Skip to content

Commit 8e797fb

Browse files
madislmmadislm
committed
AUT-2677 Use distinguished names instead of common names for OCSP service lookup
1 parent bfc9810 commit 8e797fb

7 files changed

Lines changed: 51 additions & 74 deletions

File tree

‎src/main/java/eu/webeid/ocsp/protocol/IssuerCommonName.java‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎src/main/java/eu/webeid/ocsp/protocol/IssuerDistinguishedName.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package eu.webeid.ocsp.protocol;
2+
3+
import org.bouncycastle.asn1.x500.X500Name;
4+
5+
import java.security.cert.X509Certificate;
6+
import java.util.Objects;
7+
import java.util.Optional;
8+
9+
public class IssuerDistinguishedName {
10+
11+
public static Optional<X500Name> getIssuerDistinguishedName(X509Certificate certificate) {
12+
Objects.requireNonNull(certificate, "certificate");
13+
String issuerDN = certificate.getIssuerX500Principal().getName();
14+
if (issuerDN.isEmpty()) {
15+
return Optional.empty();
16+
}
17+
return Optional.of(new X500Name(issuerDN));
18+
}
19+
20+
private IssuerDistinguishedName() {
21+
throw new IllegalStateException("Utility class");
22+
}
23+
}

‎src/main/java/eu/webeid/ocsp/service/AiaOcspService.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException;
2929
import eu.webeid.ocsp.protocol.OcspResponseValidator;
3030
import eu.webeid.security.validator.revocationcheck.RevocationMode;
31+
import org.bouncycastle.asn1.x500.X500Name;
3132
import org.bouncycastle.cert.X509CertificateHolder;
3233
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
3334

@@ -41,7 +42,7 @@
4142
import java.util.Optional;
4243
import java.util.Set;
4344

44-
import static eu.webeid.ocsp.protocol.IssuerCommonName.getIssuerCommonName;
45+
import static eu.webeid.ocsp.protocol.IssuerDistinguishedName.getIssuerDistinguishedName;
4546
import static eu.webeid.ocsp.protocol.OcspUrl.getOcspUri;
4647

4748
/**
@@ -62,9 +63,9 @@ public AiaOcspService(AiaOcspServiceConfiguration configuration, X509Certificate
6263
this.trustedCACertificateCertStore = configuration.getTrustedCACertificateCertStore();
6364
this.url = getOcspAiaUrlFromCertificate(Objects.requireNonNull(certificate));
6465
this.fallbackOcspService = fallbackOcspService;
65-
String issuerCN = getIssuerCommonName(certificate).orElseThrow(() ->
66-
new UserCertificateOCSPCheckFailedException("Getting the issuer common name failed"));
67-
this.supportsNonce = !configuration.getNonceDisabledIssuerCNs().contains(issuerCN);
66+
X500Name issuerDN = getIssuerDistinguishedName(certificate).orElseThrow(() ->
67+
new UserCertificateOCSPCheckFailedException("Getting the issuer distinguished name failed"));
68+
this.supportsNonce = !configuration.getNonceDisabledIssuerDNs().contains(issuerDN);
6869
}
6970

7071
@Override

‎src/main/java/eu/webeid/ocsp/service/AiaOcspServiceConfiguration.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222

2323
package eu.webeid.ocsp.service;
2424

25+
import org.bouncycastle.asn1.x500.X500Name;
26+
2527
import java.security.cert.CertStore;
2628
import java.security.cert.TrustAnchor;
2729
import java.util.Collection;
@@ -30,18 +32,18 @@
3032

3133
public class AiaOcspServiceConfiguration {
3234

33-
private final Collection<String> nonceDisabledIssuerCNs;
35+
private final Collection<X500Name> nonceDisabledIssuerDNs;
3436
private final Set<TrustAnchor> trustedCACertificateAnchors;
3537
private final CertStore trustedCACertificateCertStore;
3638

