Java Bouncy Castle OCSP Url

Question

Я использую bouncy castle 1.48 для проверки проверки сертификата с помощью OCSP. Он работает хорошо. Но я использую Ocsp Url как статическую переменную, и я хочу ее прочитать из сертификата. Url написано в сертификате, как Authority Info Access

[1]Authority Info Access 
Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1) 
Alternative Name: 
     URL=http://ocsp.mydomain 

Я получил org.bouncycastle.asn1.x509.AuthorityInformationAccess объект из сертификата

byte[] octetBytes = certificate.getExtensionValue(X509Extension.authorityInfoAccess.getId()); 
ASN1InputStream octetStream = new ASN1InputStream(octetBytes); 
byte[] encoded = X509ExtensionUtil.fromExtensionValue(octetBytes).getEncoded(); 
ASN1Sequence seq = ASN1Sequence.getInstance(ASN1Primitive.fromByteArray(encoded)); 
AuthorityInformationAccess access = AuthorityInformationAccess.getInstance(seq); 

который пишет AuthorityInformationAccess: Oid(1.3.6.1.5.5.7.48.1), но не могу получить Url оттуда

Answer 1

я нашел способ.

private String getOcspUrl(X509Certificate certificate) throws Exception { 
    byte[] octetBytes = certificate 
      .getExtensionValue(X509Extension.authorityInfoAccess.getId()); 

    DLSequence dlSequence = null; 
    ASN1Encodable asn1Encodable = null; 

    try { 
     ASN1Primitive fromExtensionValue = X509ExtensionUtil 
       .fromExtensionValue(octetBytes); 
     if (!(fromExtensionValue instanceof DLSequence)) 
      return null; 
     dlSequence = (DLSequence) fromExtensionValue; 
     for (int i = 0; i < dlSequence.size(); i++) { 
      asn1Encodable = dlSequence.getObjectAt(i); 
      if (asn1Encodable instanceof DLSequence) 
       break; 
     } 
     if (!(asn1Encodable instanceof DLSequence)) 
      return null; 
     dlSequence = (DLSequence) asn1Encodable; 
     for (int i = 0; i < dlSequence.size(); i++) { 
      asn1Encodable = dlSequence.getObjectAt(i); 
      if (asn1Encodable instanceof DERTaggedObject) 
       break; 
     } 
     if (!(asn1Encodable instanceof DERTaggedObject)) 
      return null; 
     DERTaggedObject derTaggedObject = (DERTaggedObject) asn1Encodable; 
     byte[] encoded = derTaggedObject.getEncoded(); 
     if (derTaggedObject.getTagNo() == 6) { 
      int len = encoded[1]; 
      return new String(encoded, 2, len); 
     } 
    } catch (IOException e) { 
     e.printStackTrace(); 
    } 
    return null; 
} 

Answer 2

Это, как я это сделал:

private String getOcspUrlFromCertificate(X509Certificate cert) { 
    byte[] extensionValue = cert.getExtensionValue(X509Extensions.AuthorityInfoAccess.getId()); 

    try { 
     ASN1Sequence asn1Seq = (ASN1Sequence) X509ExtensionUtil.fromExtensionValue(extensionValue); // AuthorityInfoAccessSyntax 
     Enumeration<?> objects = asn1Seq.getObjects(); 

     while (objects.hasMoreElements()) { 
      ASN1Sequence obj = (ASN1Sequence) objects.nextElement(); // AccessDescription 
      DERObjectIdentifier oid = (DERObjectIdentifier) obj.getObjectAt(0); // accessMethod 
      DERTaggedObject location = (DERTaggedObject) obj.getObjectAt(1); // accessLocation 

      if (location.getTagNo() == GeneralName.uniformResourceIdentifier) { 
       DEROctetString uri = (DEROctetString) location.getObject(); 
       String str = new String(uri.getOctets()); 
       if (oid.equals(X509ObjectIdentifiers.id_ad_ocsp)) { 
        return str; 
       } 
      } 
     } 
    } catch (Exception e) { 
     logger.error("Error", e); 
    } 

    return null; 
}