Chilkat HOME .NET Core C# Android™ AutoIt C C# C++ Chilkat2-Python CkPython Classic ASP DataFlex Delphi ActiveX Delphi DLL Go Java Lianja Mono C# Node.js Objective-C PHP ActiveX PHP Extension Perl PowerBuilder PowerShell PureBasic Ruby SQL Server Swift 2 Swift 3,4,5... Tcl Unicode C Unicode C++ VB.NET VBScript Visual Basic 6.0 Visual FoxPro Xojo Plugin
(Objective-C) Validate Certificate using OCSP ProtocolDemonstrates how to validate a certificate (check the revoked status) using the OCSP protocol. Note: This example requires Chilkat v9.5.0.75 or greater
#import <CkoCert.h> #import <NSString.h> #import <CkoPrng.h> #import <CkoJsonObject.h> #import <CkoBinData.h> #import <CkoHttp.h> #import <CkoHttpResponse.h> // Note: Requires Chilkat v9.5.0.75 or greater. // This requires the Chilkat API to have been previously unlocked. // See Global Unlock Sample for sample code. // This example will check the revoked status of a certificate loaded from a file. CkoCert *cert = [[CkoCert alloc] init]; BOOL success = [cert LoadFromFile: @"qa_data/certs/google.crt"]; if (success != YES) { NSLog(@"%@",cert.LastErrorText); return; } // Get the cert's OCSP URL. NSString *ocspUrl = cert.OcspUrl; // Build the JSON that will be the OCSP request. CkoPrng *prng = [[CkoPrng alloc] init]; CkoJsonObject *json = [[CkoJsonObject alloc] init]; json.EmitCompact = NO; [json UpdateString: @"extensions.ocspNonce" value: [prng GenRandom: [NSNumber numberWithInt: 36] encoding: @"base64"]]; json.I = [NSNumber numberWithInt:0]; [json UpdateString: @"request[i].cert.hashAlg" value: @"sha1"]; [json UpdateString: @"request[i].cert.issuerNameHash" value: [cert HashOf: @"IssuerDN" hashAlg: @"sha1" encoding: @"base64"]]; [json UpdateString: @"request[i].cert.issuerKeyHash" value: [cert HashOf: @"IssuerPublicKey" hashAlg: @"sha1" encoding: @"base64"]]; [json UpdateString: @"request[i].cert.serialNumber" value: cert.SerialNumber]; NSLog(@"%@",[json Emit]); // Our OCSP request looks like this: // { // "extensions": { // "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO" // }, // "request": [ // { // "cert": { // "hashAlg": "sha1", // "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=", // "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=", // "serialNumber": "6175535D87BF94B6" // } // } // ] // } CkoBinData *ocspRequest = [[CkoBinData alloc] init]; CkoHttp *http = [[CkoHttp alloc] init]; // Convert our JSON to a binary (ASN.1) OCSP request success = [http CreateOcspRequest: json ocspRequest: ocspRequest]; if (success == NO) { NSLog(@"%@",http.LastErrorText); return; } // Send the OCSP request to the OCSP server CkoHttpResponse *resp = [http PBinaryBd: @"POST" url: ocspUrl data: ocspRequest contentType: @"application/ocsp-request" md5: NO gzip: NO]; if (http.LastMethodSuccess != YES) { NSLog(@"%@",http.LastErrorText); return; } // Get the binary (ASN.1) OCSP reply CkoBinData *ocspReply = [[CkoBinData alloc] init]; [resp GetBodyBd: ocspReply]; // Convert the binary reply to JSON. // Also returns the overall OCSP response status. CkoJsonObject *jsonReply = [[CkoJsonObject alloc] init]; int ocspStatus = [[http ParseOcspReply: ocspReply replyData: jsonReply] intValue]; // The ocspStatus can have one of these values: // -1: The ARG1 does not contain a valid OCSP reply. // 0: Successful - Response has valid confirmations.. // 1: Malformed request - Illegal confirmation request. // 2: Internal error - Internal error in issuer. // 3: Try later - Try again later. // 4: Not used - This value is never returned. // 5: Sig required - Must sign the request. // 6: Unauthorized - Request unauthorized. if (ocspStatus < 0) { NSLog(@"%@",@"Invalid OCSP reply."); return; } NSLog(@"%@%d",@"Overall OCSP Response Status: ",ocspStatus); // Let's examine the OCSP response (in JSON). jsonReply.EmitCompact = NO; NSLog(@"%@",[jsonReply Emit]); // The JSON reply looks like this: // (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml // to generate JSON parsing code.) // { // "responseStatus": 0, // "responseTypeOid": "1.3.6.1.5.5.7.48.1.1", // "responseTypeName": "ocspBasic", // "response": { // "responderIdChoice": "KeyHash", // "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=", // "dateTime": "20180803193937Z", // "cert": [ // { // "hashOid": "1.3.14.3.2.26", // "hashAlg": "SHA-1", // "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=", // "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=", // "serialNumber": "6175535D87BF94B6", // "status": 0, // "thisUpdate": "20180803193937Z", // "nextUpdate": "20180810193937Z" // } // ] // } // } // // The certificate status: int certStatus = -1; if ([jsonReply HasMember: @"response.cert[0].status"] == YES) { certStatus = [[jsonReply IntOf: @"response.cert[0].status"] intValue]; } // Possible certStatus values are: // -1: No status returned. // 0: Good // 1: Revoked // 2: Unknown. NSLog(@"%@%d",@"Certificate Status: ",certStatus); |
© 2000-2024 Chilkat Software, Inc. All Rights Reserved.