Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("com.sun.security.enableCRLDP", "true");

Do these implementations check for the OCSP and CRL of intermediate CAs as well, or do they only check the leaf certificate?

share|improve this question

1 Answer 1

The source code seems to say yes. Get it from there; then look at the files in jdk/src/share/classes/sun/security/provider/certpath/. In particular, PKIXCertPathValidator.java implements the validation mechanism. In the doValidate() method, classes which will do the OCSP or CRL checking will be instantiated as OCSPChecker or CrlRevocationChecker, and they will be applied at the end on all certificates in the path (this is done by a PKIXMasterCertPathValidator instance).

Without looking at the code, this behaviour could have been deduced from the API documentation on java.security.cert.PKIXCertPathChecker: the init() method explains quite plainly that all certificates in the path will be fed to the checker instance.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.