Search in List of X509CRL's

Arzybek 0
Viewed 46

I have a list of X509 CRL's. I need to identify some of them somehow. Right now I do it using issuer:

for(var crl: List<X509CRL> crls){
 String issuer = c.getIssuerX500Principal().getName();
 if(issuer.contains("searchString"))
  result.add(crl);
}

But there's gotta be a better way to do that using knowledge of CRL file format, maybe with comparing public keys or something like that, but I don't know much about X509CRL's. Can someone help me out?

x509certificate certificate java security
2 Answers

If you have access to the public key of each certificate, you can utilize the verify(PublicKey key) method to verify that the CRL was signed using the private key that corresponds to the given public key.

If the key is incorrect, it should throw an InvalidKeyException, so surround it with a try-catch block, like this:

try {
  crl.verify(<public_key>)
} catch(InvalidKeyException e) {
  // handle exception
}

Source: https://docs.oracle.com/javase/7/docs/api/java/security/cert/X509CRL.html#verify(java.security.PublicKey)

Pexers0

Similar to the solution from @Pexers would be using either the X509 Certificate or a list of X509 Certificate serial numbers and calling either of these in a loop;

X509CRLEntry getRevokedCertificate(BigInteger serialNumber)

or

X509CRLEntry getRevokedCertificate(X509Certificate certificate)

The result will be the X509CRLEntry if they are in the CRL or null if they are not.

Processing a large number of Certificates and/or CRLs in this way would reduce the need to catch and handle an exception for each one.

Alan Carlyle0
Related