Is Bouncy Castle still using CRL to validate certificate validity?

[onepeople158]

Hello developer, while researching the Bouncy Castle API, I found that the class X509CRLObject has been enabled, and I saw the message "Do not use this class directly - either use org.bouncycastle.cert (bcpkix) or CertificateFactory." After further investigation, I did not find org.bouncycastle.cert (bcpkix). Does Bouncy Castle still have an API for CRL validation?

[dghgit]

Yes, see Java's CertPath API. The support classes (as in the public ones) are in java.security.cert.

[onepeople158]

Hello Developer,

I have used the isRevoked method in the Java library to perform a CRL (Certificate Revocation List) check, but I found that it does not return the expected result as specified by RFC 5280. Could you please let me know if Bouncy Castle or the Java library provides an API that implements the CRL validation algorithm as described in Chapter 6 of RFC 5280?

Thank you.

[dghgit]

As far as I'm aware both APIs are compliant with RFC 5280. When you say, "does not return the expected result" can you provide some details? If there's an issue with the BC API we'd certainly like to fix it, but it's impossible to tell what's going on from the current data available.

[onepeople158]

Hello, developer. The command line shows the result of my verification using OpenSSL, which displays a different range. In PyCharm, I am using the is_certificate_revoked method from the Java standard library for verification, and it does not check the CRL range according to RFC5280.

[dghgit]

I really need the certificate chain and the CRL to work out what is going on here.

[onepeople158]

Hello developer, since the is_revoked function can run without the certificate chain, I'm not sure how to add the certificate chain into the validation process.