private void validateRevocationStatusMain ( SFPair < Certificate , Certificate > pairIssuerSubject , String ocspRespB64 ) throws CertificateException { try { OCSPResp ocspResp = b64ToOCSPResp ( ocspRespB64 ) ; Date currentTime = new Date ( ) ; BasicOCSPResp basicOcspResp = ( BasicOCSPResp ) ( ocspResp . getResponseObject ( ) ) ; X509CertificateHolder [ ] attachedCerts = basicOcspResp . getCerts ( ) ; X509CertificateHolder signVerifyCert ; if ( attachedCerts . length > 0 ) { LOGGER . debug ( "Certificate is attached for verification. " + "Verifying it by the issuer certificate." ) ; signVerifyCert = attachedCerts [ 0 ] ; if ( currentTime . after ( signVerifyCert . getNotAfter ( ) ) || currentTime . before ( signVerifyCert . getNotBefore ( ) ) ) { throw new OCSPException ( String . format ( "Cert attached to OCSP Response is invalid." + "Current time - %s" + "Certificate not before time - %s" + "Certificate not after time - %s" , currentTime . toString ( ) , signVerifyCert . getNotBefore ( ) . toString ( ) , signVerifyCert . getNotAfter ( ) . toString ( ) ) ) ; } verifySignature ( new X509CertificateHolder ( pairIssuerSubject . left . getEncoded ( ) ) , signVerifyCert . getSignature ( ) , CONVERTER_X509 . getCertificate ( signVerifyCert ) . getTBSCertificate ( ) , signVerifyCert . getSignatureAlgorithm ( ) ) ; LOGGER . debug ( "Verifying OCSP signature by the attached certificate public key." ) ; } else { LOGGER . debug ( "Certificate is NOT attached for verification. " + "Verifying OCSP signature by the issuer public key." ) ; signVerifyCert = new X509CertificateHolder ( pairIssuerSubject . left . getEncoded ( ) ) ; } verifySignature ( signVerifyCert , basicOcspResp . getSignature ( ) , basicOcspResp . getTBSResponseData ( ) , basicOcspResp . getSignatureAlgorithmID ( ) ) ; validateBasicOcspResponse ( currentTime , basicOcspResp ) ; } catch ( IOException | OCSPException ex ) { throw new CertificateEncodingException ( "Failed to check revocation status." , ex ) ; } }
Validates the certificate revocation status