{"action":"created","issue":{"url":"https://api.github.com/repos/eu-emi/canl-java/issues/79","labels_url":"https://api.github.com/repos/eu-emi/canl-java/issues/79/labels{/name}","comments_url":"https://api.github.com/repos/eu-emi/canl-java/issues/79/comments","events_url":"https://api.github.com/repos/eu-emi/canl-java/issues/79/events","html_url":"https://github.com/eu-emi/canl-java/issues/79","id":108333291,"number":79,"title":"CRL download from distribution point failing?","user":{"login":"gbehrmann","id":1125766,"avatar_url":"https://avatars.githubusercontent.com/u/1125766?v=3","gravatar_id":"","url":"https://api.github.com/users/gbehrmann","html_url":"https://github.com/gbehrmann","followers_url":"https://api.github.com/users/gbehrmann/followers","following_url":"https://api.github.com/users/gbehrmann/following{/other_user}","gists_url":"https://api.github.com/users/gbehrmann/gists{/gist_id}","starred_url":"https://api.github.com/users/gbehrmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gbehrmann/subscriptions","organizations_url":"https://api.github.com/users/gbehrmann/orgs","repos_url":"https://api.github.com/users/gbehrmann/repos","events_url":"https://api.github.com/users/gbehrmann/events{/privacy}","received_events_url":"https://api.github.com/users/gbehrmann/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-25T14:05:21Z","updated_at":"2015-09-25T15:21:32Z","closed_at":null,"body":"In relation to issue #78, I was wondering why the code that should have downloaded the CRL from the CRL distribution point didn't kick in. Tracing the calls in the code, I found this piece:\r\n\r\n\t/**\r\n\t * Checks a certificate if it is revoked.\r\n\t * \r\n\t * @param paramsPKIX PKIX parameters.\r\n\t * @param cert Certificate to check if it is revoked.\r\n\t * @param validDate The date when the certificate revocation status\r\n\t *                should be checked.\r\n\t * @param sign The issuer certificate of the certificate\r\n\t *                <code>cert</code>.\r\n\t * @param workingPublicKey The public key of the issuer certificate\r\n\t *                <code>sign</code>.\r\n\t * @param certPathCerts The certificates of the certification path.\r\n\t * @param jcaHelper JcaJce helper\r\n\t * @throws SimpleValidationErrorException if the certificate is revoked or the\r\n\t *                 status cannot be checked or some error occurs.\r\n\t */\r\n\tpublic static void checkCRLs2(ExtPKIXParameters2 paramsPKIX, X509Certificate cert,\r\n\t\t\tDate validDate, X509Certificate sign, PublicKey workingPublicKey,\r\n\t\t\tList<?> certPathCerts, JcaJceHelper jcaHelper) throws SimpleValidationErrorException\r\n\t{\r\n\t\tSimpleValidationErrorException lastException = null;\r\n\t\tCRLDistPoint crldp = null;\r\n\t\ttry\r\n\t\t{\r\n\t\t\tcrldp = CRLDistPoint.getInstance(CertPathValidatorUtilitiesCanl\r\n\t\t\t\t\t.getExtensionValue(cert,\r\n\t\t\t\t\t\tRFC3280CertPathUtilities.CRL_DISTRIBUTION_POINTS));\r\n\t\t} catch (Exception e)\r\n\t\t{\r\n\t\t\tthrow new SimpleValidationErrorException(ValidationErrorCode.crlDistPtExtError, e); \r\n\t\t}\r\n        ...\r\n\t}\r\n\r\nNote how the code tries to extract the distribution point from `cert` rather than `sign`. This returns null as cert is the clients certificate, not the certificate of the CA.\r\n\r\nThe above is from RFC3280CertPathUtilitiesCanl in CANL 2.2 and RFC3280CertPathUtilitiesHelper in 1.3.3 (I only traced the calls in 1.3.3, so cannot say whether it gets invoked in 2.2)."},"comment":{"url":"https://api.github.com/repos/eu-emi/canl-java/issues/comments/143250774","html_url":"https://github.com/eu-emi/canl-java/issues/79#issuecomment-143250774","issue_url":"https://api.github.com/repos/eu-emi/canl-java/issues/79","id":143250774,"user":{"login":"gbehrmann","id":1125766,"avatar_url":"https://avatars.githubusercontent.com/u/1125766?v=3","gravatar_id":"","url":"https://api.github.com/users/gbehrmann","html_url":"https://github.com/gbehrmann","followers_url":"https://api.github.com/users/gbehrmann/followers","following_url":"https://api.github.com/users/gbehrmann/following{/other_user}","gists_url":"https://api.github.com/users/gbehrmann/gists{/gist_id}","starred_url":"https://api.github.com/users/gbehrmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gbehrmann/subscriptions","organizations_url":"https://api.github.com/users/gbehrmann/orgs","repos_url":"https://api.github.com/users/gbehrmann/repos","events_url":"https://api.github.com/users/gbehrmann/events{/privacy}","received_events_url":"https://api.github.com/users/gbehrmann/received_events","type":"User","site_admin":false},"created_at":"2015-09-25T15:21:32Z","updated_at":"2015-09-25T15:21:32Z","body":"Thanks for your answer. I will have a read through that section of RFC 5280 myself later. I am just wondering how this is supposed to work - what's the point of taking the DP from the client's certificate rather than the CA's? At least in case of the NorduGrid CA, the CA certificate is the one containing the DP extension."}}