Is it possible to accept a CRL after its next update date?

Markus Adelsberger <[email protected]>
Newsgroups gmane.comp.encryption.bouncy-castle.devel
Message-ID <OF0D3D2490.5FAD3E08-ONC1258295.0022D6A4-C1258295.0026AB36@sbs.co.at>
Hi,

I'm trying to validate X509 certificates offline with bouncy castle in 
Java and have run into a problem with older CRLs. I haven't found a 
possibility yet to accept CRLs which are expired, in our setup it can 
happen that a CRL can't be updated regularly, so the old one should stay 
valid until anything newer comes along.

Just to clarify, this would be the use case:

1. Create certificate in 2015, valid 2015-2020
2. Revoke the certificate with a CRL in 2017, key was stolen, only create 
CRL for 1 year because I make a mistake or plan on rolling over and never 
get around to it
3. Check the certificate in 2019, the CRL is expired, bouncy castle 
complains there is no CRL to be found and my validation fails - which is 
not the same as a revocation result

Currently I'm just deactivating CRL checking and performing the check 
myself, but I'd prefer to do it via bouncy castle.

I asked what to do over at StackOverflow and I was referred to this 
mailing list, I hope this was correct, if not I'm sorry.
https://stackoverflow.com/questions/50410203/accepting-expired-crl-with-bouncycastle

I'm attaching my code below, thanks for any input in this matter.

Markus

final X509CertSelector endConstraints = new X509CertSelector();
endConstraints.setSerialNumber(signer.getSID().getSerialNumber());

final PKIXBuilderParameters buildParams = new 
PKIXBuilderParameters(trustAnchors, endConstraints);
//a CertStore object with Certificates and CRLs
buildParams.addCertStore(certificates);
//currently deactivated
buildParams.setRevocationEnabled(false);

final CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
final CertPathBuilderResult result = builder.build(buildParams);

//here I manually check the CRLs, which I don't want to do
checkRevocation(result.getCertPath().getCertificates(), certificates, 
trustAnchors);

//if this passes I return the found certificate
return (X509Certificate) result.getCertPath().getCertificates().get(0);
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.