bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1 #1923

yhuang01 · 2024-11-27T08:05:10Z

I am using bc-fips-2.0.jar to do ocsp check for certificate generated from entrust. The ocsp responder url is: http://ocsps.ssl.com/

JDK version:
openjdk version "11.0.25" 2024-10-15 LTS
OpenJDK Runtime Environment Zulu11.76+22-SA (build 11.0.25+9-LTS)
OpenJDK 64-Bit Server VM Zulu11.76+22-SA (build 11.0.25+9-LTS, mixed mode)

However, I keep getting the following error when doing ocsp check:

Caused by: java.security.cert.CertPathValidatorException: OCSP responder failed: 1
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.OcspCache.getOcspResponse(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.ProvOcspRevocationChecker.check(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.ProvRevocationChecker.check(Unknown Source)
        at java.base/java.security.cert.PKIXCertPathChecker.check(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.RFC3280CertPathUtilities.processCertA(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.PKIXCertPathValidatorSpi_8.engineValidate(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.PKIXCertPathBuilderSpi_8.build(Unknown Source)

The following is the testing code which can be used to reproduce the issue:

import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;

import java.io.FileInputStream;
import org.bouncycastle.util.Properties;

import java.security.Security;
import java.security.cert.*;
import java.util.*;

public class PKIXRevocationCheckerTest {

    public static void main(String[] args) throws Exception {
        String path = "/tmpcerts/";

        try {
            // Add Bouncy Castle FIPS as a security provider
            Security.addProvider(new BouncyCastleFipsProvider());

            // Paths to the certificates
            String rootCertPath = path + "RootCA.crt";

            // Load the certificates
            X509Certificate rootCert = loadCertificate(rootCertPath);
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509", "BCFIPS");

            // Load certificates individually
            X509Certificate leafCert = (X509Certificate) certFactory.generateCertificate(new FileInputStream(path + "leaf.crt"));
            X509Certificate intermediateCert1 = (X509Certificate) certFactory.generateCertificate(new FileInputStream(path + "intermediate1.crt"));
            X509Certificate intermediateCert2 = (X509Certificate) certFactory.generateCertificate(new FileInputStream(path + "intermediate2.crt"));

            // Add certificates to the chain
            List<Certificate> certChain = new ArrayList<>();
            certChain.add(leafCert);
            certChain.add(intermediateCert1);
            certChain.add(intermediateCert2);

            // Load the leaf certificate and its chain
            CertPath certPath = certFactory.generateCertPath(certChain);

            // Set up the trust anchor (root certificate)
            TrustAnchor trustAnchor = new TrustAnchor(rootCert, null);

            System.setProperty("ocsp.responderURL", "http://ocsps.ssl.com");

            // Retrieve and print the property using Properties.getPropertyValue
            String ocspResponderURL = Properties.getPropertyValue("ocsp.responderURL");
            System.out.println("OCSP Responder URL: " + ocspResponderURL);

            // Set up PKIX parameters
            PKIXParameters pkixParams = new PKIXParameters(Collections.singleton(trustAnchor));
            pkixParams.setRevocationEnabled(true);

            // Add PKIXRevocationChecker to perform OCSP checks
            CertPathValidator validator = CertPathValidator.getInstance("PKIX", "BCFIPS");
            PKIXRevocationChecker revocationChecker = (PKIXRevocationChecker) validator.getRevocationChecker();

            // Configure revocation checker to use OCSP/CRL
            revocationChecker.setOptions(EnumSet.of (PKIXRevocationChecker.Option.SOFT_FAIL,
                    PKIXRevocationChecker.Option.ONLY_END_ENTITY));
            pkixParams.addCertPathChecker(revocationChecker);

            // Validate the certification path
            try {
                System.out.println(((PKIXRevocationChecker) validator.getRevocationChecker()).getClass());
                validator.validate(certPath, pkixParams);
                System.out.println("Certificate chain is valid.");
            } catch (CertPathValidatorException e) {
                e.printStackTrace();
                System.err.println("Certificate chain validation failed: " + e.getMessage());
            }

        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }

    /**
     * Loads a certificate from a file.
     *
     * @param certPath Path to the certificate file.
     * @return The loaded X509Certificate.
     * @throws Exception If an error occurs while loading the certificate.
     */
    private static X509Certificate loadCertificate(String certPath) throws Exception {
        try (FileInputStream fis = new FileInputStream(certPath)) {
            CertificateFactory factory = CertificateFactory.getInstance("X.509");
            return (X509Certificate) factory.generateCertificate(fis);
        }
    }

    private static X509CRL loadCRL(String crlPath) throws Exception {
        try (FileInputStream fis = new FileInputStream(crlPath)) {
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509", "BCFIPS");
            return (X509CRL) certFactory.generateCRL(fis);
        }
    }
}

The text was updated successfully, but these errors were encountered:

yhuang01 · 2024-11-27T08:05:41Z

This the leaf.crt:

yhuang01 · 2024-11-27T08:08:03Z

The following is intermediate1.crt:

yhuang01 · 2024-11-27T08:08:50Z

The following is intermediate2.crt

yhuang01 · 2024-11-27T08:10:03Z

The following is RootCA.crt

yhuang01 · 2024-12-02T04:30:00Z

It appears that this issue is related to #1548, which was fixed in 1.78. But it is not included in bc-fips-2.0.0 distribution.

dghgit · 2024-12-15T05:15:02Z

Yes, unfortunately this showed up well after submission. It's fixed in the FIPS PQC update which we are working on now.

yhuang01 · 2024-12-15T05:24:43Z

FIPS PQC update

Thank you for your response. Do you have an estimated timeline for the next BC-FIPS library release and its certification?

yhuang01 changed the title ~~java.security.cert.CertPathValidatorException: OCSP responder failed: 1~~ bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1 Nov 27, 2024

dghgit self-assigned this Dec 15, 2024

MainS2020 mentioned this issue Dec 15, 2024

The following is intermediate1.crt: mdn/browser-compat-data#25411

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1 #1923

bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1 #1923

yhuang01 commented Nov 27, 2024 •

edited

Loading

yhuang01 commented Nov 27, 2024 •

edited

Loading

yhuang01 commented Nov 27, 2024

yhuang01 commented Nov 27, 2024

yhuang01 commented Nov 27, 2024

yhuang01 commented Dec 2, 2024

dghgit commented Dec 15, 2024

yhuang01 commented Dec 15, 2024

bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1 #1923

bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1 #1923

Comments

yhuang01 commented Nov 27, 2024 • edited Loading

yhuang01 commented Nov 27, 2024 • edited Loading

yhuang01 commented Nov 27, 2024

yhuang01 commented Nov 27, 2024

yhuang01 commented Nov 27, 2024

yhuang01 commented Dec 2, 2024

dghgit commented Dec 15, 2024

yhuang01 commented Dec 15, 2024

yhuang01 commented Nov 27, 2024 •

edited

Loading

yhuang01 commented Nov 27, 2024 •

edited

Loading