OcspClientTest Class — netty Architecture

Source Code

handler-ssl-ocsp/src/test/java/io/netty/handler/ssl/ocsp/OcspClientTest.java lines 48–180

class OcspClientTest extends AbstractOcspTest {

    @ParameterizedTest
    @ValueSource(strings = {"https://netty.io", "https://apple.com"})
    void simpleOcspQueryTest(String urlString) throws IOException, ExecutionException, InterruptedException {
        HttpsURLConnection httpsConnection = null;
        try {
            URL url = new URL(urlString);
            httpsConnection = (HttpsURLConnection) url.openConnection();
            httpsConnection.connect();

            // Pull server certificates for validation
            X509Certificate[] certs = (X509Certificate[]) httpsConnection.getServerCertificates();
            X509Certificate serverCert = certs[0];
            X509Certificate certIssuer = certs[1];

            Promise<BasicOCSPResp> promise = OcspClient.query(serverCert, certIssuer, false,
                    createDefaultTransport(), createDefaultResolver(createDefaultTransport()));
            BasicOCSPResp basicOCSPResp = promise.get();

            // 'null' means certificate is valid
            assertNull(basicOCSPResp.getResponses()[0].getCertStatus());
        } finally {
            if (httpsConnection != null) {
                httpsConnection.disconnect();
            }
        }
    }

    @Test
    void validateSignatureWithIncludedChainSucceeds() throws Exception {
        X509Bundle rootIssuer = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=SomeRootCA")
                .setIsCertificateAuthority(true)
                .buildSelfSigned();

        X509Bundle intermediateIssuer = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=SomeIntermediateCA")
                .setIsCertificateAuthority(true)
                .buildIssuedBy(rootIssuer);

        X509Bundle ocspResponder = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=SomeOCSPResponder")
                .buildIssuedBy(intermediateIssuer);

        // Create actual OCSP response with the responder's certificate
        X509CertificateHolder responderHolder = new JcaX509CertificateHolder(ocspResponder.getCertificate());
        X509CertificateHolder intermediateHolder = new JcaX509CertificateHolder(intermediateIssuer.getCertificate());

        // Create a minimal BasicOCSPResp that contains the certificate chain
        BasicOCSPResp resp = createBasicOcspResponse(
                ocspResponder,
                new X509CertificateHolder[]{responderHolder, intermediateHolder}
        );

        assertDoesNotThrow(() -> OcspClient.validateSignature(resp, rootIssuer.getCertificate()));
    }

    @Test
    void validateSignatureWithInvalidChainThrows() throws Exception {
        // Build an unrelated responder chain so nothing is signed by the provided issuer (using RSA)
        X509Bundle issuerBundle = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=Issuer")
                .setIsCertificateAuthority(true)
                .buildSelfSigned();

        // Different CA
        X509Bundle otherRoot = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=SomeRootCA")
                .setIsCertificateAuthority(true)
                .buildSelfSigned();

        X509Bundle otherIntermediate = new CertificateBuilder()
                .algorithm(CertificateBuilder.Algorithm.rsa2048)
                .subject("CN=SomeIntermediateCA")
                .setIsCertificateAuthority(true)