Add resilient OCSP certificate revocation checker by madislm · Pull Request #99 · web-eid/web-eid-authtoken-validation-java

madislm · 2026-02-02T08:21:06Z

AUT-2514

Signed-off-by: Madis Jaagup Laurson madisjaagup.laurson@nortal.com

Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

…OCSP certificate revocation checker Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

…n into eu.webeid.ocsp.service

mrts · 2026-03-20T13:55:35Z

src/main/java/eu/webeid/ocsp/service/FallbackOcspService.java

+                    throw new OCSPCertificateException("Responder certificate from the OCSP response is not equal to " +
+                        "the configured fallback OCSP responder certificate");
+                }
+                return;


The early return is not wrong, but it would perhaps be clearer to structure pinned and trusted CA validation as explicit branches:

if (trustedResponderCertificate != null) { validatePinnedResponderCertificate(responderCertificate); } else { validateResponderCertificateAgainstTrustedCa(responderCertificate, now); }

Created separate branches and methods.

mrts · 2026-03-20T13:57:11Z

src/main/java/eu/webeid/ocsp/service/OcspService.java

    void validateResponderCertificate(X509CertificateHolder cert, Date now) throws AuthTokenException;

+    default FallbackOcspService getFallbackService() {
+        return null;


Returning null from the default getFallbackService() is not ideal as absence of a fallback is part of the contract. Optional would express that perhaps more clearly.

Now using Optional for that purpose.

mrts · 2026-03-20T16:06:31Z

src/main/java/eu/webeid/ocsp/OcspCertificateRevocationChecker.java

Shouldn't you catch OCSPClientException here as well, is the IOException catch still needed?

Added OCSPClientException; IOException is thrown by getCertificateId.

mrts · 2026-03-20T18:40:42Z

src/main/java/eu/webeid/ocsp/protocol/OcspResponseValidator.java

                "latest allowed: '" + latestAcceptableTimeSkew + "'", ocspResponderUri);
        }
-        if (thisUpdate.isBefore(minimumValidThisUpdateTime)) {
+        if (!allowThisUpdateInPast && thisUpdate.isBefore(minimumValidThisUpdateTime)) {


allowThisUpdateInPast = true is used in fallback mode, this means accepting indefinitely stale OCSP responses, which is a security risk.

My preference would be that primary OCSP uses the current short age limit and fallback OCSP uses a configurable separate, much larger maxThisUpdateAge (90 days or whatnot) and there is no boolean bypass.

Added a separate fallbackMaxOcspResponseThisUpdateAge parameter and removed the flag.

mrts · 2026-03-20T18:44:38Z

src/main/java/eu/webeid/ocsp/protocol/IssuerCommonName.java

+        Objects.requireNonNull(certificate, "certificate");
+        try {
+            X500Name x500Name = new JcaX509CertificateHolder(certificate).getIssuer();
+            final RDN cn = x500Name.getRDNs(BCStyle.CN)[0];


This will throw ArrayIndexOutOfBoundsException on certificates without CN.

Does not apply after moving to distinguished names.

mrts · 2026-03-20T19:06:52Z

src/main/java/eu/webeid/ocsp/protocol/IssuerCommonName.java

+
+public class IssuerCommonName {
+
+    public static Optional<String> getIssuerCommonName(X509Certificate certificate) {


Using only Common Name seems error-prone, using the full normalized Distinguished Name seems much safer.

For example, in the following (hypothetical) case there would be CN collision, but DN would work:

CN=ESTEID2025, O=AS Sertifitseerimiskeskus, C=EE CN=ESTEID2025, O=Zetes Estonia OÜ, C=EE

This applies to all locations where CN is used for lookup like OcspServiceProvider, AiaOcspService, FallbackOcspServiceConfiguration and AiaOcspServiceConfiguration.

Now using DNs for all lookups that used CNs.

mrts · 2026-03-20T19:31:41Z

src/main/java/eu/webeid/ocsp/exceptions/OCSPClientException.java

+
+public class OCSPClientException extends RuntimeException {
+
+    private byte[] responseBody;


The fields should be final/immutable.

The fields are now final.

mrts · 2026-03-20T20:09:20Z

src/main/java/eu/webeid/ocsp/exceptions/OCSPClientException.java

+
+package eu.webeid.ocsp.exceptions;
+
+public class OCSPClientException extends RuntimeException {


OCSPClientException looks more like a checked exception than a RuntimeException. Failures are part of the OcspClient contract and callers are supposed to handle them rather than let them escape accidentally.

