7

我正在使用充气城堡离线验证 X509 证书，并且遇到了旧 CRL 的问题。我还没有发现接受过期的 CRL 的可能性，在我看来，如果证书被吊销，它应该在 CRL 到期后保持吊销状态。此外，如果 CRL 为空，我只想接受这一点，此时我无法获得更新的 CRL。

只是为了澄清，这将是用例：

  1. 2015年创建证书，有效期2015-2020
  2. 在 2017 年用 CRL 吊销证书，密钥被盗，只创建了 1 年的 CRL，因为我犯了一个错误或计划滚动并且永远不会解决它
  3. 检查2019年的证书，CRL过期了，bouncy castle再次接受被吊销的证书——这显然不是我想要的

目前我将撤销检查设置为 false 并自己执行检查。我在任何地方都没有在网上找到任何关于此的内容。

这是我的代码：

final X509CertSelector endConstraints = new X509CertSelector();
endConstraints.setSerialNumber(signer.getSID().getSerialNumber());

final PKIXBuilderParameters buildParams = new PKIXBuilderParameters(trustAnchors, endConstraints);
//a CertStore object with Certificates and CRLs
buildParams.addCertStore(certificates);
//currently deactivated
buildParams.setRevocationEnabled(false);

final CertPathBuilder builder = CertPathBuilder.getInstance(SignedFileVerifier.CERTIFICATE_PATH_ALGORITHM, SignedFileVerifier.PROVIDER);
final CertPathBuilderResult result = builder.build(buildParams);

//here I manually check the CRLs, which I don't want to do
checkRevocation(result.getCertPath().getCertificates(), certificates, trustAnchors);

//if this passes I return the found certificate
return (X509Certificate) result.getCertPath().getCertificates().get(0);

确切的例外是：

Caused by: org.bouncycastle.jce.exception.ExtCertPathValidatorException: No CRLs found for issuer "cn=goodOldIssuerCA0,ou=jUnit Test Issuer,o=BOGO Company,c=AT"
    at org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCertA(Unknown Source)
    at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(Unknown Source)
    at org.bouncycastle.jce.provider.PKIXCertPathBuilderSpi.build(Unknown Source)
    at org.bouncycastle.jce.provider.PKIXCertPathBuilderSpi.build(Unknown Source)
    ...
4

2 回答 2

3

基本上我的整个问题都发生在PKIXCRLUtil#findCRLspackage中的方法中org.bouncycastle.jce.provider。这是用于加载 CRL 的方法，并始终在此处检查日期：

if (crl.getNextUpdate().after(validityDate))
    {
        X509Certificate cert = crlselect.getCertificateChecking();

        if (cert != null)
            {
            if (crl.getThisUpdate().before(cert.getNotAfter()))
            {
                finalSet.add(crl);
            }
        }
        else
        {
            finalSet.add(crl);
        }
}

我最终使用的代码如下。基本上，我首先将所有公钥按其名称组合到一个映射中（也许序列号会更好？），然后遍历我在链中拥有的所有证书。首先我得到证书颁发者的公钥，因为我需要它来验证 CRL 来自同一个颁发者。然后我创建一个X509CRLSelector发行者并通过该发行者加载所有 CRL。然后我遍历在商店中找到的 CRL，通过颁发者公钥验证它们，检查证书是否被吊销，如果是这种情况则抛出异常。在我当前的实现中，如果没有找到 CRL 就可以了，这可以通过检查selectedCRLs不为空来添加。

private void checkRevocation(final List<X509Certificate> certificates, final CertStore revocationLists, final Set<TrustAnchor> trustAnchors) throws GeneralSecurityException {
    final Map<String, PublicKey> publicKeyMap = extractPublicKeys(certificates, trustAnchors);

    //check the whole chain, we don't know if the issuer or the signer was revoked
    for(final X509Certificate certificate : certificates){
        final X500Principal issuerX500Principal = certificate.getIssuerX500Principal();

        //get the issuer of this certificate
        final PublicKey issuerPublicKey = publicKeyMap.get(issuerX500Principal.getName());

        if(issuerPublicKey == null){
            throw new GeneralSecurityException("Unable to find issuer for certificate '" + certificate.getSubjectX500Principal() + "'");
        }

        final X509CRLSelector crlSelector = new X509CRLSelector();
        //we only use the issuer, not the date or time, don't want CRLs to expire
        crlSelector.addIssuer(issuerX500Principal);

        //get all CRLs that match this issuer
        final Collection<? extends CRL> selectedCRLs = revocationLists.getCRLs(crlSelector);
        for(final CRL crl : selectedCRLs){
            final X509CRL x509CRL = (X509CRL)crl;
            //check first if the crl is really published by the issuer
            x509CRL.verify(issuerPublicKey);

            //check if the current certificate was revoked
            final X509CRLEntry revokedCertificate = x509CRL.getRevokedCertificate(certificate);

            //if we found a revoked certificate throw an exception
            if(revokedCertificate != null){
                throw new GeneralSecurityException(String.format("Unable to use certificate '%1$s', revocation after %2$tF %2$tT, reason: %3$s",
                        certificate.getSubjectX500Principal(), revokedCertificate.getRevocationDate(), revokedCertificate.getRevocationReason()));
            }
        }
    }
}

private Map<String, PublicKey> extractPublicKeys(final List<X509Certificate> certificates, final Set<TrustAnchor> trustAnchors) {
    final Map<String, PublicKey> certificateMap = new HashMap<>();
    for(final X509Certificate certificate : certificates){
        certificateMap.put(certificate.getSubjectX500Principal().getName(), certificate.getPublicKey());
    }

    for(final TrustAnchor trustAnchor : trustAnchors){
        final X509Certificate certificate = trustAnchor.getTrustedCert();
        certificateMap.put(certificate.getSubjectX500Principal().getName(), certificate.getPublicKey());
    }
    return certificateMap;
}
于 2018-05-28T13:45:20.883 回答
1

完全禁用 CRL 检查。不，我不是在开玩笑。安全界的普遍共识是撤销被打破。现代浏览器甚至不费心检查 CRL。如果您可以在您的浏览器中启用严格的 CRL 检查（许多甚至不再允许您），那么您会发现大部分网络都无法访问。

于 2018-05-27T04:51:35.257 回答