Examples with CertificateExpiredException java.security.cert.CertificateExpiredException used on opensource projects

Example 46 with CertificateExpiredException

use of java.security.cert.CertificateExpiredException in project oxAuth by GluuFederation.

the class GenericCertificateVerifier method validate.

@Override
public ValidationStatus validate(X509Certificate certificate, List<X509Certificate> issuers, Date validationDate) {
    X509Certificate issuer = issuers.get(0);
    ValidationStatus status = new ValidationStatus(certificate, issuer, validationDate, ValidatorSourceType.APP, CertificateValidity.UNKNOWN);
    try {
        Principal subjectX500Principal = certificate.getSubjectX500Principal();
        try {
            log.debug("Validity status is valid for '" + subjectX500Principal + "'");
            certificate.checkValidity(validationDate);
            status.setValidity(CertificateValidity.VALID);
        } catch (CertificateExpiredException ex) {
            log.debug("Validity status is expied for '" + subjectX500Principal + "'");
        } catch (CertificateNotYetValidException ex) {
            log.warn("Validity status is not yet valid for '" + subjectX500Principal + "'");
        }
    } catch (Exception ex) {
        log.error("CRL exception: ", ex);
    }
    return status;
}

Example 47 with CertificateExpiredException

use of java.security.cert.CertificateExpiredException in project cloudstack by apache.

the class RootCACustomTrustManager method checkClientTrusted.

@Override
public void checkClientTrusted(final X509Certificate[] certificates, final String s) throws CertificateException {
    if (LOG.isDebugEnabled()) {
        printCertificateChain(certificates, s);
    }
    final X509Certificate primaryClientCertificate = (certificates != null && certificates.length > 0 && certificates[0] != null) ? certificates[0] : null;
    String exceptionMsg = "";
    if (authStrictness && primaryClientCertificate == null) {
        throw new CertificateException("In strict auth mode, certificate(s) are expected from client:" + clientAddress);
    } else if (primaryClientCertificate == null) {
        LOG.info("No certificate was received from client, but continuing since strict auth mode is disabled");
        return;
    }
    // Revocation check
    final BigInteger serialNumber = primaryClientCertificate.getSerialNumber();
    if (serialNumber == null || crlDao.findBySerial(serialNumber) != null) {
        final String errorMsg = String.format("Client is using revoked certificate of serial=%x, subject=%s from address=%s", primaryClientCertificate.getSerialNumber(), primaryClientCertificate.getSubjectDN(), clientAddress);
        LOG.error(errorMsg);
        exceptionMsg = (StringUtils.isEmpty(exceptionMsg)) ? errorMsg : (exceptionMsg + ". " + errorMsg);
    }
    // Validity check
    try {
        primaryClientCertificate.checkValidity();
    } catch (final CertificateExpiredException | CertificateNotYetValidException e) {
        final String errorMsg = String.format("Client certificate has expired with serial=%x, subject=%s from address=%s", primaryClientCertificate.getSerialNumber(), primaryClientCertificate.getSubjectDN(), clientAddress);
        LOG.error(errorMsg);
        if (!allowExpiredCertificate) {
            throw new CertificateException(errorMsg);
        }
    }
    // Ownership check
    boolean certMatchesOwnership = false;
    if (primaryClientCertificate.getSubjectAlternativeNames() != null) {
        for (final List<?> list : primaryClientCertificate.getSubjectAlternativeNames()) {
            if (list != null && list.size() == 2 && list.get(1) instanceof String) {
                final String alternativeName = (String) list.get(1);
                if (clientAddress.equals(alternativeName)) {
                    certMatchesOwnership = true;
                }
            }
        }
    }
    if (!certMatchesOwnership) {
        final String errorMsg = "Certificate ownership verification failed for client: " + clientAddress;
        LOG.error(errorMsg);
        exceptionMsg = (StringUtils.isEmpty(exceptionMsg)) ? errorMsg : (exceptionMsg + ". " + errorMsg);
    }
    if (authStrictness && StringUtils.isNotEmpty(exceptionMsg)) {
        throw new CertificateException(exceptionMsg);
    }
    if (LOG.isDebugEnabled()) {
        if (authStrictness) {
            LOG.debug("Client/agent connection from ip=" + clientAddress + " has been validated and trusted.");
        } else {
            LOG.debug("Client/agent connection from ip=" + clientAddress + " accepted without certificate validation.");
        }
    }
    if (primaryClientCertificate != null && activeCertMap != null && StringUtils.isNotEmpty(clientAddress)) {
        activeCertMap.put(clientAddress, primaryClientCertificate);
    }
}