37-
public AiaOcspServiceConfiguration(Collection<String> nonceDisabledIssuerCNs, Set<TrustAnchor> trustedCACertificateAnchors, CertStore trustedCACertificateCertStore) {
38-
this.nonceDisabledIssuerCNs = Objects.requireNonNull(nonceDisabledIssuerCNs);
39+
public AiaOcspServiceConfiguration(Collection<X500Name> nonceDisabledIssuerDNs, Set<TrustAnchor> trustedCACertificateAnchors, CertStore trustedCACertificateCertStore) {
40+
this.nonceDisabledIssuerDNs = Objects.requireNonNull(nonceDisabledIssuerDNs);
3941
this.trustedCACertificateAnchors = Objects.requireNonNull(trustedCACertificateAnchors);
4042
this.trustedCACertificateCertStore = Objects.requireNonNull(trustedCACertificateCertStore);
4143
}
4244

43-
public Collection<String> getNonceDisabledIssuerCNs() {
44-
return nonceDisabledIssuerCNs;
45+
public Collection<X500Name> getNonceDisabledIssuerDNs() {
46+
return nonceDisabledIssuerDNs;
4547
}
4648

4749
public Set<TrustAnchor> getTrustedCACertificateAnchors() {

‎src/main/java/eu/webeid/ocsp/service/FallbackOcspServiceConfiguration.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
import eu.webeid.ocsp.exceptions.OCSPCertificateException;
2626
import eu.webeid.ocsp.protocol.OcspResponseValidator;
27+
import org.bouncycastle.asn1.x500.X500Name;
2728

2829
import java.net.URI;
2930
import java.security.cert.CertStore;
@@ -38,14 +39,14 @@ public class FallbackOcspServiceConfiguration {
3839
private final X509Certificate responderCertificate;
3940
private final boolean doesSupportNonce;
4041
private final FallbackOcspServiceConfiguration nextFallbackConfiguration;
41-
private final String issuerCN;
42+
private final X500Name issuerDN;
4243
private final Set<TrustAnchor> trustedCACertificateAnchors;
4344
private final CertStore trustedCACertificateCertStore;
4445

4546
public FallbackOcspServiceConfiguration(URI accessLocation, X509Certificate responderCertificate,
4647
boolean doesSupportNonce,
4748
FallbackOcspServiceConfiguration nextFallbackConfiguration,
48-
String issuerCN, Set<TrustAnchor> trustedCACertificateAnchors,
49+
X500Name issuerDN, Set<TrustAnchor> trustedCACertificateAnchors,
4950
CertStore trustedCACertificateCertStore) throws OCSPCertificateException {
5051
this.accessLocation = Objects.requireNonNull(accessLocation, "Fallback OCSP service access location");
5152
this.responderCertificate = responderCertificate;
@@ -54,7 +55,7 @@ public FallbackOcspServiceConfiguration(URI accessLocation, X509Certificate resp
5455
}
5556
this.doesSupportNonce = doesSupportNonce;
5657
this.nextFallbackConfiguration = nextFallbackConfiguration;
57-
this.issuerCN = issuerCN;
58+
this.issuerDN = issuerDN;
5859
this.trustedCACertificateAnchors = Objects.requireNonNull(trustedCACertificateAnchors);
5960
this.trustedCACertificateCertStore = Objects.requireNonNull(trustedCACertificateCertStore);
6061
}
@@ -75,8 +76,8 @@ public FallbackOcspServiceConfiguration getNextFallbackConfiguration() {
7576
return nextFallbackConfiguration;
7677
}
7778

78-
public String getIssuerCN() {
79-
return issuerCN;
79+
public X500Name getIssuerDN() {
80+
return issuerDN;
8081
}
8182

8283
public Set<TrustAnchor> getTrustedCACertificateAnchors() {

‎src/main/java/eu/webeid/ocsp/service/OcspServiceProvider.java‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException;
2626
import eu.webeid.security.exceptions.AuthTokenException;
27+
import org.bouncycastle.asn1.x500.X500Name;
2728

2829
import java.security.cert.CertificateEncodingException;
2930
import java.security.cert.X509Certificate;
@@ -32,13 +33,13 @@
3233
import java.util.Map;
3334
import java.util.Objects;
3435

35-
import static eu.webeid.ocsp.protocol.IssuerCommonName.getIssuerCommonName;
36+
import static eu.webeid.ocsp.protocol.IssuerDistinguishedName.getIssuerDistinguishedName;
3637

