In fact, the correct chain might not be found in the right order, so, there
could be a try/catch block within the for loop:
try (InputStream in = certUrl.openStream())
{
Collection<? extends java.security.cert.Certificate> altIssuerCerts =
certFactory.generateCertificates(in);
for (java.security.cert.Certificate c : altIssuerCerts) {
X509Certificate altIssuerCert = (X509Certificate) c;
addCertToCertificatesMap(altIssuerCert);
certInfo.alternativeCertChain = new CertSignatureInformation();
try {
traverseChain(altIssuerCert, certInfo.alternativeCertChain,
maxDepth - 1);
} catch (IOException e) {
LOG.error("Error getting additional Certificate from " +
certInfo.issuerUrl, e);
}
}
}
On 2019/01/31 16:43:20, Tilman Hausherr <[email protected]> wrote:
> Yes this sounds good, thanks. I'll add it soon.
>
> Tilman
>
> Am 31.01.2019 um 14:27 schrieb Tobias Brignol Petry:
> > Hello,
> >
> > The current version of
> > org.apache.pdfbox.examples.signature.validation.CertInformationCollector
> > supports a single certificate as the alternative issuer.
> > It could support chains also:
> >
> > ---------------------------
> > Current code (lines 300-308):
> > try (InputStream in = certUrl.openStream())
> > {
> > X509Certificate altIssuerCert = (X509Certificate) certFactory
> > .generateCertificate(in);
> > addCertToCertificatesMap(altIssuerCert);
> >
> > certInfo.alternativeCertChain = new CertSignatureInformation();
> > traverseChain(altIssuerCert, certInfo.alternativeCertChain, maxDepth -
> > 1);
> > }
> > ------------------------------
> > Proposed update:
> > try (InputStream in = certUrl.openStream())
> > {
> > Collection<? extends java.security.cert.Certificate> altIssuerCerts =
> > certFactory.generateCertificates(in);
> > for (java.security.cert.Certificate c : altIssuerCerts) {
> > X509Certificate altIssuerCert = (X509Certificate) c;
> > addCertToCertificatesMap(altIssuerCert);
> >
> > certInfo.alternativeCertChain = new CertSignatureInformation();
> > traverseChain(altIssuerCert, certInfo.alternativeCertChain,
> > maxDepth - 1);
> > }
> > }
> > --------------------------
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
