Add resilient OCSP certificate revocation checker by madislm · Pull Request #99 · web-eid/web-eid-authtoken-validation-java

madislm · 2026-02-02T08:21:06Z

AUT-2514

Signed-off-by: Madis Jaagup Laurson madisjaagup.laurson@nortal.com

Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

…OCSP certificate revocation checker Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

…n into eu.webeid.ocsp.service

…tificateRevocationChecker

…Service

…nd related tests

…s final

…llows old OCSP responses

…vice lookup

…SP request

…eption

…tificateRevocationChecker

…tionChecker

mrts · 2026-04-24T15:26:32Z

 */
 package eu.webeid.security.validator.revocationcheck;

+import eu.webeid.resilientocsp.ResilientOcspCertificateRevocationChecker;


Avoid depending on resilientocsp here, this creates a cyclic dependency between two separate libraries.

mrts · 2026-04-24T15:48:56Z

+            // Users must not be able to modify this value.
+            .ignoreExceptions(ResilientUserCertificateRevokedException.class)
+            .build();
+    }


Let's move the helpers from RevocationInfo here:

Suggested change

}

}

private static RevocationInfo withOcspResponse(RevocationInfo revocationInfo, byte[] ocspResponse) {

return revocationInfo.withAdditionalOcspResponseAttribute(RevocationInfo.KEY_OCSP_RESPONSE, ocspResponse);

}

private static RevocationInfo withHttpStatusCode(RevocationInfo revocationInfo, Integer statusCode) {

return revocationInfo.withAdditionalOcspResponseAttribute(RevocationInfo.KEY_HTTP_STATUS_CODE, statusCode);

}

private static RevocationInfo withCircuitBreakerStatistics(RevocationInfo revocationInfo, CircuitBreakerStatistics circuitBreakerStatistics) {

return revocationInfo.withAdditionalOcspResponseAttribute(RevocationInfo.KEY_CIRCUIT_BREAKER_STATISTICS, circuitBreakerStatistics);

}

mrts · 2026-04-24T15:50:50Z

+        if (result.isSuccess()) {
+            RevocationInfo revocationInfo = result.get();
+            if (revocationInfoList.isEmpty()) {
+                revocationInfo = revocationInfo.withCircuitBreakerStatistics(circuitBreakerStatistics);


Use the local helper instead:

Suggested change

revocationInfo = revocationInfo.withCircuitBreakerStatistics(circuitBreakerStatistics);

revocationInfo = withCircuitBreakerStatistics(revocationInfo, circuitBreakerStatistics);

mrts · 2026-04-24T15:56:14Z

+
+    public RevocationInfo withCircuitBreakerStatistics(ResilientOcspCertificateRevocationChecker.CircuitBreakerStatistics circuitBreakerStatistics) {
+        return withAdditionalField(KEY_CIRCUIT_BREAKER_STATISTICS, circuitBreakerStatistics);
+    }
+
+    public RevocationInfo withOcspResponse(byte[] ocspResponse) {
+        return withAdditionalField(KEY_OCSP_RESPONSE, ocspResponse);
+    }
+
+    public RevocationInfo withHttpStatusCode(Integer statusCode) {
+        return withAdditionalField(KEY_HTTP_STATUS_CODE, statusCode);
+    }


As circuit breaker is not conceptually part of the base library, it is best to move these methods to ResilientOcspCertificateRevocationChecker.

Suggested change

public RevocationInfo withCircuitBreakerStatistics(ResilientOcspCertificateRevocationChecker.CircuitBreakerStatistics circuitBreakerStatistics) {

return withAdditionalField(KEY_CIRCUIT_BREAKER_STATISTICS, circuitBreakerStatistics);

}

public RevocationInfo withOcspResponse(byte[] ocspResponse) {

return withAdditionalField(KEY_OCSP_RESPONSE, ocspResponse);

}

public RevocationInfo withHttpStatusCode(Integer statusCode) {

return withAdditionalField(KEY_HTTP_STATUS_CODE, statusCode);

}

mrts · 2026-04-24T15:56:35Z

+    }

-}
+    private RevocationInfo withAdditionalField(String key, Object value) {


Nice helper!

mrts · 2026-04-24T15:59:42Z

+        if (value == null) {
+            return this;
+        }
+        Map<String, Object> newOcspResponseAttributes = new HashMap<>(ocspResponseAttributes);


ocspResponseAttributes can be null, so null check is needed here:

Suggested change

Map<String, Object> newOcspResponseAttributes = new HashMap<>(ocspResponseAttributes);

Map<String, Object> newOcspResponseAttributes = ocspResponseAttributes != null

? new HashMap<>(ocspResponseAttributes)

: new HashMap<>();

new HashMap<>(null) throws NullPointerException.

mrts · 2026-04-24T16:12:12Z

+        CircuitBreaker circuitBreaker = circuitBreakerRegistry.circuitBreaker(primaryService.getAccessLocation().toASCIIString());
+
+        Optional<FallbackOcspService> firstFallbackServiceOpt = primaryService.getFallbackService();
+        if (firstFallbackServiceOpt.isEmpty()) {


I think a comment here is needed to clarify that without a configured fallback the primary service is used directly:

Suggested change

if (firstFallbackServiceOpt.isEmpty()) {

if (firstFallbackServiceOpt.isEmpty()) {

// Without a configured fallback, use the primary service directly without retry or circuit-breaker.

