If I understand correctly, local variable "altIssuerCert" (scoped within the for loop) will be passed on to addCertToCertificatesMap. If it happens to be the "wrong" one, the consequence will be that the certificates map may end up containing one (or more) unuseful entry(ies).
On 2019/02/02 18:50:13, Tilman Hausherr <[email protected]> wrote: > "altIssuerCert" is set each time in the loop. How do we make sure that > it's the right one, i.e. the one at the beginning of the chain? > > Tilman > > Am 01.02.2019 um 13:14 schrieb [email protected]: > > In fact, the correct chain might not be found in the right order, so, there > > could be a try/catch block within the for loop: > > > > try (InputStream in = certUrl.openStream()) > > { > > Collection<? extends java.security.cert.Certificate> altIssuerCerts = > > certFactory.generateCertificates(in); > > for (java.security.cert.Certificate c : altIssuerCerts) { > > X509Certificate altIssuerCert = (X509Certificate) c; > > addCertToCertificatesMap(altIssuerCert); > > > > certInfo.alternativeCertChain = new CertSignatureInformation(); > > try { > > traverseChain(altIssuerCert, certInfo.alternativeCertChain, > > maxDepth - 1); > > } catch (IOException e) { > > LOG.error("Error getting additional Certificate from " + > > certInfo.issuerUrl, e); > > } > > } > > } > > > > On 2019/01/31 16:43:20, Tilman Hausherr <[email protected]> wrote: > >> Yes this sounds good, thanks. I'll add it soon. > >> > >> Tilman > >> > >> Am 31.01.2019 um 14:27 schrieb Tobias Brignol Petry: > >>> Hello, > >>> > >>> The current version of > >>> org.apache.pdfbox.examples.signature.validation.CertInformationCollector > >>> supports a single certificate as the alternative issuer. > >>> It could support chains also: > >>> > >>> --------------------------- > >>> Current code (lines 300-308): > >>> try (InputStream in = certUrl.openStream()) > >>> { > >>> X509Certificate altIssuerCert = (X509Certificate) certFactory > >>> .generateCertificate(in); > >>> addCertToCertificatesMap(altIssuerCert); > >>> > >>> certInfo.alternativeCertChain = new CertSignatureInformation(); > >>> traverseChain(altIssuerCert, certInfo.alternativeCertChain, > >>> maxDepth - > >>> 1); > >>> } > >>> ------------------------------ > >>> Proposed update: > >>> try (InputStream in = certUrl.openStream()) > >>> { > >>> Collection<? extends java.security.cert.Certificate> altIssuerCerts > >>> = > >>> certFactory.generateCertificates(in); > >>> for (java.security.cert.Certificate c : altIssuerCerts) { > >>> X509Certificate altIssuerCert = (X509Certificate) c; > >>> addCertToCertificatesMap(altIssuerCert); > >>> > >>> certInfo.alternativeCertChain = new CertSignatureInformation(); > >>> traverseChain(altIssuerCert, certInfo.alternativeCertChain, > >>> maxDepth - 1); > >>> } > >>> } > >>> -------------------------- > >>> > >> > >> --------------------------------------------------------------------- > >> To unsubscribe, e-mail: [email protected] > >> For additional commands, e-mail: [email protected] > >> > >> > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
