public static OCSPReq generateOCSPRequest ( X509Certificate issuerCert , BigInteger serialNumber ) throws CertificateVerificationException { //Programatically adding Bouncy Castle as the security provider. So no need to manually set. Once the programme // is over security provider will also be removed. Security . addProvider ( new BouncyCastleProvider ( ) ) ; try { byte [ ] issuerCertEnc = issuerCert . getEncoded ( ) ; X509CertificateHolder certificateHolder = new X509CertificateHolder ( issuerCertEnc ) ; DigestCalculatorProvider digCalcProv = new JcaDigestCalculatorProviderBuilder ( ) . setProvider ( Constants . BOUNCY_CASTLE_PROVIDER ) . build ( ) ; // CertID structure is used to uniquely identify certificates that are the subject of // an OCSP request or response and has an ASN.1 definition. CertID structure is defined in RFC 2560. CertificateID id = new CertificateID ( digCalcProv . get ( CertificateID . HASH_SHA1 ) , certificateHolder , serialNumber ) ; // basic request generation with nonce. OCSPReqBuilder builder = new OCSPReqBuilder ( ) ; builder . addRequest ( id ) ; // create details for nonce extension. The nonce extension is used to bind // a request to a response to prevent re-play attacks. As the name implies, // the nonce value is something that the client should only use once during a reasonably small period. BigInteger nonce = BigInteger . valueOf ( System . currentTimeMillis ( ) ) ; //to create the request Extension builder . setRequestExtensions ( new Extensions ( new Extension ( OCSPObjectIdentifiers . id_pkix_ocsp_nonce , false , new DEROctetString ( nonce . toByteArray ( ) ) ) ) ) ; return builder . build ( ) ; } catch ( OCSPException | OperatorCreationException | IOException | CertificateEncodingException e ) { throw new CertificateVerificationException ( "Cannot generate OCSP Request with the given certificate" , e ) ; } }
This method generates an OCSP Request to be sent to an OCSP authority access endpoint .