Learn certificate revocation list

最新推荐文章于 2024-07-20 15:43:15 发布
最新推荐文章于 2024-07-20 15:43:15 发布
阅读量134 收藏
点赞数
文章标签： ldap java 数据库
原文链接：https://my.oschina.net/l1z2g9/blog/357670
版权

为什么80%的码农都做不了架构师？>>>   hot3.png

jks -> p12 p12 -> pem (cer)
pem (cer) -> der

  • Convert a DER crl to PEM openssl crl -CAfile root.pem eCertCA1-10CRL2.pem

  • java keytool
    keytool -trustcacerts -import -alias alias -keystore cacerts.jks -file prod.der
    keytool -v -importkeystore -srckeystore cacerts3.jks -srcalias alias -destkeystore temp.p12 -deststoretype PKCS12 -srcstorepass password -deststorepass 1304478222600604
    keytool -list -v -keystore xxp12 -storepass 112233 -storetype pkcs12

  • export private key
    openssl pkcs12 -in prod.cer -out csr_private.key -nocerts -nodes -password pass:1304478222600604

  • print basic information in p12
    openssl pkcs12 -in xx.p12 -clcerts -nokeys|openssl x509 -text -noout

  • print information in PEM format certificate
    openssl x509 -in certificate.crt -text -noout

  • Export DER and PEM encoded certificate By java

<pre> for(String alias : keyStore.aliases()){ if (keyStore.isKeyEntry(alias)) { certificate = ((X509Certificate) keyStore.getCertificate(alias); } } byte[] cert_der_format = certificate.getEncoded(); // DER Encoded String cert_pem_format = X509Factory.BEGIN_CERT + new String(BASE64EnCoder.encode(cert_der_format)) + "\n" + X509Factory.END_CERT; // PEM Encoded </pre>

By Keytool
keytool -exportcert -alias herong_key -keypass keypass -keystore herong.jks -storepass jkspass -file keytool_crt.der
keytool -exportcert -alias herong_key -keypass keypass -keystore herong.jks -storepass jkspass -rfc -file keytool_crt.pem

  • Methods for getting certificate information
    By keytool
    keytool -list -v -keystore abc.p12 -storepass 1234 -storetype pkcs12 keytool -printcert -file keytool_crt.pem

By openssl
openssl x509 -in keytool_crt.pem -text -noout openssl x509 -in keytool_crt.der -inform der -text -noout

  • Convert p12 file from cert.p12 to cert2.p12 openssl pkcs12 -clcerts -nokeys -in cert.p12 -out usercert.pem // public key
    openssl pkcs12 -nocerts -in cert.p12 -out userkey.pem // private key
    Merge it
    openssl pkcs12 -export -out cert2.p12 -inkey ./userkey.pem -in ./usercert.pem

java ValidateCertUseCRL
DER vs. CRT vs. CER vs. PEM Certificates and How To Convert Them
DER (Distinguished Encoding Rules) certificate encoding
Verify Certificate is revoked by CRL
Using openssl to extract private key
SSL Converter
article-most-common-openssl-commands
normalize your certificate
Certificates: File Format & Conversion
keytool Exporting Certificates in DER and PEM
OpenSSL Validating Certificate Path
"keytool" Viewing Certificates in DER and PEM

  • No way to get CRL path using api from ibm jar, just find keyword CRLDistributionPoints by toString getExtension(new ObjectIdentifier(key)) as below;

    <!-- lang: java -->

    package xx;

