3

I've read that Java provides OCSP and CRL checking for CertPaths via: Security.setProperty("ocsp.enable", "true"); System.setProperty("com.sun.security.enableCRLDP", "true");

Do these implementations check for the OCSP and CRL of intermediate CAs as well, or do they only check the leaf certificate?

Improve this question

1 Answer 1

Reset to default
4

The source code seems to say yes. Get it from there; then look at the files in jdk/src/share/classes/sun/security/provider/certpath/. In particular, PKIXCertPathValidator.java implements the validation mechanism. In the doValidate() method, classes which will do the OCSP or CRL checking will be instantiated as OCSPChecker or CrlRevocationChecker, and they will be applied at the end on all certificates in the path (this is done by a PKIXMasterCertPathValidator instance).

Without looking at the code, this behaviour could have been deduced from the API documentation on java.security.cert.PKIXCertPathChecker: the init() method explains quite plainly that all certificates in the path will be fed to the checker instance.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .