Certificate chain validation using java, checking revokation and OCSP status

Question

I am new to the world of PKI, certificates in general. I am writing a service which needs to validate a chain of certiticates.

The general approach taken is as follows

a) Generate a List of certificates from the data sent

ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(data);

CertPathValidatorResult certPathValidatorResult = null;
try {

  CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
  List<X509Certificate> x509Certificates =
      (List<X509Certificate>) certificateFactory.generateCertificates(byteArrayInputStream);

  CertPath certPath = certificateFactory.generateCertPath(x509Certificates);

2. Load the JDK keystore, with something like this //Load the JDK's cacerts keystore file String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar); FileInputStream is = new FileInputStream(filename); KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType()); String password = "changeit"; keystore.load(is, password.toCharArray());

3.  CertPathValidator certPathValidator = CertPathValidator.getInstance("PKIX"); PKIXParameters pkixParameters = new PKIXParameters(keystore); //pkixParameters.setRevocationEnabled(false); PKIXParameters certPathValidatorResult = certPathValidator.validate(certPath, pkixParameters);

4. I am assuming if this is not a valid chain it would throw an exception. Would this validation check expired Certificates, Valid Public Key?

5. also I need to be able to find the the OCSP staus of a certificate or check if it is revoked>? How can this be done using the Cryptography API

6. Is the use fo bouncy castle recommended over the API? Does Bouncy castle have a way to check CRL and OCSP status of a certificate?

Thanks for all the pointers and help in advance. Appreciate it.

Best Regards

Answer 1

1. It's correct, you can use CertificateFactory to load certificates chain.
2. If you want validate a chain of certiticates, you don't need a KeyStore. The certificates are validated with the certificate of autority who emit that certificate.
   For example:

ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(chain.getBytes());
CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
List<X509Certificate> x509Certificates = (List<X509Certificate>) certificateFactory.generateCertificates(byteArrayInputStream);
x509Certificates.get(1).verify(x509Certificates.get(0).getPublicKey());

3. In this case you can use it to validate a certificate if you don't know the root ca.
4. You can check the period with

x509Certificates.get(1).getNotBefore()

and

x509Certificates.get(1).getNotAfter()

5. Is important validate the status of certificate.
6. Yes BouncyCastle is great library for it.