import java.io.DataInputStream; import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.io.InputStream; import java.net.URL; import java.net.URLConnection; import java.security.InvalidAlgorithmParameterException; import java.security.InvalidKeyException; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.security.PrivateKey; import java.security.PrivilegedActionException; import java.security.Signature; import java.security.UnrecoverableKeyException; import java.security.cert.CertPath; import java.security.cert.CertPathValidator; import java.security.cert.CertPathValidatorException; import java.security.cert.CertStore; import java.security.cert.Certificate; import java.security.cert.CertificateEncodingException; import java.security.cert.CertificateException; import java.security.cert.CertificateExpiredException; import java.security.cert.CertificateFactory; import java.security.cert.CertificateNotYetValidException; import java.security.cert.CertificateParsingException; import java.security.cert.CollectionCertStoreParameters; import java.security.cert.PKIXCertPathValidatorResult; import java.security.cert.PKIXParameters; import java.security.cert.TrustAnchor; import java.security.cert.X509CRL; import java.security.cert.X509Certificate; import java.util.Collections; import java.util.Enumeration; import java.util.HashSet; import java.util.Iterator; import java.util.List; import java.util.ResourceBundle; import java.util.Set; import java.util.Vector;

import com.ibm.security.util.ObjectIdentifier; import com.ibm.security.x509.Extension; import com.ibm.security.x509.X509CertImpl;

public class Authenticator { private static final String start = "-----BEGIN CERTIFICATE-----\n"; private static final String end = "-----END CERTIFICATE-----";

private ResourceBundle m_configuration = ResourceBundle.getBundle("dh.properties.pkcs12");
private KeyStore m_keyStore = null;
private boolean keyStoreLoaded = false;
private String certificateID = "";
private X509Certificate certificate;
private String password = "";

public KeyStore loadKeyStore(final InputStream inStream, final String password) throws KeyStoreException,
		NoSuchAlgorithmException, CertificateException, IOException {
	String keyStoreType = m_configuration.getString("KEY_STORE_TYPE");
	try {
		m_keyStore = KeyStore.getInstance(keyStoreType);
	} catch (KeyStoreException e) {
		e.printStackTrace();
		throw e;
	}

	System.out.println("load the p12 file");
	if (password != null) {
		this.password = password;
		m_keyStore.load(inStream, password.toCharArray());
	} else {
		m_keyStore.load(inStream, null);
	}

	System.out.println("file is loaded successful");
	keyStoreLoaded = true;

	return m_keyStore;
}

public String getCertificateID() throws KeyStoreException {
	System.out.println("calling getCertificateID()"); //$IGN_Avoid_standard_output_input_error$<working as intended> //$IGN_Remove_System_print_or_println_statements$<working as intended>
	if (!keyStoreLoaded) {
		throw new KeyStoreException("Key store has not been loaded.");
	}

	StringBuffer result = new StringBuffer();

	try {
		Enumeration<String> aliases = m_keyStore.aliases();
		while (aliases.hasMoreElements()) {
			String alias = aliases.nextElement();
			if (m_keyStore.isKeyEntry(alias)) {
				result.append(alias);
			}
		}
	} catch (KeyStoreException e) {
		e.printStackTrace();
		throw e;
	}

	return result.toString();
}

public String getEncocdedCertificate() throws KeyStoreException {
	System.out.println("calling getCertificate()"); //$IGN_Avoid_standard_output_input_error$<working as intended> //$IGN_Remove_System_print_or_println_statements$<working as intended>

	if (!keyStoreLoaded) {
		throw new KeyStoreException("Key store has not been loaded.");
	}

	try {
		certificate = retrieveCertificate();
	} catch (Exception e) {
		e.printStackTrace();
		return "";
	}

	try {
		return start + new String(BASE64Coder.encode(certificate.getEncoded())) + "\n" + end;
	} catch (CertificateEncodingException e) {
		e.printStackTrace();
	}
	return "";
}

private X509Certificate retrieveCertificate() throws KeyStoreException, CertificateExpiredException,
		CertificateNotYetValidException {
	if (!keyStoreLoaded) {
		throw new KeyStoreException("Key store has not been loaded.");
	}

	Certificate cert = m_keyStore.getCertificate(certificateID);

	if (cert == null) {
		//System.out.println("Searching for all aliases");
		Enumeration<String> aliases = m_keyStore.aliases();

		while (aliases.hasMoreElements()) {
			String alias = aliases.nextElement().trim();

			if (m_keyStore.isKeyEntry(alias)) {
				cert = m_keyStore.getCertificate(alias);

				if (cert == null) {
					continue;
				}

			}
		}
	}

	if (cert instanceof X509Certificate) {
		certificate = (X509Certificate) cert;
	}

	try { //$IGN_Place_try_catch_out_of_loop$<working as intended>
		certificate.checkValidity();
	} catch (CertificateExpiredException e) {
		System.out.println(e);
		throw e;
	} catch (CertificateNotYetValidException e) {
		System.out.println(e);
		throw e;
	} //$IGN_Always_use_caught_exception$<working as intended>

	return certificate;
}

public String getSubjectDN() throws CertificateExpiredException, CertificateNotYetValidException, KeyStoreException {
	certificate = retrieveCertificate();
	try {
		String principal = certificate.getSubjectX500Principal().getName();
		return principal;
	} catch (Exception e) {
		String subjectDNName = certificate.getSubjectDN().getName();
		return subjectDNName;
	}
}

public void checkCRL() throws CertPathValidatorException {
	System.out.println("calling checkCRL");
	if (certificate == null) {
		try {
			certificate = retrieveCertificate();
		} catch (Exception e) {
			e.printStackTrace();
		}
	}

	CertPath cp = null;
	Vector<Certificate> certs = new Vector<Certificate>();

	// load the cert to be checked
	certs.add(certificate);

	// handle location of CRL
	//System.out.println("Using the CRL specified in the " + "cert to check the revocation status of: "
	//	+ certs.elementAt(0));
	System.setProperty("com.sun.security.enableCRLDP", "true");

	CertificateFactory cf = null;
	// init cert path
	PKIXParameters params = null;
	try {
		cf = CertificateFactory.getInstance("X509");
		cp = (CertPath) cf.generateCertPath(certs);

		// load the root CA cert 
		String rootCaCert = m_configuration.getString("ROOT_CA_CERT");
		X509Certificate rootCACert = getCertFromFile(rootCaCert);
		System.out.println("rootCACert = " + rootCACert);

		// init trusted certs
		TrustAnchor ta = new TrustAnchor(rootCACert, null);
		Set<TrustAnchor> trustedCerts = new HashSet<TrustAnchor>();
		trustedCerts.add(ta);

		// init PKIX parameters
		params = new PKIXParameters(trustedCerts);
	} catch (CertificateException e) {
		System.out.println(e);
		return;
	} catch (Exception e) {
		System.out.println(e);
		return;
	}

	URL url = null;
	X509CertImpl certificateImpl = (X509CertImpl) certificate;

	Set<String> oids = certificateImpl.getNonCriticalExtensionOIDs();
	for (String key : oids) {
		System.out.println("key = " + key);
		try {
			Extension e = certificateImpl.getExtension(new ObjectIdentifier(key));
			String val = e.toString();
			if (val.indexOf("CRLDistributionPoints") != -1) {
				int start = val.indexOf("http");
				int end = val.indexOf(".crl");
				url = new URL(val.substring(start, end + 4));
			}
		} catch (Exception ex) {
			System.out.println(ex);
		}
	}

	// load the CRL
	try {
		if (url != null) {
			URLConnection connection = url.openConnection();
			connection.setDoInput(true);
			connection.setUseCaches(false);
			DataInputStream inStream = new DataInputStream(connection.getInputStream());
			X509CRL crl = (X509CRL) cf.generateCRL(inStream);
			inStream.close();

			params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(Collections
					.singletonList(crl))));
			params.setRevocationEnabled(true);
		}
	} catch (Exception e) {
		System.out.println("fail to load url " + url);
		System.out.println(e);
	}

	// perform validation
	try {
		CertPathValidator cpv = CertPathValidator.getInstance("PKIX");

