How to use CRLs when validating certificate paths

Thread view:

Duncan - 28 Aug 2007 10:19 GMT

Hi guys,

I'm trying to build and validate a certificate path in Java 6. I have
loaded in two certificates: one is the certificate I'm trying to
validate, and the other is the certificate of the CA who has signed
it.

I threw these two certificates into an array and called
CertificateValidator.createCertificatePath(<cert array>) to generate a
path. I then created a TrustAnchor object, passing in the CA's
certificate, and used this to create a new PKIXParameters object.
Finally, I create a CertPathValidator of the default type, and tried
to validate the path, along with the parameters object.

I get the following error:

java.security.cert.CertPathValidatorException: revocation status check
failed: no CRL found
at
sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:
139)
at
sun.security.provider.certpath.PKIXCertPathValidator.doValidate(PKIXCertPathValidator.java:
316)
at
sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:
178)
at
java.security.cert.CertPathValidator.validate(CertPathValidator.java:
250)

So I've acquired the CRL of the CA, and can load this into a X509CRL
object. I'm now completely unsure how to use this object - at which
point in the process can I specify that this is the CRL to be examined
during the validation process? I find the java.security.cert.*
documentation to be rather sparse at times, and could not find any
examples via Google.

Any help would be greatly appreciated. Do not hesitate to ask for
more details :-)

Thanks,

Duncan Jones

Reply to this Message

Duncan - 29 Aug 2007 14:42 GMT

> Hi guys,
>
[quoted text clipped - 40 lines]
>
> Duncan Jones

It seems perhaps I was complicating matters. Since I had access to
both the CA's cert, and the signed certificate, I could simply use the
following code:

try {
InputStream is = new FileInputStream(<path to DER encoded signed
cert>);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate signedCert = (X509Certificate)
cf.generateCertificate(is);

is = new FileInputStream(<path to DER encoded CA cert>);
X509Certificate caCert = (X509Certificate)
cf.generateCertificate(is);

try {
// check date validity and confirm CA signed certificate
signedCert.checkValidity();
signedCert.verify(caCert.getPublicKey());
System.out.println("Certificate validated succesfully!");
}
catch (SignatureException e) {
System.err.println("Signature did not match.");
e.printStackTrace();
}
catch (CertificateExpiredException e) {
System.err.println("Certificate has expired.");
}
catch (CertificateNotYetValidException e) {
System.err.println("Certificate is not yet valid.");
}
}
catch (Throwable t) {
t.printStackTrace();
}

Reply to this Message

Roedy Green - 30 Aug 2007 04:26 GMT

>I threw these two certificates into an array and called
>CertificateValidator.createCertificatePath(<cert array>) to generate a
>path.

do you mean array or ArrayList?