private static boolean issues ( X509CertImpl cert , X509CRLImpl crl , String provider ) throws IOException { boolean matched = false ; AdaptableX509CertSelector issuerSelector = new AdaptableX509CertSelector ( ) ; // check certificate's key usage boolean [ ] usages = cert . getKeyUsage ( ) ; if ( usages != null ) { usages [ 6 ] = true ; // cRLSign issuerSelector . setKeyUsage ( usages ) ; } // check certificate's subject X500Principal crlIssuer = crl . getIssuerX500Principal ( ) ; issuerSelector . setSubject ( crlIssuer ) ; /* * Facilitate certification path construction with authority * key identifier and subject key identifier. * * In practice, conforming CAs MUST use the key identifier method, * and MUST include authority key identifier extension in all CRLs * issued. [section 5.2.1, RFC 2459] */ AuthorityKeyIdentifierExtension crlAKID = crl . getAuthKeyIdExtension ( ) ; if ( crlAKID != null ) { issuerSelector . parseAuthorityKeyIdentifierExtension ( crlAKID ) ; } matched = issuerSelector . match ( cert ) ; // if AKID is unreliable, verify the CRL signature with the cert if ( matched && ( crlAKID == null || cert . getAuthorityKeyIdentifierExtension ( ) == null ) ) { try { crl . verify ( cert . getPublicKey ( ) , provider ) ; matched = true ; } catch ( GeneralSecurityException e ) { matched = false ; } } return matched ; }
Verifies whether a CRL is issued by a certain certificate