Validate certificate using OCSP protocol.`

Question

Hi all,
I'm doing an project using RSA SID 8000 that stores customer certificate, when customer using certificate stored in that Token for singing/encrypting... i must verify it whether it validated or not.
I searching on Google and write my apps:
My program:
1- read certifcate from token card
2- read CA certificate( get through IE, then export to my local disk)
3- import keystore for uing ssl
But when i run it often display message errors:
Validation failure, cert[-1] :Path does not chain with any of the trust anchors
package pki.ocsp;
import java.security.cert.*;
import java.security.*;
import java.util.*;
import java.io.*;
import sun.security.pkcs11.SunPKCS11;
//Hien tai dang hardcode OCSP Responder Url http://127.0.0.1:80
public class DemOcsp {
private static final String TEST_RESPONDER_URL = "https://10.0.44.13:80";
public static void main(String [] args){
try {           
//String certPath = "D:\\Test\\va\\vaCA.cer";
String caPath = "D:\\Test\\va\\am71cert.cer";
KeyStore cac = null;
String configName = "d:\\cards.cfg";
SunPKCS11 p = new SunPKCS11(configName);
Security.addProvider(p);
char[] pin = { '1', '2', '3', '4', '5', '6' };
//Windows-MY
//cac = KeyStore.getInstance("Windows-MY");
cac = KeyStore.getInstance("PKCS11");
cac.load(null, pin);
X509Certificate clientCert;
clientCert = (X509Certificate) cac.getCertificate("nampx1, [email protected], vn, Vietinbank, Pham xuan nam");
System.setProperty("javax.net.ssl.trustStore", "D:\\Test\\va\\am71keys.jks");
System.setProperty("javax.net.ssl.trustStorePassword ", "Admin01");
X509Certificate caCert = readCert(caPath);
List certList = new Vector();
certList.add(clientCert);
certList.add(caCert);
validateCertPath(certList, caCert, TEST_RESPONDER_URL);
} catch (Exception e){
e.printStackTrace();
private static void validateCertPath(List certList, X509Certificate trustedCert, String responderUrl) {
try {
// Instantiate a CertificateFactory for X.509
CertificateFactory cf = CertificateFactory.getInstance("X.509");
// Extract the certification path from
// the List of Certificates
CertPath cp = cf.generateCertPath(certList);
// Create CertPathValidator that implements the "PKIX" algorithm
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
// Set the Trust anchor
TrustAnchor anchor = new TrustAnchor(trustedCert, null);
// Set the PKIX parameters
PKIXParameters params = new PKIXParameters(Collections.singleton(anchor));
params.setRevocationEnabled(true);
// the list of additional signer certificates for populating the trust store
Security.setProperty("ocsp.enable", "true");
Security.setProperty("ocsp.responderURL", responderUrl);
// Validate and obtain results
try {
PKIXCertPathValidatorResult result =
(PKIXCertPathValidatorResult) cpv.validate(cp, params);
PolicyNode policyTree = result.getPolicyTree();
PublicKey subjectPublicKey = result.getPublicKey();
System.out.println("Certificate validated");
System.out.println("Policy Tree:\n" + policyTree);
System.out.println("Subject Public key:\n" + subjectPublicKey);
} catch (CertPathValidatorException cpve) {
System.out.println("Validation failure, cert["
+ cpve.getIndex() + "] :" + cpve.getMessage());
} catch (NoSuchAlgorithmException e) {
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
} catch (InvalidAlgorithmParameterException e) {
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
} catch (CertificateException e) {
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
private static X509Certificate readCert(String fileName) throws FileNotFoundException, CertificateException {
InputStream is = new FileInputStream(fileName);
BufferedInputStream bis = new BufferedInputStream(is);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) cf.generateCertificate(bis);
return cert;
}

Answer 1

While it may be possible to get the CA certificate from an OCSP response under certain ideal conditions, it would be a bad idea to rely on that for the correct functioning of your application.
First, a CA may delegate a responder to sign responses for it, in which case any certificate in the response would be the responder's, not the CA's.
Second, the responder is not required to send the signing certificate in the response.
The only one true way to validate a certificate and build a chain is described in RFC 5280. Any PKIX-compliant application should adhere to those algorithms.
Edited by: dstutz on Dec 10, 2008 2:07 PM