Is it possible to accept a CRL after its next update date?
Markus Adelsberger <[email protected]>
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <OF0D3D2490.5FAD3E08-ONC1258295.0022D6A4-C1258295.0026AB36@sbs.co.at> |
Hi,
I'm trying to validate X509 certificates offline with bouncy castle in
Java and have run into a problem with older CRLs. I haven't found a
possibility yet to accept CRLs which are expired, in our setup it can
happen that a CRL can't be updated regularly, so the old one should stay
valid until anything newer comes along.
Just to clarify, this would be the use case:
1. Create certificate in 2015, valid 2015-2020
2. Revoke the certificate with a CRL in 2017, key was stolen, only create
CRL for 1 year because I make a mistake or plan on rolling over and never
get around to it
3. Check the certificate in 2019, the CRL is expired, bouncy castle
complains there is no CRL to be found and my validation fails - which is
not the same as a revocation result
Currently I'm just deactivating CRL checking and performing the check
myself, but I'd prefer to do it via bouncy castle.
I asked what to do over at StackOverflow and I was referred to this
mailing list, I hope this was correct, if not I'm sorry.
https://stackoverflow.com/questions/50410203/accepting-expired-crl-with-bouncycastle
I'm attaching my code below, thanks for any input in this matter.
Markus
final X509CertSelector endConstraints = new X509CertSelector();
endConstraints.setSerialNumber(signer.getSID().getSerialNumber());
final PKIXBuilderParameters buildParams = new
PKIXBuilderParameters(trustAnchors, endConstraints);
//a CertStore object with Certificates and CRLs
buildParams.addCertStore(certificates);
//currently deactivated
buildParams.setRevocationEnabled(false);
final CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
final CertPathBuilderResult result = builder.build(buildParams);
//here I manually check the CRLs, which I don't want to do
checkRevocation(result.getCertPath().getCertificates(), certificates,
trustAnchors);
//if this passes I return the found certificate
return (X509Certificate) result.getCertPath().getCertificates().get(0);