Suggested change

public class OCSPClientException extends RuntimeException {

public class OCSPClientException extends Exception {

Made it an Exception instead of a RuntimeException.

…tificateRevocationChecker

…Service

…nd related tests

…s final

…llows old OCSP responses

…vice lookup

…SP request

madislm force-pushed the AUT-2514 branch 2 times, most recently from 0e6161a to e927de2 Compare February 2, 2026 09:16

madislm force-pushed the AUT-2514 branch 5 times, most recently from e96286a to a324e96 Compare February 10, 2026 08:29

madislm force-pushed the AUT-2514 branch from e9e03d1 to d917099 Compare February 18, 2026 10:56

mrts force-pushed the WE2-1030-use-platform-ocsp branch from 10a405b to 74e7af2 Compare February 20, 2026 16:55

madislm force-pushed the AUT-2514 branch 2 times, most recently from 9cdcc89 to ef4ae35 Compare February 27, 2026 09:35

mrts force-pushed the WE2-1030-use-platform-ocsp branch from 74e7af2 to f55d636 Compare March 6, 2026 18:37

aarmam and others added 16 commits March 18, 2026 10:52

AUT-2473 Add ResilientOcspCertificateRevocationChecker

9e042cd

Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

AUT-2473 Separate handling unknown status from revoked for resilient …

a57ce1c

…OCSP certificate revocation checker Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

AUT-2510 Disable thisUpdate in the past check for fallback OCSP service

46dc128

AUT-2552 Collect failed requests, add resilient OCSP specific exceptions

59f8c2c

AUT-2511 Collect failed retry results

b98e45f

AUT-2547 Add support for two fallbacks

d299d3d

AUT-2597 Update Resilience4j to version 2.3.0

42dd199

AUT-2597 Improve collecting failed requests

1aafc02

AUT-2597 Add tests for ResilientOcspCertificateRevocationChecker

1f07eb6

AUT-2597 Use issuer CNs to get fallback OCSP services

2c280b2

AUT-2597 Move FallbackOcspService and FallbackOcspServiceConfiguratio…

3c3e117

…n into eu.webeid.ocsp.service

AUT-2597 Reorganize code in ResilientOcspCertificateRevocationChecker

8400be7

AUT-2597 Add a note regarding recursive fallbacks

f7c137d

AUT-2623 Fix broken tests

e7e768c

AUT-2623 Fix and improve tests

3c27b2a

AUT-2618 Separate issuer certificates from OCSP responder certificates

6d023f2

madislm force-pushed the AUT-2514 branch from 644f3a4 to 6d023f2 Compare March 18, 2026 09:00

mrts requested changes Mar 20, 2026

View reviewed changes

mrts reviewed Mar 20, 2026

View reviewed changes

madislm added 3 commits March 26, 2026 12:28

AUT-2562 Add data to RevocationInfo list returned by ResilientOcspCer…

5edbdd7

…tificateRevocationChecker

AUT-2677 Restructure responder certificate validation in FallbackOcsp…

f528135

…Service

AUT-2677 Fix exception handling in OcspCertificateRevocationChecker a…

8e45594

…nd related tests

madislm force-pushed the AUT-2514 branch from 630bca3 to 8e45594 Compare March 27, 2026 09:03

madislm added 5 commits March 30, 2026 15:05

AUT-2677 Make OCSPClientException a checked exception, make its field…

612ad2d

…s final

AUT-2677 Use Optional for getFallbackService

93fa0b4

AUT-2677 Add max this update age to fallback instead of a flag that a…

bfc9810

…llows old OCSP responses

AUT-2677 Use distinguished names instead of common names for OCSP ser…

8e797fb

…vice lookup

AUT-2709 Collect response time and request duration after a failed OC…

b04c3e6

…SP request


		public class IssuerCommonName {

		public static Optional<String> getIssuerCommonName(X509Certificate certificate) {


		public class OCSPClientException extends RuntimeException {

		private byte[] responseBody;


		package eu.webeid.ocsp.exceptions;

		public class OCSPClientException extends RuntimeException {

Conversation

madislm commented Feb 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

madislm Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mrts Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

madislm Mar 27, 2026 •

edited

Loading

mrts Mar 20, 2026 •

edited

Loading