Java Requires Chilkat v11.0.0+

Validate Certificate using OCSP Protocol

See more Certificates Examples

Demonstrates how to validate a certificate (check the revoked status) using the OCSP protocol. Chilkat2 Java

import com.chilkatsoft.chilkat2.BinData;
import com.chilkatsoft.chilkat2.Cert;
import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.Http;
import com.chilkatsoft.chilkat2.HttpResponse;
import com.chilkatsoft.chilkat2.JsonObject;
import com.chilkatsoft.chilkat2.Prng;

public class ChilkatExample {

    public static void main(String[] args) {
        // This requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // This example will check the revoked status of a certificate loaded from a file.
        Cert cert = new Cert();
        try {
            cert.loadFromFile("qa_data/certs/google.crt");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Get the cert's OCSP URL.
        String ocspUrl = cert.getOcspUrl();

        // Build the JSON that will be the OCSP request.

        // Possible hash algorithms are sha1, sha256, sha384, sha512.
        String hashAlg = "sha256";
        Prng prng = new Prng();
        JsonObject json = new JsonObject();
        json.setEmitCompact(false);
        // Read more about OCSP nonce lengths
        json.updateString("extensions.ocspNonce", prng.genRandom(16, "base64"));
        json.setI(0);
        json.updateString("request[i].cert.hashAlg", hashAlg);
        json.updateString("request[i].cert.issuerNameHash", cert.hashOf("IssuerDN", hashAlg, "base64"));
        json.updateString("request[i].cert.issuerKeyHash", cert.hashOf("IssuerPublicKey", hashAlg, "base64"));
        json.updateString("request[i].cert.serialNumber", cert.getSerialNumber());

        System.out.println(json.emit());

        // Our OCSP request looks something like this:
        // {
        //   "extensions": {
        //     "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO"
        //   },
        //   "request": [
        //     {
        //       "cert": {
        //         "hashAlg": "sha1",
        //         "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
        //         "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
        //         "serialNumber": "6175535D87BF94B6"
        //       }
        //     }
        //   ]
        // }

        BinData ocspRequest = new BinData();
        Http http = new Http();

        // Convert our JSON to a binary (ASN.1) OCSP request
        try {
            http.createOcspRequest(json, ocspRequest);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Send the OCSP request to the OCSP server
        HttpResponse resp = new HttpResponse();
        try {
            http.httpBd("POST", ocspUrl, ocspRequest, "application/ocsp-request", resp);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Get the binary (ASN.1) OCSP reply
        BinData ocspReply = new BinData();
        resp.getBodyBd(ocspReply);

        // Convert the binary reply to JSON.
        // Also returns the overall OCSP response status.
        JsonObject jsonReply = new JsonObject();
        int ocspStatus = http.parseOcspReply(ocspReply, jsonReply);

        // The ocspStatus can have one of these values:
        // -1:  The ARG1 does not contain a valid OCSP reply.
        // 0:  Successful - Response has valid confirmations..
        // 1: Malformed request - Illegal confirmation request.
        // 2: Internal error - Internal error in issuer.
        // 3: Try later -  Try again later.
        // 4: Not used - This value is never returned.
        // 5: Sig required - Must sign the request.
        // 6: Unauthorized - Request unauthorized.

        if (ocspStatus < 0) {
            System.out.println("Invalid OCSP reply.");
            return;
        }

        System.out.println("Overall OCSP Response Status: " + ocspStatus);

        // Let's examine the OCSP response (in JSON).
        jsonReply.setEmitCompact(false);
        System.out.println(jsonReply.emit());

        // The JSON reply looks like this:
        // (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml
        // to generate JSON parsing code.)

        // {
        //   "responseStatus": 0,
        //   "responseTypeOid": "1.3.6.1.5.5.7.48.1.1",
        //   "responseTypeName": "ocspBasic",
        //   "response": {
        //     "responderIdChoice": "KeyHash",
        //     "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
        //     "dateTime": "20180803193937Z",
        //     "cert": [
        //       {
        //         "hashOid": "1.3.14.3.2.26",
        //         "hashAlg": "SHA-1",
        //         "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
        //         "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
        //         "serialNumber": "6175535D87BF94B6",
        //         "status": 0,
        //         "thisUpdate": "20180803193937Z",
        //         "nextUpdate": "20180810193937Z"
        //       }
        //     ]
        //   }
        // }
        //

        // The certificate status:
        int certStatus = -1;
        if (jsonReply.hasMember("response.cert[0].status")) {
            certStatus = jsonReply.intOf("response.cert[0].status");
        }

        // Possible certStatus values are:
        // -1: No status returned.
        // 0: Good
        // 1: Revoked
        // 2: Unknown.
        System.out.println("Certificate Status: " + certStatus);
    }
}