		PKIXCertPathValidatorResult cpv_result = (PKIXCertPathValidatorResult) cpv.validate(cp, params);
		X509Certificate trustedCert = (X509Certificate) cpv_result.getTrustAnchor().getTrustedCert();
		if (trustedCert == null) {
			System.out.println("Trusted Cert = NULL");
		} else {
			System.out.println("Trusted CA DN = " + trustedCert.getSubjectDN());
		}
		System.out.println("CERTIFICATE VALIDATION SUCCEEDED");
	} catch (NoSuchAlgorithmException e) {
		System.out.println(e);
	} catch (CertPathValidatorException e) {
		e.printStackTrace();
		throw e;
	} catch (InvalidAlgorithmParameterException e) {
		System.out.println(e);
	}
}

private static X509Certificate getCertFromFile(String path) {
	X509Certificate cert = null;
	try {
		File certFile = new File(path);
		if (!certFile.canRead())
			throw new IOException(" File " + certFile.toString() + " is unreadable");

		FileInputStream fis = new FileInputStream(path);
		CertificateFactory cf = CertificateFactory.getInstance("X509");
		cert = (X509Certificate) cf.generateCertificate(fis);

	} catch (Exception e) {
		System.out.println("Can't construct X509 Certificate. " + e.getMessage());
	}
	return cert;
}

/**
 * GeneralName ::= CHOICE {
 *     otherName                       [0]     OtherName,
 *     rfc822Name                      [1]     IA5String,
 *     dNSName                         [2]     IA5String,
 *     x400Address                     [3]     ORAddress,
 *     directoryName                   [4]     Name,
 *     ediPartyName                    [5]     EDIPartyName,
 *     uniformResourceIdentifier       [6]     IA5String,
 *     iPAddress                       [7]     OCTET STRING,
 *     registeredID                    [8]     OBJECT IDENTIFIER}
 * @see java.security.cert.X509Certificate#getSubjectAlternativeNames()
 * @link http://www.ietf.org/rfc/rfc2459.txt
 */
private String getDomainName() {
	String domainName = "";

	try {
		Iterator it = certificate.getSubjectAlternativeNames().iterator();
		while (it.hasNext()) {
			List list = (List) it.next();
			if (((Integer) list.get(0)).intValue() == 2) {
				domainName = list.get(1).toString();
			}
		}

	} catch (CertificateParsingException e) {
		// TODO Auto-generated catch block
		e.printStackTrace();
	}

	return domainName;
}

private String encodeID(String hkid) {
	Signature signature = null;
	PrivateKey key = null;
	String hashAlgorithm = "SHA-1";
	try {
		key = (PrivateKey) m_keyStore.getKey(getCertificateID(), this.password.toCharArray());
		String signingAlgorithm = "SHA1with" + key.getAlgorithm();
		signature = Signature.getInstance(signingAlgorithm);
	} catch (UnrecoverableKeyException e) {
		System.out.println("UnrecoverableKeyException " + e);
	} catch (KeyStoreException e) {
		System.out.println("KeyStoreException " + e);
	} catch (NoSuchAlgorithmException e) {
		System.out.println("NoSuchAlgorithmException " + e);
	}

	try {
		signature.initSign(key);
		signature.update(hkid.getBytes("UTF-8"));

		byte[] signed = signature.sign();
		MessageDigest digest = null;
		digest = MessageDigest.getInstance(hashAlgorithm);
		//System.out.println("Got MD algorithm");
		String encodedID = new String(BASE64Coder.encode(digest.digest(signed)));
		System.out.println("Done hashing");
		return encodedID;
		//signature.initVerify(certificate.getPublicKey());
		/*if (signature.verify(signed)) {
			
		}*/
	} catch (Exception ignore) {
		System.out.println("Exception " + ignore);
	}
	return "";
}

public boolean checkHKID(String hkid) {
	System.out.println("check HKID");
	String domainName = getDomainName();
	String encodedID = encodeID(hkid);

