Class OcspClient

java.lang.Object
io.netty.handler.ssl.ocsp.OcspClient

final class OcspClient extends Object
  • Field Details

    • logger

      private static final InternalLogger logger
    • SECURE_RANDOM

      private static final SecureRandom SECURE_RANDOM
    • OCSP_RESPONSE_MAX_SIZE

      private static final int OCSP_RESPONSE_MAX_SIZE
  • Constructor Details

    • OcspClient

      private OcspClient()
  • Method Details

    • query

      static Promise<org.bouncycastle.cert.ocsp.BasicOCSPResp> query(X509Certificate x509Certificate, X509Certificate issuer, boolean validateResponseNonce, IoTransport ioTransport, DnsNameResolver dnsNameResolver)
      Query the certificate status using OCSP
      Parameters:
      x509Certificate - Client X509Certificate to validate
      issuer - X509Certificate issuer of client certificate
      validateResponseNonce - Set to true to enable OCSP response validation
      ioTransport - IoTransport to use
      Returns:
      Promise of BasicOCSPResp
    • query

      private static Promise<org.bouncycastle.cert.ocsp.OCSPResp> query(EventLoop eventLoop, ByteBuf ocspRequest, String host, int port, String path, IoTransport ioTransport, DnsNameResolver dnsNameResolver)
      Query the OCSP responder for certificate status using HTTP/1.1
      Parameters:
      eventLoop - EventLoop for HTTP request execution
      ocspRequest - ByteBuf containing OCSP request data
      host - OCSP responder hostname
      port - OCSP responder port
      path - OCSP responder path
      ioTransport - IoTransport to use
      Returns:
      Returns Promise containing OCSPResp
    • validateResponse

      private static void validateResponse(Promise<org.bouncycastle.cert.ocsp.BasicOCSPResp> responsePromise, org.bouncycastle.cert.ocsp.BasicOCSPResp basicResponse, org.bouncycastle.asn1.DEROctetString derNonce, X509Certificate issuer, boolean validateNonce)
    • validateNonce

      private static void validateNonce(org.bouncycastle.cert.ocsp.BasicOCSPResp basicResponse, org.bouncycastle.asn1.DEROctetString encodedNonce) throws org.bouncycastle.cert.ocsp.OCSPException
      Validate OCSP response nonce
      Throws:
      org.bouncycastle.cert.ocsp.OCSPException
    • validateSignature

      private static void validateSignature(org.bouncycastle.cert.ocsp.BasicOCSPResp resp, X509Certificate certificate) throws org.bouncycastle.cert.ocsp.OCSPException
      Validate OCSP response signature
      Throws:
      org.bouncycastle.cert.ocsp.OCSPException
    • parseOcspUrlFromCertificate

      private static String parseOcspUrlFromCertificate(X509Certificate cert)
      Parse OCSP endpoint URL from Certificate
      Parameters:
      cert - Certificate to be parsed
      Returns:
      OCSP endpoint URL
      Throws:
      NullPointerException - If we couldn't locate OCSP responder URL
      IllegalArgumentException - If we couldn't parse X509Certificate into JcaX509CertificateHolder