private List < String > getCrlDistributionPoints ( X509Certificate cert ) throws CertificateVerificationException { //Gets the DER-encoded OCTET string for the extension value for CRLDistributionPoints. byte [ ] crlDPExtensionValue = cert . getExtensionValue ( Extension . cRLDistributionPoints . getId ( ) ) ; if ( crlDPExtensionValue == null ) { throw new CertificateVerificationException ( "Certificate doesn't have CRL distribution points" ) ; } //crlDPExtensionValue is encoded in ASN.1 format. ASN1InputStream asn1In = new ASN1InputStream ( crlDPExtensionValue ) ; //DER (Distinguished Encoding Rules) is one of ASN.1 encoding rules defined in ITU-T X.690, 2002, specification. //ASN.1 encoding rules can be used to encode any data object into a binary file. Read the object in octets. CRLDistPoint distPoint ; try { DEROctetString crlDEROctetString = ( DEROctetString ) asn1In . readObject ( ) ; //Get Input stream in octets. distPoint = getOctetInputStream ( crlDEROctetString ) ; } catch ( IOException e ) { throw new CertificateVerificationException ( "Cannot read certificate to get CRL URLs" , e ) ; } finally { try { asn1In . close ( ) ; } catch ( IOException e ) { LOG . error ( "Cannot close input stream" , e ) ; } } List < String > crlUrls = new ArrayList <> ( ) ; //Loop through ASN1Encodable DistributionPoints. for ( DistributionPoint dp : distPoint . getDistributionPoints ( ) ) { //get ASN1Encodable DistributionPointName. DistributionPointName dpn = dp . getDistributionPoint ( ) ; if ( dpn != null && dpn . getType ( ) == DistributionPointName . FULL_NAME ) { //Create ASN1Encodable General Names. GeneralName [ ] genNames = GeneralNames . getInstance ( dpn . getName ( ) ) . getNames ( ) ; // Look for a URI for ( GeneralName genName : genNames ) { if ( genName . getTagNo ( ) == GeneralName . uniformResourceIdentifier ) { //DERIA5String contains an ascii string. //A IA5String is a restricted character string type in the ASN.1 notation. String url = DERIA5String . getInstance ( genName . getName ( ) ) . getString ( ) . trim ( ) ; crlUrls . add ( url ) ; } } } } if ( crlUrls . isEmpty ( ) ) { throw new CertificateVerificationException ( "Cant get CRL urls from certificate" ) ; } return crlUrls ; }
Extracts all CRL distribution point URLs from the CRL Distribution Point extension in a X . 509 certificate . If CRL distribution point extension is unavailable returns an empty list .