org.apache.synapse.transport.certificatevalidation.ocsp

Class OCSPVerifier

java.lang.Object

org.apache.synapse.transport.certificatevalidation.ocsp.OCSPVerifier

All Implemented Interfaces:

RevocationVerifier

public class OCSPVerifier
extends java.lang.Object
implements RevocationVerifier

Used to check if a Certificate is revoked or not by its CA using Online Certificate Status Protocol (OCSP).

Constructor Summary

Constructors

Constructor and Description
OCSPVerifier(OCSPCache cache)

Method Summary

Modifier and Type	Method and Description
RevocationStatus	checkRevocationStatus(java.security.cert.X509Certificate peerCert, java.security.cert.X509Certificate issuerCert) Gets the revocation status (Good, Revoked or Unknown) of the given peer certificate.
protected org.bouncycastle.cert.ocsp.OCSPResp	getOCSPResponce(java.lang.String serviceUrl, org.bouncycastle.cert.ocsp.OCSPReq request) Gets an ASN.1 encoded OCSP response (as defined in RFC 2560) from the given service URL.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OCSPVerifier

public OCSPVerifier(OCSPCache cache)

Method Detail

checkRevocationStatus

public RevocationStatus checkRevocationStatus(java.security.cert.X509Certificate peerCert,
                                              java.security.cert.X509Certificate issuerCert)
                                       throws CertificateVerificationException

Gets the revocation status (Good, Revoked or Unknown) of the given peer certificate.

Specified by:

checkRevocationStatus in interface RevocationVerifier

Parameters:

peerCert - The certificate we want to check if revoked.

issuerCert - Needed to create OCSP request.

Returns:

revocation status of the peer certificate.

Throws:

CertificateVerificationException

getOCSPResponce

protected org.bouncycastle.cert.ocsp.OCSPResp getOCSPResponce(java.lang.String serviceUrl,
                                                              org.bouncycastle.cert.ocsp.OCSPReq request)
                                                       throws CertificateVerificationException

Gets an ASN.1 encoded OCSP response (as defined in RFC 2560) from the given service URL. Currently supports only HTTP.

Parameters:

serviceUrl - URL of the OCSP endpoint.

request - an OCSP request object.

Returns:

OCSP response encoded in ASN.1 structure.

Throws:

CertificateVerificationException