Examples with DecodedNextCaMessage org.xipki.scep.message.DecodedNextCaMessage used on opensource projects

Example 1 with DecodedNextCaMessage

use of org.xipki.scep.message.DecodedNextCaMessage in project xipki by xipki.

the class Client method retrieveNextCaAuthorityCertStore.

private AuthorityCertStore retrieveNextCaAuthorityCertStore(ScepHttpResponse httpResp) throws ScepClientException {
    String ct = httpResp.getContentType();
    if (!ScepConstants.CT_X509_NEXT_CA_CERT.equalsIgnoreCase(ct)) {
        throw new ScepClientException("invalid Content-Type '" + ct + "'");
    }
    CMSSignedData cmsSignedData;
    try {
        cmsSignedData = new CMSSignedData(httpResp.getContentBytes());
    } catch (CMSException ex) {
        throw new ScepClientException("invalid SignedData message: " + ex.getMessage(), ex);
    } catch (IllegalArgumentException ex) {
        throw new ScepClientException("invalid SignedData message: " + ex.getMessage(), ex);
    }
    DecodedNextCaMessage resp;
    try {
        resp = DecodedNextCaMessage.decode(cmsSignedData, responseSignerCerts);
    } catch (MessageDecodingException ex) {
        throw new ScepClientException("could not decode response: " + ex.getMessage(), ex);
    }
    if (resp.getFailureMessage() != null) {
        throw new ScepClientException("Error: " + resp.getFailureMessage());
    }
    Boolean bo = resp.isSignatureValid();
    if (bo != null && !bo.booleanValue()) {
        throw new ScepClientException("Signature is invalid");
    }
    Date signingTime = resp.getSigningTime();
    long maxSigningTimeBias = getMaxSigningTimeBiasInMs();
    if (maxSigningTimeBias > 0) {
        if (signingTime == null) {
            throw new ScepClientException("CMS signingTime attribute is not present");
        }
        long now = System.currentTimeMillis();
        long diff = now - signingTime.getTime();
        if (diff < 0) {
            diff = -1 * diff;
        }
        if (diff > maxSigningTimeBias) {
            throw new ScepClientException("CMS signingTime is out of permitted period");
        }
    }
    if (!resp.getSignatureCert().equals(authorityCertStore.getSignatureCert())) {
        throw new ScepClientException("the signature certificate must not be trusted");
    }
    return resp.getAuthorityCertStore();
}