Generates an OCSP request and generates the CertificateID.

Returns:OCSPReq: OCSP request, ready to fetch data

getCertificateToCheck	back to summary
pack-priv X509Certificate getCertificateToCheck() Get the certificate to be OCSP-checked. Returns:X509Certificate The certificate to be OCSP-checked.

getCertificateToCheck

back to summary

pack-priv X509Certificate getCertificateToCheck()

Get the certificate to be OCSP-checked.

Returns:X509Certificate: The certificate to be OCSP-checked.

getKeyHashFromCertHolder	back to summary
private byte[] getKeyHashFromCertHolder(X509CertificateHolder certHolder)

getOcspResponderCertificate back to summary

getOcspResponderCertificate	back to summary
public X509Certificate getOcspResponderCertificate() Get responder certificate. This is available after `getResponseOcsp()` has been called. This method should be used instead of `basicResponse.getCerts()[0]` Returns:X509Certificate The certificate of the responder.

public X509Certificate getOcspResponderCertificate()

Get responder certificate. This is available after getResponseOcsp() has been called. This method should be used instead of basicResponse.getCerts()[0]

Returns:X509Certificate: The certificate of the responder.

getResponseOcsp	back to summary
public OCSPResp getResponseOcsp() throws IOException, OCSPException, RevokedCertificateException, URISyntaxException Performs and verifies the OCSP-Request Returns:OCSPResp the OCSPResp, when the request was successful, else a corresponding exception will be thrown. Never returns null.

getResponseOcsp

back to summary

public OCSPResp getResponseOcsp() throws IOException, OCSPException, RevokedCertificateException, URISyntaxException

Performs and verifies the OCSP-Request

Returns:OCSPResp: the OCSPResp, when the request was successful, else a corresponding exception will be thrown. Never returns null.

performRequest	back to summary
private OCSPResp performRequest(String urlString) throws IOException, OCSPException, URISyntaxException Performs the OCSP-Request, with given data. Parameters urlString:String URL of OCSP service. Returns:OCSPResp the OCSPResp, that has been fetched from the ocspUrl

performRequest

back to summary

private OCSPResp performRequest(String urlString) throws IOException, OCSPException, URISyntaxException

Performs the OCSP-Request, with given data.

Parameters

urlString:String: URL of OCSP service.

Returns:OCSPResp

the OCSPResp, that has been fetched from the ocspUrl

verifyOcspResponse	back to summary
private void verifyOcspResponse(OCSPResp ocspResponse) throws OCSPException, RevokedCertificateException, IOException Verifies the status and the response itself (including nonce), but not the signature. Parameters ocspResponse:OCSPResp to be verified Exceptions IOException: if the default security provider can't be instantiated

verifyOcspResponse

back to summary

private void verifyOcspResponse(OCSPResp ocspResponse) throws OCSPException, RevokedCertificateException, IOException

Verifies the status and the response itself (including nonce), but not the signature.

Parameters

ocspResponse:OCSPResp: to be verified

Exceptions

IOException:: if the default security provider can't be instantiated

verifyRespStatus	back to summary
public void verifyRespStatus(OCSPResp resp) throws OCSPException Helper method to verify response status. Parameters resp:OCSPResp OCSP response Exceptions OCSPException: if the response status is not ok

verifyRespStatus

back to summary

public void verifyRespStatus(OCSPResp resp) throws OCSPException

Helper method to verify response status.

Parameters

resp:OCSPResp: OCSP response

Exceptions

OCSPException:: if the response status is not ok

org.apache.pdfbox.examples.signature.cert back to summary

private Class OcspHelper.SHA1DigestCalculator

Class Inheritance

extends Object
implements DigestCalculator

java.lang.Object
org.apache.pdfbox.examples.signature.cert.OcspHelper.SHA1DigestCalculator

All Implemented Interfaces

org.bouncycastle.operator.DigestCalculator

Class to create SHA-1 Digest, used for creation of CertificateID.

Field Summary

Modifier and Type	Field and Description
private final ByteArrayOutputStream	bOut

Constructor Summary

Access	Constructor and Description
private	SHA1DigestCalculator()

Method Summary

Modifier and Type	Method and Description
public AlgorithmIdentifier	getAlgorithmIdentifier() Implements org.bouncycastle.operator.DigestCalculator.getAlgorithmIdentifier. Return the algorithm identifier representing the digest implemented by this calculator.
public byte[]	getDigest() Implements org.bouncycastle.operator.DigestCalculator.getDigest. Return the digest calculated on what has been written to the calculator's output stream.
public OutputStream	getOutputStream() Implements org.bouncycastle.operator.DigestCalculator.getOutputStream. Returns a stream that will accept data for the purpose of calculating a digest.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

bOut	back to summary
private final ByteArrayOutputStream bOut

Constructor Detail

SHA1DigestCalculator	back to summary
private SHA1DigestCalculator()

Method Detail

getAlgorithmIdentifier	back to summary
public AlgorithmIdentifier getAlgorithmIdentifier() Implements org.bouncycastle.operator.DigestCalculator.getAlgorithmIdentifier. Doc from org.bouncycastle.operator.DigestCalculator.getAlgorithmIdentifier. Return the algorithm identifier representing the digest implemented by this calculator. Returns:AlgorithmIdentifier algorithm id and parameters. Annotations @Override

getAlgorithmIdentifier

back to summary

public AlgorithmIdentifier getAlgorithmIdentifier()

Implements org.bouncycastle.operator.DigestCalculator.getAlgorithmIdentifier.

Doc from org.bouncycastle.operator.DigestCalculator.getAlgorithmIdentifier.

Return the algorithm identifier representing the digest implemented by this calculator.

Returns:AlgorithmIdentifier

algorithm id and parameters.

Annotations

@Override

getDigest	back to summary
public byte[] getDigest() Implements org.bouncycastle.operator.DigestCalculator.getDigest. Doc from org.bouncycastle.operator.DigestCalculator.getDigest. Return the digest calculated on what has been written to the calculator's output stream. Returns:byte[] a digest. Annotations @Override

getDigest

back to summary

public byte[] getDigest()

Implements org.bouncycastle.operator.DigestCalculator.getDigest.

Doc from org.bouncycastle.operator.DigestCalculator.getDigest.

Return the digest calculated on what has been written to the calculator's output stream.

Returns:byte[]

a digest.

Annotations

@Override

getOutputStream	back to summary
public OutputStream getOutputStream() Implements org.bouncycastle.operator.DigestCalculator.getOutputStream. Doc from org.bouncycastle.operator.DigestCalculator.getOutputStream. Returns a stream that will accept data for the purpose of calculating a digest. Use org.bouncycastle.util.io.TeeOutputStream if you want to accumulate the data on the fly as well. Returns:OutputStream an OutputStream Annotations @Override

getOutputStream

back to summary

public OutputStream getOutputStream()

Implements org.bouncycastle.operator.DigestCalculator.getOutputStream.

Doc from org.bouncycastle.operator.DigestCalculator.getOutputStream.

Returns a stream that will accept data for the purpose of calculating a digest. Use org.bouncycastle.util.io.TeeOutputStream if you want to accumulate the data on the fly as well.

Returns:OutputStream

an OutputStream

Annotations

@Override

public Class OcspHelper

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class OcspHelper.SHA1DigestCalculator

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail