be.fgov.ehealth.etee.crypto.crl
Interface CRLChecker

public interface CRLChecker

Service to verify certificate revocation status using CRLs.

Method Summary

CryptoResult<CRLData>	validate(java.security.cert.X509Certificate cert) Extracts the CRL distribution points from the certificate (if available) and checks the certificate revocation status against the CRLs coming from the distribution points.
CryptoResult<CRLData>	validate(java.security.cert.X509Certificate cert, java.security.cert.CertStore certStore) Extracts the CRL distribution points from the certificate (if available) and checks the certificate revocation status against the CRLs coming from the distribution points.

Method Detail

validate

CryptoResult<CRLData> validate(java.security.cert.X509Certificate cert)

Extracts the CRL distribution points from the certificate (if available) and checks the certificate revocation status against the CRLs coming from the distribution points. Supports HTTP, HTTPS, FTP and LDAP based URLs.

Parameters:

cert - the certificate to be checked for revocation

Returns:

result of revocationcheck (flag revoked and evidence used)

validate

CryptoResult<CRLData> validate(java.security.cert.X509Certificate cert,
                               java.security.cert.CertStore certStore)

Extracts the CRL distribution points from the certificate (if available) and checks the certificate revocation status against the CRLs coming from the distribution points. Supports HTTP, HTTPS, FTP and LDAP based URLs.
If a certStore is given, CRLs will only be downloaded if no acceptable CRL is found in the store. The certStore should also contain the issuer of the certificate for signature validation on the CRL. Failure to do so will result in a notificationWarning: #CRL_TRUST_NOT_VERIFIED

Parameters:

cert - the certificate to be checked for revocation

certStore - contains crls and certificates that can be used for the revocationcheck of the given certificate

Returns:

result of revocationcheck (status certificate and evidence used)