用Java读取OCSP签名证书时出现异常

Question

I'm currently working on getting a Java application (JRE 1.5+) to talk to a Windows 2008 OCSP Responder, and I'm getting a strange error on trying to read the Responder's signing cert. 我目前正在努力使Java应用程序（JRE 1.5+）与Windows 2008 OCSP响应程序进行通讯，并且在尝试读取响应程序的签名证书时遇到一个奇怪的错误。

I get the following exception on trying to perform an OCSP validation. 我在尝试执行OCSP验证时遇到以下异常。

Caused by: java.security.cert.CertificateParsingException: java.io.IOException: short read on DerValue buffer
    at sun.security.x509.X509CertInfo.<init>(Unknown Source)
    at sun.security.x509.X509CertImpl.parse(Unknown Source)
    at sun.security.x509.X509CertImpl.<init>(Unknown Source)
    at sun.security.provider.certpath.OCSPResponse.<init>(Unknown Source)
    at sun.security.provider.certpath.OCSPChecker.check(Unknown Source)
    ... 6 more
Caused by: java.io.IOException: short read on DerValue buffer
    at sun.security.util.DerValue.getOctetString(Unknown Source)
    at sun.security.x509.Extension.<init>(Unknown Source)
    at sun.security.x509.CertificateExtensions.init(Unknown Source)
    at sun.security.x509.CertificateExtensions.<init>(Unknown Source)
    at sun.security.x509.X509CertInfo.parse(Unknown Source)
    ... 11 more

This suggested there was a problem reading the signing cert, so I tried importing that separately using a method similar to the below: 这表明阅读签名证书时出现问题，因此我尝试使用类似于以下方法的方法分别导入该证书：

    public static List<Certificate> readCerts(String certFile,
        CertificateFactory cf, boolean withCRL) throws Exception {
    FileInputStream fis = new FileInputStream(certFile);
    BufferedInputStream bis = new BufferedInputStream(fis);

    List<Certificate> certs = new LinkedList<Certificate>();

    while (bis.available() > 0) {
        Certificate cert = cf
                .generateCertificate(bis);
        X509Certificate cx509 = (X509Certificate) cert;
        certs.add(cert);
    }

    return certs;
}

which gave me the same error. 这给了我同样的错误。 This only seems to happen with certificates generated from the OCSP Signing template, user certificates can be read fine. 这似乎只发生在从OCSP签名模板生成的证书中，可以很好地读取用户证书。

Has anyone else encountered similar problems with X509 support in Java? 是否有人在Java中使用X509支持遇到类似问题？

Regards, Tom 问候，汤姆

UPDATE: The cert I'm having trouble with is as below: 更新：我遇到的证书如下：

Answer 1

I assume you get your factory like this, 我想你是这样子的

  cf = CertificateFactory.getInstance("X509");

The default X509 factory has many limitations. 默认的X509工厂有很多限制。 It looks like your cert contains an extension the factory doesn't know how to parse. 看来您的证书包含工厂不知道如何解析的扩展名。 If you post the cert, I can help you to identify the offending extension. 如果您发布证书，我可以帮助您确定有问题的扩展名。

EDIT: The offending extension is 编辑：令人讨厌的扩展名是

1.3.6.1.5.5.7.48.1.5 - id-pkix-ocsp-nocheck 1.3.6.1.5.5.7.48.1.5-id-pkix-ocsp-nocheck

The only option is to remove this from the cert with Java built-in JCE. 唯一的选择是使用Java内置JCE将其从证书中删除。 You can also try another JCE like BouncyCastle. 您也可以尝试其他的JCE，例如BouncyCastle。

用Java读取OCSP签名证书时出现异常

问题描述

1 个解决方案

解决方案1
3 已采纳 2009-09-30 12:08:43

用Java读取OCSP签名证书时出现异常

问题描述

1 个解决方案

解决方案1 3 已采纳 2009-09-30 12:08:43

解决方案1
3 已采纳 2009-09-30 12:08:43