void validateRevocationStatus ( X509Certificate [ ] chain , String peerHost ) throws CertificateException { final List < Certificate > bcChain = convertToBouncyCastleCertificate ( chain ) ; final List < SFPair < Certificate , Certificate > > pairIssuerSubjectList = getPairIssuerSubject ( bcChain ) ; if ( peerHost . startsWith ( "ocspssd" ) ) { return ; } if ( ocspCacheServer . new_endpoint_enabled ) { ocspCacheServer . resetOCSPResponseCacheServer ( peerHost ) ; } synchronized ( OCSP_RESPONSE_CACHE_LOCK ) { boolean isCached = isCached ( pairIssuerSubjectList ) ; if ( this . useOcspResponseCacheServer && ! isCached ) { if ( ! ocspCacheServer . new_endpoint_enabled ) { LOGGER . debug ( "Downloading OCSP response cache from the server. URL: {}" , SF_OCSP_RESPONSE_CACHE_SERVER_URL ) ; } else { LOGGER . debug ( "Downloading OCSP response cache from the server. URL: {}" , ocspCacheServer . SF_OCSP_RESPONSE_CACHE_SERVER ) ; } readOcspResponseCacheServer ( ) ; // if the cache is downloaded from the server, it should be written // to the file cache at all times. WAS_CACHE_UPDATED = true ; } executeRevocationStatusChecks ( pairIssuerSubjectList , peerHost ) ; if ( WAS_CACHE_UPDATED ) { JsonNode input = encodeCacheToJSON ( ) ; fileCacheManager . writeCacheFile ( input ) ; WAS_CACHE_UPDATED = false ; } } }
Certificate Revocation checks