private static Collection < X509CRL > getCRLs ( X509CRLSelector selector , X509CertImpl certImpl , DistributionPoint point , boolean [ ] reasonsMask , boolean signFlag , PublicKey prevKey , X509Certificate prevCert , String provider , List < CertStore > certStores , Set < TrustAnchor > trustAnchors , Date validity ) throws CertStoreException { // check for full name GeneralNames fullName = point . getFullName ( ) ; if ( fullName == null ) { // check for relative name RDN relativeName = point . getRelativeName ( ) ; if ( relativeName == null ) { return Collections . emptySet ( ) ; } try { GeneralNames crlIssuers = point . getCRLIssuer ( ) ; if ( crlIssuers == null ) { fullName = getFullNames ( ( X500Name ) certImpl . getIssuerDN ( ) , relativeName ) ; } else { // should only be one CRL Issuer if ( crlIssuers . size ( ) != 1 ) { return Collections . emptySet ( ) ; } else { fullName = getFullNames ( ( X500Name ) crlIssuers . get ( 0 ) . getName ( ) , relativeName ) ; } } } catch ( IOException ioe ) { return Collections . emptySet ( ) ; } } Collection < X509CRL > possibleCRLs = new ArrayList <> ( ) ; CertStoreException savedCSE = null ; for ( Iterator < GeneralName > t = fullName . iterator ( ) ; t . hasNext ( ) ; ) { try { GeneralName name = t . next ( ) ; if ( name . getType ( ) == GeneralNameInterface . NAME_DIRECTORY ) { X500Name x500Name = ( X500Name ) name . getName ( ) ; possibleCRLs . addAll ( getCRLs ( x500Name , certImpl . getIssuerX500Principal ( ) , certStores ) ) ; } else if ( name . getType ( ) == GeneralNameInterface . NAME_URI ) { URIName uriName = ( URIName ) name . getName ( ) ; X509CRL crl = getCRL ( uriName ) ; if ( crl != null ) { possibleCRLs . add ( crl ) ; } } } catch ( CertStoreException cse ) { savedCSE = cse ; } } // only throw CertStoreException if no CRLs are retrieved if ( possibleCRLs . isEmpty ( ) && savedCSE != null ) { throw savedCSE ; } Collection < X509CRL > crls = new ArrayList <> ( 2 ) ; for ( X509CRL crl : possibleCRLs ) { try { // make sure issuer is not set // we check the issuer in verifyCRLs method selector . setIssuerNames ( null ) ; if ( selector . match ( crl ) && verifyCRL ( certImpl , point , crl , reasonsMask , signFlag , prevKey , prevCert , provider , trustAnchors , certStores , validity ) ) { crls . add ( crl ) ; } } catch ( IOException | CRLException e ) { // don't add the CRL if ( debug != null ) { debug . println ( "Exception verifying CRL: " + e . getMessage ( ) ) ; e . printStackTrace ( ) ; } } } return crls ; }
Download CRLs from the given distribution point verify and return them . See the top of the class for current limitations .