Package com.sun.identity.security.cert

Class AMCRLStore

  • public class AMCRLStore
extends AMCertStore
    The class is used to manage crl store in LDAP server This class does get crl and update crl with CRLDistribution PointsExtension in client certificate or IssuingDistribution PointExtension in CRL. This class should be used in order to manage CRL store in LDAP 
     id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::=  { id-ce 31 }

 RLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint

 DistributionPoint ::= SEQUENCE {
        distributionPoint       [0]     DistributionPointName OPTIONAL,
        reasons                 [1]     ReasonFlags OPTIONAL,
        cRLIssuer               [2]     GeneralNames OPTIONAL }

 DistributionPointName ::= CHOICE {
        fullName                [0]     GeneralNames,
        nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

 ReasonFlags ::= BIT STRING {
        unused                  (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
        privilegeWithdrawn      (7),
        aACompromise            (8) }

    Fetching CRLs named by an untrusted certificate

    The distribution point comes out of the certificate being validated, so this class will make an outbound request to a location someone else chose (GHSA-g5vw-v384-gw9v). Callers are expected to have established that the certificate chains to a configured trust anchor first — Cert.doJCERevocationValidation and CRLValidator both do.

    That check is deliberately not repeated here. Callers validate a whole chain once and then ask for the CRL of each certificate in it; re-validating each certificate on its own would be a stricter test that rejects the intermediates and the root of a chain that has already passed, and revocation would then fail closed. The protection that does live here applies to every caller, in-tree or not:

    • the address policy (isCrlDpUrlAllowed(java.lang.String)) on both the HTTP and the LDAP sink, applied again to every redirect target and never following one out of https;
    • a AMCRLStore.FetchBudget — a size cap, a wall-clock budget and a cap on how many locations are tried, all belonging to the certificate rather than to a location or a hop;
    • CRL_DP_PARAM_HOSTS, so the deployment's own HTTP parameters are not posted to a location the certificate chose;
    • validateFetchedCrl(java.security.cert.X509Certificate, java.security.cert.X509CRL, java.security.cert.X509CRL, java.util.Collection<java.security.PublicKey>), so nothing unverified reaches the shared CRL stores.

    So what an out-of-tree caller can still provoke by passing an untrusted certificate is a bounded, address-filtered request to a public address. To also get a CRL stored, it would have to supply a chain in which the CRL's issuer traces to a configured trust anchor through certificates that were each authorised to issue the next — see findIssuerPublicKeys(X509Certificate, X509Certificate[]). That walk is not a full PKIX path validation: it does not check validity dates, name constraints or whether the intermediates are themselves revoked. Pass a chain you have validated.

    • Constructor Detail

      • AMCRLStore

        public AMCRLStore​(AMLDAPCertStoreParameters param)
        Class AMCRLStore is special cased CRL store for LDAP. A AMCRLStore instance has to have all the information for ldap and all the access information for CRLDistributionPointExtension and CRLIssuingDistributionPoint Extension
        Parameters:
        param - the LDAP certificate store parameters used to configure this CRL store. The store keeps a copy: changing them afterwards does not affect it.

    • Method Detail

      • getCRL

        public X509CRL getCRL​(X509Certificate certificate)
               throws IOException
        Checks certificate and returns corresponding stored CRL in ldap store
        Parameters:
        certificate - the certificate whose CRL should be retrieved
        Returns:
        the stored CRL for the certificate's issuer, or null if none was found. See getCRL(X509Certificate, X509Certificate[]) for what the caller still has to check about it.
        Throws:
        IOException - if an error occurs while accessing the CRL store

      • getCRL

        public X509CRL getCRL​(X509Certificate certificate,
                      X509Certificate[] chain)
               throws IOException
        Checks certificate and returns corresponding stored CRL in ldap store.

        Same as getCRL(X509Certificate), but the certificate chain lets a CRL issued by an intermediate CA be verified and therefore stored. Without it such a CRL can only be used for the current validation and is refetched next time.

        Parameters:
        certificate - the certificate whose CRL should be retrieved
        chain - the chain the certificate was presented with. The caller must have validated it; a key taken from it decides whether a fetched CRL may enter the shared CRL stores. May be null.
        Returns:
        the CRL for the certificate's issuer, or null if none was found.

        Two things about it are the caller's to check. It is not necessarily one that could be verified locally — see AMCRLStore.CrlUpdateDecision.USE_ONLY — so a caller that does not hand it to PKIX must verify it itself. And it may be past its nextUpdate: when the refresh from the distribution point fails or is rejected, the CRL already held is returned rather than nothing, since a superseded revocation list is still better evidence than none. PKIX drops an expired CRL by itself, but a caller that asks it CRL.isRevoked(java.security.cert.Certificate) directly has to check X509CRL.getNextUpdate() first.

        Throws:
        IOException - if an error occurs while accessing the CRL store

      • getCRLFromCache

        public X509CRL getCRLFromCache​(X509Certificate certificate)
        Checks certificate and returns corresponding stored CRL in cached CRL store.
        Parameters:
        certificate - the certificate whose issuer is used to look up the cached CRL
        Returns:
        Cached CRL information about the certificate.

      • updateCRLCache

        public void updateCRLCache​(X509Certificate certificate,
                           X509CRL crl)
        Checks certificate and update CRL in cached CRL store.
        Parameters:
        certificate - the certificate whose issuer identifies the cache entry
        crl - the CRL to store in the cache, or null to remove the cached entry

      • getCRL

        public static X509CRL getCRL​(AMLDAPCertStoreParameters ldapParam,
                             X509Certificate cert,
                             String... attrNames)
        It gets the new CRL from ldap server. If it is ldap URI, the URI has to be a dn that can be accessed with ldap anonymous bind. (example : ldap://server:port/uid=ca,o=company.com) This dn entry has to have CRL in attribute certificaterevocationlist or certificaterevocationlist;binary.

        if attrNames does only contain one value the ldap search filter will be (attrName=Value_of_the_corresponding_Attribute_from_SubjectDN) e.g. SubjectDN of issuer cert 'C=BE, CN=Citizen CA, serialNumber=201007' attrNames is 'CN', search filter used will be (CN=Citizen CA)

        if attrNames does contain serveral values the ldap search filter value will be a comma separated list of name attribute values, the search attribute will be 'cn' (cn="attrNames[0]=Value_of_the_corresponding_Attribute_from_SubjectDN, attrNames[1]=Value_of_the_corresponding_Attribute_from_SubjectDN")

        e.g. SubjectDN of issuer cert 'C=BE, CN=Citizen CA, serialNumber=201007' attrNames is {"CN","serialNumber"}, search filter used will be (cn=CN=Citizen CA,serialNumber=201007)

        The order of the values of attrNames matter as they must match the value of the 'cn' attribute of a crlDistributionPoint entry in the directory server

        Parameters:
        ldapParam - the LDAP certificate store parameters used to connect to the store
        cert - the certificate whose issuer CRL should be retrieved
        attrNames - the attribute names from the subjectDN of the issuer cert used to build the search filter
        Returns:
        the CRL retrieved for the certificate's issuer, or null if none was found