Java에서 X509Certificate에서 CRL을 가져 오는 방법

Question

CMSSignedData (PKCS7)에서 파생 된 X509Certificate가 있습니다. 내 질문은 인증서가 취소되었는지 여부를 확인하기 위해 URL을 CRL 파일로 가져 오는 방법입니다. 나는 코드 아래에 시도했다 :

X509CertificateHolder signerCertificateHolder = (X509CertificateHolder) certIt.next(); 
X509Certificate certificate = new JcaX509CertificateConverter().setProvider("BC").getCertificate(signerCertificateHolder); 
X509CRLEntry revokedCertificate; 
X509CRL crl; 

URL url = new URL("???"); 
URLConnection connection = url.openConnection(); 

try(DataInputStream inStream = new DataInputStream(connection.getInputStream())) 
{ 
crl = (X509CRL) cf.generateCRL(inStream); 
} 

revokedCertificate = crl.getRevokedCertificate(certificate.getSerialNumber()); 

if(revokedCertificate != null) 
{ 
System.out.println("Revoked"); 
} 
else 
{ 
System.out.println("Valid"); 
} 

그리고 나는 CRL에 URL을 얻을 수없는 것을 제외하고는, 잘 작동합니다. OI (Object Identifier) ​​- 2.5.29.31이 있다는 것을 알고 있습니다. 그러나 유감스럽게도 인증서에서 파생시킬 수는 없습니다. 어떻게해야합니까?

Answer 1

이 코드 스 니펫 here이 발견되어 인증서의 모든 CRL이 인쇄됩니다.

import java.io.ByteArrayInputStream; 
import java.io.File; 
import java.io.FileInputStream; 
import java.security.cert.CertificateFactory; 
import java.security.cert.X509Certificate; 
import java.util.ArrayList; 
import java.util.List; 

import org.bouncycastle.asn1.ASN1InputStream; 
import org.bouncycastle.asn1.ASN1Primitive; 
import org.bouncycastle.asn1.DERIA5String; 
import org.bouncycastle.asn1.DEROctetString; 
import org.bouncycastle.asn1.x509.CRLDistPoint; 
import org.bouncycastle.asn1.x509.DistributionPoint; 
import org.bouncycastle.asn1.x509.DistributionPointName; 
import org.bouncycastle.asn1.x509.Extension; 
import org.bouncycastle.asn1.x509.GeneralName; 
import org.bouncycastle.asn1.x509.GeneralNames; 

public class CertCRL 
{ 

    public static void main(String[] args) 
    { 
     try 
     { 
      CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509"); 

      X509Certificate certificate = (X509Certificate) certificateFactory.generateCertificate(new FileInputStream(new File("CERT_FILE_PATH"))); 

      byte[] crlDistributionPointDerEncodedArray = certificate.getExtensionValue(Extension.cRLDistributionPoints.getId()); 

      ASN1InputStream oAsnInStream = new ASN1InputStream(new ByteArrayInputStream(crlDistributionPointDerEncodedArray)); 
      ASN1Primitive derObjCrlDP = oAsnInStream.readObject(); 
      DEROctetString dosCrlDP = (DEROctetString) derObjCrlDP; 

      oAsnInStream.close(); 

      byte[] crldpExtOctets = dosCrlDP.getOctets(); 
      ASN1InputStream oAsnInStream2 = new ASN1InputStream(new ByteArrayInputStream(crldpExtOctets)); 
      ASN1Primitive derObj2 = oAsnInStream2.readObject(); 
      CRLDistPoint distPoint = CRLDistPoint.getInstance(derObj2); 

      oAsnInStream2.close(); 

      List<String> crlUrls = new ArrayList<String>(); 
      for (DistributionPoint dp : distPoint.getDistributionPoints()) 
      { 
       DistributionPointName dpn = dp.getDistributionPoint(); 
       // Look for URIs in fullName 
       if (dpn != null) 
       { 
        if (dpn.getType() == DistributionPointName.FULL_NAME) 
        { 
         GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames(); 
         // Look for an URI 
         for (int j = 0; j < genNames.length; j++) 
         { 
          if (genNames[j].getTagNo() == GeneralName.uniformResourceIdentifier) 
          { 
           String url = DERIA5String.getInstance(genNames[j].getName()).getString(); 
           crlUrls.add(url); 
          } 
         } 
        } 
       } 
      } 

      for (String url : crlUrls) 
       System.out.println(url); 
     } 
     catch (Throwable e) 
     { 
      e.printStackTrace(); 
     } 
    } 

}