代码实现对证书进行CRL校验

孤港猫怨海

于 2025-01-10 15:53:42 发布

阅读量532

点赞数 3

CC 4.0 BY-SA版权

文章标签：安全 ssl java

本文链接：https://blog.youkuaiyun.com/qq_36319965/article/details/145059545

文章目录

CRL介绍

证书吊销列表 (Certificate Revocation List ，简称： CRL) 是 PKI 系统中的一个结构化数据文件，该文件包含了证书颁发机构 (CA) 已经吊销的证书的序列号及其吊销日期。 CRL 文件中还包含证书颁发机构信息、吊销列表失效时间和下一次更新时间，以及采用的签名算法等。

CRL必要性

CRL是保护网络通信安全的重要组成部分。通过及时更新和分发吊销列表，CRL能够有效防止潜在的安全威胁，增强用户对数字证书的信任。

防止伪造和欺诈：CRL用于列出已经被吊销的数字证书，确保用户不在信任已经失效或不再可信的证书，有助于防止伪造和诈骗
保护敏感信息：当证书被吊销的原因可能涉及安全漏洞、密钥泄露或不再信任的实体，CRL能够及时提醒用户，减少数据被盗取的风险。

CRL校验实现

这里用Java实现对证书进行CRL校验，查看证书吊销状态

老规矩，先上BC,POM文件增加依赖引用

	<dependency>
      <groupId>org.bouncycastle</groupId>
      <artifactId>bcprov-jdk15to18</artifactId>
      <version>1.69</version>
    </dependency>

Java代码

import java.io.InputStream;
import java.io.FileInputStream;
import java.net.URL;
import java.security.Security;
import java.security.cert.CertificateFactory;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.util.Date;
import org.bouncycastle.asn1.x509.*;
import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
import org.bouncycastle.jce.provider.BouncyCastleProvider;


/**
 * @description 证书CRL吊销情况验证
 */
public class CertCrlVerify {


    static{
        Security.addProvider(new BouncyCastleProvider());
    }

    public static void main(String[] args) {
        try {
        	//待验证证书
            X509Certificate certificate = loadCertificate("C:\\baidu.crt");

            String crlDistributionPoint = getCRLDistributionPoint(certificate);

            X509CRL crl = downloadCRL(crlDistributionPoint);

            //加载上级证书 /CRL签发证书
            X509Certificate issuerCertificate = loadCertificate("C:\\baidu_ca.crt");

            validateCRL(crl, issuerCertificate);

            checkCertificateRevocation(crl, certificate);

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static X509Certificate loadCertificate(String certPath) throws Exception {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        try (InputStream in = new FileInputStream(certPath)) {
            return (X509Certificate) cf.generateCertificate(in);
        }
    }


    // 获取 CRL 分发点
    private static String getCRLDistributionPoint(X509Certificate certificate) throws Exception {
        byte[] crlDistributionPoint = certificate.getExtensionValue(Extension.cRLDistributionPoints.getId());
        if (crlDistributionPoint == null)
            return null;

        CRLDistPoint distPoint = CRLDistPoint
                .getInstance(JcaX509ExtensionUtils.parseExtensionValue(crlDistributionPoint));

        return ((GeneralNames)distPoint.getDistributionPoints()[0].getDistributionPoint().getName()).getNames()[0].getName().toString();
    }

    private static X509CRL downloadCRL(String crlUrl) throws Exception {
        InputStream crlInputStream = new URL(crlUrl).openStream();
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        return (X509CRL) cf.generateCRL(crlInputStream);
    }

    private static void validateCRL(X509CRL crl, X509Certificate certificate) throws Exception {
        crl.verify(certificate.getPublicKey());
        if (crl.getNextUpdate() != null && crl.getNextUpdate().before(new Date())) {
            throw new Exception("CRL文件已过期");
        }
        if (crl.getThisUpdate().after(new Date())) {
            throw new Exception("CRL未生效");
        }
    }

    private static void checkCertificateRevocation(X509CRL crl, X509Certificate certificate) {
        if (crl.isRevoked(certificate)) {
            System.out.println("证书已被吊销");
        } else {
            System.out.println("证书未被吊销");
        }
    }
}