public static OCSPResp getOCSPResponse ( List < String > locations , OCSPReq request , X509Certificate userCertificate , OCSPCache ocspCache ) throws CertificateVerificationException { SingleResp [ ] responses ; BasicOCSPResp basicResponse ; CertificateStatus certificateStatus ; for ( String serviceUrl : locations ) { OCSPResp response ; try { response = OCSPVerifier . getOCSPResponce ( serviceUrl , request ) ; if ( OCSPResponseStatus . SUCCESSFUL != response . getStatus ( ) ) { continue ; // Server didn't give the correct response. } basicResponse = ( BasicOCSPResp ) response . getResponseObject ( ) ; responses = ( basicResponse == null ) ? null : basicResponse . getResponses ( ) ; } catch ( OCSPException | CertificateVerificationException e ) { LOG . debug ( "OCSP response failed for url{}. Hence trying the next url" , serviceUrl ) ; continue ; } if ( responses != null && responses . length == 1 ) { SingleResp singleResponse = responses [ 0 ] ; certificateStatus = singleResponse . getCertStatus ( ) ; if ( certificateStatus != null ) { throw new IllegalStateException ( "certificate-status=" + certificateStatus ) ; } //User certificates serial number and response coming from CA needs to be same. if ( ! userCertificate . getSerialNumber ( ) . equals ( singleResponse . getCertID ( ) . getSerialNumber ( ) ) ) { throw new IllegalStateException ( "Bad Serials=" + userCertificate . getSerialNumber ( ) + " vs. " + singleResponse . getCertID ( ) . getSerialNumber ( ) ) ; } //If the response state is successful we cache the response. ocspCache . setCacheValue ( response , userCertificate . getSerialNumber ( ) , singleResponse , request , serviceUrl ) ; return response ; } } throw new CertificateVerificationException ( "Could not get revocation status from OCSP." ) ; }
Get OCSP response from cache .