Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("", "true");

Do these implementations check for the OCSP and CRL of intermediate CAs as well, or do they only check the leaf certificate?

share|improve this question

The source code seems to say yes. Get it from there; then look at the files in jdk/src/share/classes/sun/security/provider/certpath/. In particular, implements the validation mechanism. In the doValidate() method, classes which will do the OCSP or CRL checking will be instantiated as OCSPChecker or CrlRevocationChecker, and they will be applied at the end on all certificates in the path (this is done by a PKIXMasterCertPathValidator instance).

Without looking at the code, this behaviour could have been deduced from the API documentation on the init() method explains quite plainly that all certificates in the path will be fed to the checker instance.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.