3738
public class OcspServiceProvider {
3839

3940
private final DesignatedOcspService designatedOcspService;
4041
private final AiaOcspServiceConfiguration aiaOcspServiceConfiguration;
41-
private final Map<String, FallbackOcspService> fallbackOcspServiceMap = new HashMap<>();
42+
private final Map<X500Name, FallbackOcspService> fallbackOcspServiceMap = new HashMap<>();
4243

4344
public OcspServiceProvider(DesignatedOcspServiceConfiguration designatedOcspServiceConfiguration, AiaOcspServiceConfiguration aiaOcspServiceConfiguration) {
4445
this(designatedOcspServiceConfiguration, aiaOcspServiceConfiguration, null);
@@ -51,7 +52,7 @@ public OcspServiceProvider(DesignatedOcspServiceConfiguration designatedOcspServ
5152
this.aiaOcspServiceConfiguration = Objects.requireNonNull(aiaOcspServiceConfiguration, "aiaOcspServiceConfiguration");
5253
if (fallbackOcspServiceConfigurations != null) {
5354
for (FallbackOcspServiceConfiguration configuration : fallbackOcspServiceConfigurations) {
54-
fallbackOcspServiceMap.put(configuration.getIssuerCN(), new FallbackOcspService(configuration));
55+
fallbackOcspServiceMap.put(configuration.getIssuerDN(), new FallbackOcspService(configuration));
5556
}
5657
}
5758
}
@@ -69,9 +70,9 @@ public OcspService getService(X509Certificate certificate) throws AuthTokenExcep
6970
if (designatedOcspService != null && designatedOcspService.supportsIssuerOf(certificate)) {
7071
return designatedOcspService;
7172
}
72-
String issuerCommonName = getIssuerCommonName(certificate).orElseThrow(() ->
73-
new UserCertificateOCSPCheckFailedException("Getting the issuer common name failed"));
74-
FallbackOcspService fallbackOcspService = fallbackOcspServiceMap.get(issuerCommonName);
73+
X500Name issuerDistinguishedName = getIssuerDistinguishedName(certificate).orElseThrow(() ->
74+
new UserCertificateOCSPCheckFailedException("Getting the issuer distinguished name failed"));
75+
FallbackOcspService fallbackOcspService = fallbackOcspServiceMap.get(issuerDistinguishedName);
7576
return new AiaOcspService(aiaOcspServiceConfiguration, certificate, fallbackOcspService);
7677
}
7778
}

‎src/test/java/eu/webeid/ocsp/service/OcspServiceMaker.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import eu.webeid.security.certificate.CertificateValidator;
2626
import eu.webeid.security.exceptions.JceException;
2727
import eu.webeid.ocsp.exceptions.OCSPCertificateException;
28+
import org.bouncycastle.asn1.x500.X500Name;
2829

2930
import java.io.IOException;
3031
import java.net.URI;
@@ -41,7 +42,7 @@ public class OcspServiceMaker {
4142

4243
private static final String TEST_OCSP_ACCESS_LOCATION = "http://demo.sk.ee/ocsp";
4344
private static final List<X509Certificate> TRUSTED_CA_CERTIFICATES;
44-
private static final String ISSUER_CN = "TEST of ESTEID-SK 2015";
45+
private static final X500Name ISSUER_DN = new X500Name("CN=TEST of ESTEID-SK 2015, OID.2.5.4.97=NTREE-10747013, O=AS Sertifitseerimiskeskus, C=EE");
4546

4647
static {
4748
try {
@@ -69,7 +70,7 @@ public static OcspServiceProvider getDesignatedOcspServiceProvider(String ocspSe
6970

7071
private static AiaOcspServiceConfiguration getAiaOcspServiceConfiguration() throws JceException {
7172
return new AiaOcspServiceConfiguration(
72-
Set.of(ISSUER_CN),
73+
Set.of(ISSUER_DN),
7374
CertificateValidator.buildTrustAnchorsFromCertificates(TRUSTED_CA_CERTIFICATES),
7475
CertificateValidator.buildCertStoreFromCertificates(TRUSTED_CA_CERTIFICATES));
7576
}

0 commit comments

Comments
 (0)