@ Nonnull public static ClientCertificateValidationResult verifyClientCertificate ( @ Nonnull final HttpServletRequest aHttpRequest , @ Nonnull final String sLogPrefix ) { if ( s_bIsCheckDisabled . get ( ) ) { if ( LOGGER . isDebugEnabled ( ) ) LOGGER . debug ( sLogPrefix + "Client certificate is considered valid because the 'allow all' for tests is set!" ) ; return ClientCertificateValidationResult . createSuccess ( INSECURE_DEBUG_CLIENT ) ; } // This is how to get client certificate from request final Object aValue = aHttpRequest . getAttribute ( "javax.servlet.request.X509Certificate" ) ; if ( aValue == null ) { if ( LOGGER . isWarnEnabled ( ) ) LOGGER . warn ( sLogPrefix + "No client certificates present in the request" ) ; return ClientCertificateValidationResult . createFailure ( ) ; } // type check if ( ! ( aValue instanceof X509Certificate [ ] ) ) throw new IllegalStateException ( "Request value is not of type X509Certificate[] but of " + aValue . getClass ( ) ) ; // Main checking final X509Certificate [ ] aRequestCerts = ( X509Certificate [ ] ) aValue ; if ( ArrayHelper . isEmpty ( aRequestCerts ) ) { // Empty array if ( LOGGER . isWarnEnabled ( ) ) LOGGER . warn ( sLogPrefix + "No client certificates passed for validation" ) ; return ClientCertificateValidationResult . createFailure ( ) ; } // OK, we have a non-empty, type checked Certificate array // TODO: determine CRLs final ICommonsList < CRL > aCRLs = new CommonsArrayList <> ( ) ; // Verify for "now" final LocalDateTime aVerificationDate = PDTFactory . getCurrentLocalDateTime ( ) ; // Search the certificate from the request matching our required issuers X509Certificate aClientCertToVerify = null ; { for ( final X509Certificate aCert : aRequestCerts ) { final X500Principal aIssuer = aCert . getIssuerX500Principal ( ) ; if ( s_aSearchIssuers . contains ( aIssuer ) ) { if ( LOGGER . isInfoEnabled ( ) ) LOGGER . info ( sLogPrefix + " Using the following client certificate issuer for verification: '" + aIssuer + "'" ) ; aClientCertToVerify = aCert ; break ; } } // Do we have a certificate to verify? if ( aClientCertToVerify == null ) { throw new IllegalStateException ( "Found no client certificate that was issued by one of the " + s_aSearchIssuers . size ( ) + " required issuers. Provided certs are: " + Arrays . toString ( aRequestCerts ) ) ; } } final String sClientID = getClientUniqueID ( aClientCertToVerify ) ; // This is the main verification process against the PEPPOL SMP root // certificate for ( final X509Certificate aRootCert : s_aPeppolSMPRootCerts ) { final String sVerifyErrorMsg = _verifyCertificate ( aClientCertToVerify , aRootCert , aCRLs , aVerificationDate ) ; if ( sVerifyErrorMsg == null ) { if ( LOGGER . isInfoEnabled ( ) ) LOGGER . info ( sLogPrefix + " Passed client certificate is valid" ) ; return ClientCertificateValidationResult . createSuccess ( sClientID ) ; } } if ( LOGGER . isWarnEnabled ( ) ) LOGGER . warn ( "Client certificate is invalid: " + sClientID ) ; return ClientCertificateValidationResult . createFailure ( ) ; }
Extract certificates from request and validate them .