如何从 X509Certificate 对象解析 AuthoritiyInformation

Question

我想从给定的 X509Certificate 对象中检索 OCSP 信息。由于我不知道如何解析这些信息，所以我在这里问这个问题。

这是我目前得到的：

X509Certificate x509cert = ... //The Certificate
ASN1Primitive obj = ASN1Primitive.fromByteArray(x509cert
                            .getExtensionValue(Extension.authorityInfoAccess
                                    .getId()));
AuthorityInformationAccess aia = AuthorityInformationAccess.getInstance(obj);

抛出异常：

java.security.cert.CertificateParsingException: java.lang.IllegalArgumentException: unknown object in getInstance: org.bouncycastle.asn1.DEROctetString

如何将 ASN1Primitive 解析为有效的 DEROctetString 以取得进展？

例子中ASN1Primitive的值为：

3032303006082b060105050730018624687474703a2f2f6f6373702e616368656c6f732e64653a383038302f6f6373702f65676b

在我看来是一个有效值。

Answer 1

您可以使用 ASN1InputStream

构建 DEROctetString

byte[] authInfoAccessExtensionValue = x509cert.getExtensionValue(X509Extension.authorityInfoAccess.getId());
ASN1InputStream ais1 = new ASN1InputStream(new ByteArrayInputStream(authInfoAccessExtensionValue ));
DEROctetString oct = (DEROctetString) (ais1.readObject());
ASN1InputStream ais2 = new ASN1InputStream(oct.getOctets());
AuthorityInformationAccess authorityInformationAccess = AuthorityInformationAccess.getInstance(ais2.readObject());

尝试使用此代码获取 X509Certificate 中的 OCSP URI 元数据。代码摘自SD-DSS项目的classOnlineOCSPSource（略有修改）

public String getAccessLocation(X509Certificate certificate) throws IOException {

    final ASN1ObjectIdentifier ocspAccessMethod = X509ObjectIdentifiers.ocspAccessMethod;
    final byte[] authInfoAccessExtensionValue = certificate.getExtensionValue(X509Extension.authorityInfoAccess.getId());
    if (null == authInfoAccessExtensionValue) {

        return null;
    }
    ASN1InputStream ais1 = null;
    ASN1InputStream ais2 = null;
    try {

        final ByteArrayInputStream bais = new ByteArrayInputStream(authInfoAccessExtensionValue);
        ais1 = new ASN1InputStream(bais);
        final DEROctetString oct = (DEROctetString) (ais1.readObject());
        ais2 = new ASN1InputStream(oct.getOctets());
        final AuthorityInformationAccess authorityInformationAccess = AuthorityInformationAccess.getInstance(ais2.readObject());

        final AccessDescription[] accessDescriptions = authorityInformationAccess.getAccessDescriptions();
        for (AccessDescription accessDescription : accessDescriptions) {

            final boolean correctAccessMethod = accessDescription.getAccessMethod().equals(ocspAccessMethod);
            if (!correctAccessMethod) {

                continue;
            }
            final GeneralName gn = accessDescription.getAccessLocation();
            if (gn.getTagNo() != GeneralName.uniformResourceIdentifier) {
                //Not a uniform resource identifier
                continue;
            }
            final DERIA5String str = (DERIA5String) ((DERTaggedObject) gn.toASN1Primitive()).getObject();
            final String accessLocation = str.getString();

            return accessLocation;
        }
        return null;

    } finally {
        ais1.close();
        ais2.close();
    }
}

Answer 2

在 Bouncy Castle 1.57 中，无需创建中介 ASN1Primitive。您只需使用 org.bouncycastle.asn1.x509.Extension 和 org.bouncycastle.x509.extension.X509ExtensionUtil classes:

即可获得扩展名

X509Certificate cert = // the certificate

// get Authority Information Access extension
byte[] extVal = cert.getExtensionValue(Extension.authorityInfoAccess.getId());
AuthorityInformationAccess aia = AuthorityInformationAccess.getInstance(X509ExtensionUtil.fromExtensionValue(extVal));

然后你可以使用aia对象：

AccessDescription[] descriptions = aia.getAccessDescriptions();
for (AccessDescription ad : descriptions) {
    // ...
}

你也可以在以前的版本中这样做，但是对于版本 <= 1.47 我相信 Extension class 不存在，你应该使用 org.bouncycastle.asn1.x509.X509Extension 代替（我认为 org.bouncycastle.x509.extension.X509ExtensionUtil 是一样的）。

如何从 X509Certificate 对象解析 AuthoritiyInformation

How to parse AuthoritiyInformation from X509Certificate object

java

bouncycastle

x509certificate