Examples with CertUtils org.apereo.cas.adaptors.x509.util.CertUtils used on opensource projects

Example 1 with CertUtils

use of org.apereo.cas.adaptors.x509.util.CertUtils in project cas by apereo.

the class AbstractCRLRevocationChecker method check.

@Override
public void check(final X509Certificate cert) throws GeneralSecurityException {
    if (cert == null) {
        throw new IllegalArgumentException("Certificate cannot be null.");
    }
    LOGGER.debug("Evaluating certificate revocation status for [{}]", CertUtils.toString(cert));
    final Collection<X509CRL> crls = getCRLs(cert);
    if (crls == null || crls.isEmpty()) {
        LOGGER.warn("CRL data is not available for [{}]", CertUtils.toString(cert));
        this.unavailableCRLPolicy.apply(null);
        return;
    }
    final List<X509CRL> expiredCrls = new ArrayList<>();
    final List<X509CRLEntry> revokedCrls;
    crls.stream().filter(CertUtils::isExpired).forEach(crl -> {
        LOGGER.warn("CRL data expired on [{}]", crl.getNextUpdate());
        expiredCrls.add(crl);
    });
    if (crls.size() == expiredCrls.size()) {
        LOGGER.warn("All CRLs retrieved have expired. Applying CRL expiration policy...");
        for (final X509CRL crl : expiredCrls) {
            this.expiredCRLPolicy.apply(crl);
        }
    } else {
        crls.removeAll(expiredCrls);
        LOGGER.debug("Valid CRLs [{}] found that are not expired yet", crls);
        revokedCrls = crls.stream().map(crl -> crl.getRevokedCertificate(cert)).filter(Objects::nonNull).collect(Collectors.toList());
        if (revokedCrls.size() == crls.size()) {
            final X509CRLEntry entry = revokedCrls.get(0);
            LOGGER.warn("All CRL entries have been revoked. Rejecting the first entry [{}]", entry);
            throw new RevokedCertificateException(entry);
        }
    }
}