OCSP revocation of client certificates

gtrak：

How to manually check certificate revocation status in Java using OCSP, considering only the client's java.security.cert.X509Certificate? I can't see a clear way to do it.

Alternatively, I can have tomcat do this for me automatically, how do you know your solution is correct?

gtrak：

I found one of the most brilliant solutions:

http://www.docjar.com/html/api/sun/security/provider/certpath/OCSP.java.html

        /**
   54    * This is a class that checks the revocation status of a certificate(s) using
   55    * OCSP. It is not a PKIXCertPathChecker and therefore can be used outside of
   56    * the CertPathValidator framework. It is useful when you want to
   57    * just check the revocation status of a certificate, and you don't want to
   58    * incur the overhead of validating all of the certificates in the
   59    * associated certificate chain.
   60    *
   61    * @author Sean Mullan
   62    */

It has a method check(X509Certificate clientCert, X509Certificate issuerCert) to do this!

Related

OCSP revocation of client certificates

gtrak： How to manually check certificate revocation status in Java using OCSP, considering only the client's java.security.cert.X509Certificate? I can't see a clear way to do it. Alternatively, I can have tomcat do this for me automatically, how do you know yo

OCSP revocation of client certificates

gtrak： How to manually check certificate revocation status in Java using OCSP, considering only the client's java.security.cert.X509Certificate? I can't see a clear way to do it. Alternatively, I can have tomcat do this for me automatically, how do you know yo

OCSP revocation check before completing TLS handshake

Filip Eriksson: I need to use Go as a client to do an OCSP revocation check on the server certificate before completing the TLS handshake, i.e. [start handshake -> get server certificate -> check revocation status -> if revocation aborted], not [start handshak

OCSP revocation check before completing TLS handshake

Filip Eriksson: I need to use Go as a client to do an OCSP revocation check on the server certificate before completing the TLS handshake, i.e. [start handshake -> get server certificate -> check revocation status -> if revocation aborted], not [start handshak

OCSP revocation check before completing TLS handshake

Filip Eriksson: I need to use Go as a client to do an OCSP revocation check on the server certificate before completing the TLS handshake, i.e. [start handshake -> get server certificate -> check revocation status -> if revocation aborted], not [start handshak

What are OCSP signing certificates and keys? Who should issue it?

simple man What are OCSP signing certificates and keys? Who should issue it? So if I have this: Example Root Certification Authority Example Intermediate Certificate Authorities *.example.com (any domain) I only set up OCSP for domain certificates, so the OCSP

Apache client authentication OCSP responder issue

Jabalaski I'm having trouble setting up Apache 2.4.29 on Windows to use a valid OCSP responder for client authentication. Client authentication works fine when the OCSP responder is down. I'm also able to verify that my client certificate status is "good" when

Apache client authentication OCSP responder issue

Jabalaski I'm having trouble setting up Apache 2.4.29 on Windows to use a valid OCSP responder for client authentication. Client authentication works fine when the OCSP responder is down. I'm also able to verify that my client certificate status is "good" when

Apache client authentication OCSP responder issue

Jabalaski I'm having trouble setting up Apache 2.4.29 on Windows to use a valid OCSP responder for client authentication. Client authentication works fine when the OCSP responder is down. I'm also able to verify that my client certificate status is "good" when

Client certificates and identities in iOS

lipoprotein: I have used SecKeyGeneratePairfunctions to generate private and public keys for a Swift based iOS app . I then generated a "Certificate Signing Request" using the iOS CSR and my server replied with a certificate chain in PEM format. I use the foll

Compare client certificates in go

User1791139: My use case looks like I know the client's public certificate and just want to allow them. I have a go server configured based on gin and TLS where a method has been assigned to the property "VerifyPeerCertificate". The function looks like func cu

Compare client certificates in go

User1791139: My use case looks like I know the client's public certificate and just want to allow them. I have a go server configured based on gin and TLS where a method has been assigned to the property "VerifyPeerCertificate". The function looks like func cu

Client certificates and identities in iOS

lipoprotein: I have used SecKeyGeneratePairfunctions to generate private and public keys for a Swift based iOS app . I then generated a "Certificate Signing Request" using the iOS CSR and my server replied with a certificate chain in PEM format. I use the foll

Dynamically request client certificates

user 93353 The web server has settings for requesting client certificates - eg. SSLVerifyClient requireIn Apache, use other settings in IIS etc. If this setting is set, the browser will pop up a dialog asking you to select a certificate. Is it possible to requ

Android and client certificates

Anthony B Code I've been searching for weeks and can't seem to find an answer anywhere. I am trying to do the following for Android. The code is from a C# app I wrote but am porting it to Android. Web endpoints require certificates to be attached to mutual aut

Android and client certificates

Anthony B Code I've been searching for weeks and can't seem to find an answer anywhere. I am trying to do the following for Android. The code is from a C# app I wrote but am porting it to Android. Web endpoints require certificates to be attached to mutual aut

Compare client certificates in go

User1791139: My use case looks like I know the client's public certificate and just want to allow them. I have a go server configured based on gin and TLS where a method has been assigned to the property "VerifyPeerCertificate". The function looks like func cu

Client certificates and identities in iOS

lipoprotein: I have used SecKeyGeneratePairfunctions to generate private and public keys for a Swift based iOS app . I then generated a "Certificate Signing Request" using the iOS CSR and my server replied with a certificate chain in PEM format. I use the foll

Dynamically request client certificates

user 93353 The web server has settings for requesting client certificates - eg. SSLVerifyClient requireIn Apache, use other settings in IIS etc. If this setting is set, the browser will pop up a dialog asking you to select a certificate. Is it possible to requ