Alex Rivera | Logout

OCSP Revocation on client certificate

Asked 2011-03-01T23:05:28.573
18

How do I manually check for certificate revocation status in java using OCSP, given just a client's java.security.cert.X509Certificate? I can't see a clear way to do it.

Alternatively, can I make tomcat do it for me automatically, and how do you know your solution to be true?

java security tomcat x509certificate ocsp
Edit
Report

1 Answer

19

I found a most excellent solution:

http://www.docjar.com/html/api/sun/security/provider/certpath/OCSP.java.html

        /**
   54    * This is a class that checks the revocation status of a certificate(s) using
   55    * OCSP. It is not a PKIXCertPathChecker and therefore can be used outside of
   56    * the CertPathValidator framework. It is useful when you want to
   57    * just check the revocation status of a certificate, and you don't want to
   58    * incur the overhead of validating all of the certificates in the
   59    * associated certificate chain.
   60    *
   61    * @author Sean Mullan
   62    */

It has a method check(X509Certificate clientCert, X509Certificate issuerCert) that does the trick!

answered 2011-03-09T16:53:26.763

Your Answer