	System.out.println("domainName = " + domainName);
	System.out.println("encodedID = " + encodedID);

	if (encodedID.length() != domainName.length())
		return false;

	for (int i = 0; i < encodedID.length(); i++)
		if (encodedID.charAt(i) != domainName.charAt(i))
			return false;

	return true;
}

}

------- Class 2 --------- Using it Authenticator auth = new Authenticator(); try { auth.loadKeyStore(in, certPin); } catch (KeyStoreException e) { System.out.println("KeyStoreException error = " + e.getMessage()); errMsg = bundle.getString(ErrMsgConfig.ECERT00007); } catch (NoSuchAlgorithmException e) { System.out.println("NoSuchAlgorithmException error = " + e.getMessage()); errMsg = bundle.getString(ErrMsgConfig.ECERT00019); } catch (CertificateException e) { System.out.println("CertificateException error = " + e.getMessage()); errMsg = bundle.getString(ErrMsgConfig.ECERT00007); } catch (IOException e) { System.out.println("IOException error = " + e.getMessage()); errMsg = bundle.getString(ErrMsgConfig.ECERT00019); }

		String subjectDN = "";

		if (errMsg.length() == 0) {
			try {
				subjectDN = auth.getSubjectDN();
			} catch (CertificateExpiredException e) {
				System.out.println("CertificateExpiredException error = " + e.getMessage());
				errMsg = bundle.getString(ErrMsgConfig.ECERT00002);
			} catch (CertificateNotYetValidException e) {
				System.out.println("CertificateNotYetValidException error = " + e.getMessage());
				errMsg = bundle.getString(ErrMsgConfig.ECERT00003);
			}
		}

		System.out.println("subject: " + subjectDN);
		if (errMsg.length() == 0) {
			try {
				boolean valid = RmiSignVerifier.checkCRL(auth.getEncocdedCertificate());
				if (!valid) {
					errMsg = bundle.getString(ErrMsgConfig.ECERT00014);
				}
			} catch (CertPathValidatorException e) {
				System.out.println("CertPathValidatorException error = " + e.getMessage());
				errMsg = bundle.getString(ErrMsgConfig.ECERT00004);
			}
		}

		if (errMsg.length() == 0) {
			req.setAttribute("errMsg", errMsg);

			List<Rdn> names = new LdapName(subjectDN).getRdns();
			for (Rdn name : names) {
				System.out.println("rdn " + name.getType() + ", " + name.getValue());
				String value = name.getValue().toString();

				if (name.getType().equals("O")) {
					if (value.indexOf("Hongkong Post") == -1) {
						errMsg = bundle.getString(ErrMsgConfig.ECERT00007);
					}

					if (value.indexOf(CERT_TYPE_ORGANIZATIONAL) != -1) {
						certType = CERT_TYPE_ORGANIZATIONAL;
					} else {
						certType = CERT_TYPE_PERSONAL;
					}
				}

				if (name.getType().equals("OU")) {
					Pattern p = Pattern.compile("\\d+");

					if (p.matcher(value).matches()) { // check digit
						if (value.length() > 10) {
							brc = value.substring(0, 8);
							brcBranchCode = value.substring(8, 11);
						} else {
							srn = value;
							session.setAttribute("CERT_SRC_NO", srn);
							System.out.println("srn " + srn);
						}
					}
				}
				if (name.getType().equals("CN")) {
					holdername = value;
					session.setAttribute("holdername", holdername);
					System.out.println("holdername: " + holdername);
				}
			}

			System.out.println("certificate Type " + certType);

			if (certType.equals(CERT_TYPE_PERSONAL)) {
				if (!auth.checkHKID(userHKID)) {
					errMsg = bundle.getString(ErrMsgConfig.ECERT00008);
				}
			}
		}

  • With oracle java api, it can be used to get crl path elegantly.

    <!-- lang: java -->

    CRLDistributionPointsExtension crlDistributionPointsExtension = certificateImpl .getCRLDistributionPointsExtension(); if (crlDistributionPointsExtension != null) { try { for (DistributionPoint distributionPoint : ((List<DistributionPoint>) crlDistributionPointsExtension .get(CRLDistributionPointsExtension.POINTS))) { for (GeneralName generalName : distributionPoint.getFullName().names()) { String generalNameString = generalName.toString(); System.out.println(generalNameString); String crlURLString = generalNameString.substring(9); crlUrl = new URL(crlURLString); } } } catch (Exception ex) { throw new CertPathValidatorException(ex); } }

  • But finally check whether CRL is revoked, just call crl.isrevoked to work. Damn!

