how to get x 509 certificate status by bouncy cast

问题:

hi all i am trying to get x 509 certificate status by bouncy castle i am following following steps:-

1) Read user Certificate 2) Get path of user certificate to test it is good or revoked 3) Read CA Certificate 4) Read CA Certificate to connect to ocsp responder.."); 5) Generate OCSP Request 6) OCSP Resonder URL 7) Check errors in response:

                // check if response code is other than 200 then throw
                // exception
                if (con.getResponseCode() / 100 != 2) {
                    throw new Exception("***Error***");
                }

                // Get Response
                InputStream in = (InputStream) con.getContent();
                OCSPResp ocspResponse = new OCSPResp(in);

                System.out.println(ocspResponse.getStatus());

// here we are getting response code 6 for all types of user certificates both revoked certificate as well as good certificate. Can anyone help?

回答1:

Status code 6 means the responder does not know about the certID in the request. The code shows some confusion with regards to client, intermediate and root CA certs. A good idea would be to first confirm the responder works using OpenSSL.

openssl ocsp -issuer intermediate-ca.pem -cert client.pem -url http://192.168.3.247/ocsp -no_nonce -text

One problem in the code looks to be you are using GET but not appending the base 64 encoded request to the URI. Other things missing are verifying the signature on the response and checking the nonce value.

EJBCA's OCSP test tool has an example: https://svn.cesecore.eu/svn/ejbca/trunk/ejbca/modules/clientToolBox/src/org/ejbca/core/protocol/ocsp/OCSPUnidClient.java