Question

我试图在BouncyCastle找到有关OCSP的信息, 我在网上找到的例子充其量是模糊的, 所以我想我尽量在这里问一下。

以下是我的问题:我试图在BouncyCastle为.NET做OCSP, 但我对OCSP的反应有问题,

问题可能是我用错误的方式构建回应本身,因为我这样做的方式是由在线找到的零碎和零碎的零碎拼凑在一起的,而我则是纯粹的“直觉”。

        X509CrlEntry crlentry = Repository.CRL.GetRevokedCertificate(certToCheck.SerialNumber);
        BasicOcspRespGenerator basicRespGen = new BasicOcspRespGenerator(Repository.Data.BouncyCastlePublicKey);
        if (crlentry == null) {
            //still valid
            basicRespGen.AddResponse(certToCheck, CertificateStatus.Good);
        } else {
            //revoked
            DerGeneralizedTime dt = new DerGeneralizedTime(crlentry.RevocationDate);
            RevokedInfo rinfo = new RevokedInfo(dt, new CrlReason(CrlReason.CessationOfOperation));
            RevokedStatus rstatus = new RevokedStatus(rinfo);
            basicRespGen.AddResponse(certToCheck, rstatus);
        }
        BasicOcspResp response = basicRespGen.Generate("SHA512withRSA", Repository.Data.BouncyCastlePrivateKey, new X509Certificate[] { Repository.Data.MyCertificate }, DateTime.Now);
        byte[] responseBytes = response.GetEncoded;
    //I then send the bytes back to the client who made the request

问题是现在我不知道如何将回应从它序列式的字节[ ]形式上调回... 似乎没有工厂/ 授标者或建造者来取回它。有一个 OcspResp 构建器接受字节作为参数, 但是它抛出一个例外, 因为 OcspResp 和 BasicOcspResp 是不同的东西。

有人能帮我吗?我建立回应本身是错误的吗?还是我看不到如何去消化它?有什么暗示吗?

Thanks in advance Master_T

Answer 1

这是那么古老, 但是如果有人寻找答案, 这里就是: 在提取字节之前, 基本OcspResp 必须被包裹在 OcspResp 中。

在服务器上创建响应 :

    X509CrlEntry crlentry = Repository.CRL.GetRevokedCertificate(certToCheck.SerialNumber);
    BasicOcspRespGenerator basicRespGen = new BasicOcspRespGenerator(Repository.Data.BouncyCastlePublicKey);
    if (crlentry == null) {
        //still valid
        basicRespGen.AddResponse(certToCheck, CertificateStatus.Good);
    } else {
        //revoked
        DerGeneralizedTime dt = new DerGeneralizedTime(crlentry.RevocationDate);
        RevokedInfo rinfo = new RevokedInfo(dt, new CrlReason(CrlReason.CessationOfOperation));
        RevokedStatus rstatus = new RevokedStatus(rinfo);
        basicRespGen.AddResponse(certToCheck, rstatus);
    }
    BasicOcspResp basicOcspResp = basicRespGen.Generate("SHA512withRSA", Repository.Data.BouncyCastlePrivateKey, new X509Certificate[] { Repository.Data.MyCertificate }, DateTime.Now);
    var ocspResponseGenerator = new OCSPRespGenerator();
    var ocspResponse = ocspResponseGenerator.Generate(OCSPRespGenerator.Successful, basicOcspResp);
    byte[] responseBytes = ocspResponse.GetEncoded();

阅读客户回复:

    OcspResp ocspResponse = new OcspResp(responseBytes);
    BasicOcspResp basicOcspResponse = (BasicOcspResp)ocspResponse.GetResponseObject();

友情链接