转载于:https://my.oschina.net/l1z2g9/blog/357670

weixin_34240657
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
在LDAP中CA、CRL的发布属性
xyyaiguozhe的专栏
12-30 2498
文章摘自 https://access.redhat.com/site/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Configuring_Publishers_for_LDAP_Publishing.html 主要介绍了在LDAP中CA、CRL文件的所需配置对象和属性。 7.4. Configuri
LDAP服务器搭建新手指南
宁以至远
05-22 1万+
<! v/:* {behavior:url(#default#VML);}o/:* {behavior:url(#default#VML);}w/:* {behavior:url(#default#VML);}.shape {behavior:url(#default#VML);}--> Normal 0 false 7.8
openssl证书撤销列表(Certificate Revocation List，简称CRL)详解
N阶二进制的博客
12-11 2694
证书撤销列表(Certificate Revocation List，简称CRL)，是一种包含撤销的证书列表的签名数据结构。CRL是证书撤销状态的公布形式，CRL就像信用卡的黑名单，用于公布某些数字证书不再有效。CRL是一种离线的证书状态信息。它以一定的周期进行更新。CRL可以分为完全CRL和增量CRL。在完全CRL中包含了所有的被撤销证书信息，增量CRL由一系列的CRL来表明被撤销的证书信息，它每次发布的CRL是对前面发布CRL的增量扩充。
java parameters用法_java11教程--类PKIXParameters用法
weixin_39909001的博客
02-13 170
用作PKIX CertPathValidator算法输入的参数。PKIX CertPathValidator根据PKIX认证路径验证算法使用这些参数来验证CertPath 。要实例化PKIXParameters对象，应用程序必须指定PKIX证书路径验证算法定义的一个或多个最受信任的CA. 可以使用两个构造函数之一指定最受信任的CA. 应用程序可以调用PKIXParameters(Set) ，指定S...
证书吊销列表（Certificate Revocation List，CRL）
渡安H的博客
05-17 4648
证书吊销列表（Certificate Revocation List，CRL）一个被签署的列表，它指定了一套证书发布者认为无效的证书。除了普通CRL外，还定义了一些特殊的CRL类型用于覆盖特殊领域的CRL。 CRL一定是被CA所签署的，可以使用与签发证书相同的私钥，也可以使用专门的CRL签发私钥。CRL中包含了被吊销证书的序列号。 证书具有一个指定的寿命，但 CA 可通过称为证书吊销的过程来缩...
CRL和OSCP、LDAP
lingdukafeibj的博客
04-27 2811
签名验签服务器规范明确写出签名验签服务器应支持与CA基础设施的连接功能，包括CRL连接配置、OSCP连接配置。看完后一头雾水，首先需要了解什么是CRL 1、证书吊销列表（Certificate Revocation List，简称：CRL） 是PKI系统系统中的一个结构化的数据文件，该文件包含了证书颁发机构（CA）已经吊销的证书的序列号及其吊销日期。CRL文件中还包含证书颁发机构信息、吊销列表失效时间和下一次更新时间、以及采用的签名算法等。证书吊销列表最短的有效期为1个小时，一般为1天，甚至1个月不等，
Threshold Certificate-based Encryption
02-20
CBE provides an efficient implicit certificate mechanism to eliminate third-party queries for the certificate status and to simply the certificate revocation problem. Therefore, CBE can be ...
An_End-to-End_Measurement_of_Certificate_Revocation_in_the_Web's
01-02
这篇论文《An End-to-End Measurement of Certificate Revocation in the Web's PKI》主要探讨了互联网公钥基础设施（PKI）中证书吊销的全链条问题。作者通过大规模数据收集，分析了服务器、证书颁发机构（CA）、...
An_End-to-End_Measurement_of_Certificate_Revocation_in_the_Web's_PKI.pdf
08-07
一篇发表在IMC'15会议上的论文An End-to-End Measurement of Certificate Revocation in the Web's PKI。这篇文章主要研究了PKI体系中证书吊销的相关问题 Abstract & Introduction 这篇文章主要研究了PKI体系中证书...
revocation-endpoints:CRL和OCSP端点列表
05-26
CRL（Certificate Revocation List）和OCSP（Online Certificate Status Protocol）是两种主要的机制，用于确认数字证书是否已被撤销，从而确保通信的安全性。 **CRL（证书吊销列表）**： CRL是由证书颁发机构（CA...
证书吊销列表(CRL)介绍
热门推荐
孩儿学堂
04-25 2万+
一、证书吊销列表(CRL) 证书吊销列表 (Certificate Revocation List ，简称： CRL) 是 PKI 系统中的一个结构化数据文件，该文件包含了证书颁发机构 (CA) 已经吊销的证书的序列号及其吊销日期。 CRL 文件中还包含证书颁发机构信息、吊销列表失效时间和下一次更新时间，以及采用的签名算法等。证书吊销列表最短的有效期为一个小时，一般为 1 天，甚至一个月不等，
Java Secure Socket Extension (JSSE) -类和接口篇
weixin_43364172的博客
10-30 1061
@[TOC](Java Secure Socket Extension (JSSE) -类和接口篇 ) 为了 通信安全，两侧的连接必须是SSL-enabled。JSSE API里，连接的endpoint类是SSLSocket和SSLEngine。 SSLSocketFactory或者SSLServerSocket生成的SSLSocket，接收入站连接。 SSLServerSocket由SSLSe...
ROOT证书、CA证书和使用CA签发的X.509证书
wusj的博客
07-14 2265
ROOT证书、CA证书和使用CA签发的X.509证书 简介 概念 使用Bouncy Castle 生成一个签名证书 验证证书的签名 使用来自Oracle的证书支持 加载Keystore文件 验证签名是否合法 验证Trust Chain 结尾 简介 日常开发中，我们程序员不怎么会接触证书相关的问题，对信息安全领域相关的内容知之甚少。因为平时主要实现的业务很少要直接面向底层的通信，也就很少关注这证书这样的知识。在一般情况下，我们仅仅只是在使用一些高层的依赖中会引入证书、加密相关的依赖包，比如： <!
解析LDAP的Schema（v3）
赵士杰的博客
12-01 827
2. Abstract This document provides an overview of the attribute types and object classes defined by the ISO and ITU-T committees in the X.500 documents, in particular those intended for use by ...
求大佬细分OCSP协议、LDAP目录访问协议、CA证书库、LDAP目录服务器、LDAP目录数据库、CRL证书撤销列表文件之间的关系
kiritox的博客
02-21 2776
最近在看PKI系统的相关知识，在看到使用证书这块的时候对标题上的这些概念之间的关系有点不清楚。 比如A要认证B的证书 1、选择通过OCSP在线证书查询协议进行在线查询证书有效性的时候，是直接连接CA服务器么？然后由CA服务器去访问CA证书库？ 2、选择通过CRL证书撤销列表进行验证证书是否被撤销的逻辑是：向LDAP目录服务器发起下载/更新本地CRL证书撤销列表文件的请求，然后由LDAP目录服...
[Cloud Computing]Mechanisms: Certificate Revocation List
zjysource的专栏
07-06 533
Certificate Revocation List The certificate revocation list (CRL) is a signed list that is published and maintained by each certification authority (CA) that lists all of its revoked certificat
java之log4j反序列化
最新发布
weixin_45653478的博客
07-20 1157
Log4j2默认支持解析ldap/rmi协议（只要打印的日志中包括ldap/rmi协议即可），并会通过名称从ldap服务端获取对应的Class文件，使用ClassLoader在本地加载Ldap服务端返回的Class类。
安装net4.7The revocation function was unable to check revocation
06-08
这个错误通常表示你的计算机无法验证证书的有效性，可能是由于计算机上的时间和日期不正确或证书链上的某些证书已过期或被吊销。您可以尝试以下步骤来解决此问题： 1. 确保计算机的时间和日期正确。...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值