As this is may be non-obvious, maybe add this to the class-level Javadoc as well:

/** * OCSP revocation checker that falls back to configured fallback OCSP responders when the primary OCSP service fails. * * <p>Retry and circuit-breaker handling are applied only when a fallback OCSP service is configured for the * certificate issuer. If no fallback is configured, validation is handled by the primary OCSP service directly. */

madislm force-pushed the AUT-2514 branch 2 times, most recently from 0e6161a to e927de2 Compare February 2, 2026 09:16

madislm force-pushed the AUT-2514 branch 5 times, most recently from e96286a to a324e96 Compare February 10, 2026 08:29

madislm force-pushed the AUT-2514 branch from e9e03d1 to d917099 Compare February 18, 2026 10:56

mrts force-pushed the WE2-1030-use-platform-ocsp branch from 10a405b to 74e7af2 Compare February 20, 2026 16:55

madislm force-pushed the AUT-2514 branch 2 times, most recently from 9cdcc89 to ef4ae35 Compare February 27, 2026 09:35

mrts force-pushed the WE2-1030-use-platform-ocsp branch from 74e7af2 to f55d636 Compare March 6, 2026 18:37

aarmam and others added 16 commits March 18, 2026 10:52

AUT-2473 Add ResilientOcspCertificateRevocationChecker

9e042cd

Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

AUT-2473 Separate handling unknown status from revoked for resilient …

a57ce1c

…OCSP certificate revocation checker Co-authored-by: Madis Jaagup Laurson <madisjaagup.laurson@nortal.com>

AUT-2510 Disable thisUpdate in the past check for fallback OCSP service

46dc128

AUT-2552 Collect failed requests, add resilient OCSP specific exceptions

59f8c2c

AUT-2511 Collect failed retry results

b98e45f

AUT-2547 Add support for two fallbacks

d299d3d

AUT-2597 Update Resilience4j to version 2.3.0

42dd199

AUT-2597 Improve collecting failed requests

1aafc02

AUT-2597 Add tests for ResilientOcspCertificateRevocationChecker

1f07eb6

AUT-2597 Use issuer CNs to get fallback OCSP services

2c280b2

AUT-2597 Move FallbackOcspService and FallbackOcspServiceConfiguratio…

3c3e117

…n into eu.webeid.ocsp.service

AUT-2597 Reorganize code in ResilientOcspCertificateRevocationChecker

8400be7

AUT-2597 Add a note regarding recursive fallbacks

f7c137d

AUT-2623 Fix broken tests

e7e768c

AUT-2623 Fix and improve tests

3c27b2a

AUT-2618 Separate issuer certificates from OCSP responder certificates

6d023f2

madislm force-pushed the AUT-2514 branch from 644f3a4 to 6d023f2 Compare March 18, 2026 09:00

mrts requested changes Mar 20, 2026

View reviewed changes

mrts reviewed Mar 20, 2026

View reviewed changes

Comment thread src/main/java/eu/webeid/ocsp/exceptions/OCSPClientException.java Outdated

madislm added 3 commits March 26, 2026 12:28

AUT-2562 Add data to RevocationInfo list returned by ResilientOcspCer…

5edbdd7

…tificateRevocationChecker

AUT-2677 Restructure responder certificate validation in FallbackOcsp…

f528135

…Service

AUT-2677 Fix exception handling in OcspCertificateRevocationChecker a…

8e45594

…nd related tests

madislm force-pushed the AUT-2514 branch from 630bca3 to 8e45594 Compare March 27, 2026 09:03

madislm added 5 commits March 30, 2026 15:05

AUT-2677 Make OCSPClientException a checked exception, make its field…

612ad2d

…s final

AUT-2677 Use Optional for getFallbackService

93fa0b4

AUT-2677 Add max this update age to fallback instead of a flag that a…

bfc9810

…llows old OCSP responses

AUT-2677 Use distinguished names instead of common names for OCSP ser…

8e797fb

…vice lookup

AUT-2709 Collect response time and request duration after a failed OC…

b04c3e6

…SP request

mrts mentioned this pull request Apr 10, 2026

Add circuit breaker for OCSP service requests #94

Closed

mrts requested changes Apr 14, 2026

View reviewed changes

madislm added 5 commits April 20, 2026 12:08

AUT-2758 Improve handling objects being null

2e875a4

AUT-2758 Simplify getting issuer distinguished name

0588089

AUT-2758 Refactor handling ResilientUserCertificateOCSPCheckFailedExc…

e238713

…eption

AUT-2758 Refactor collecting circuit breaker statistics

d657506

AUT-2758 Refactor creating RevocationInfo objects in ResilientOcspCer…

1580169

…tificateRevocationChecker

madislm force-pushed the AUT-2514 branch from 8b598e3 to 1580169 Compare April 20, 2026 12:52

madislm added 2 commits April 20, 2026 16:08

AUT-2758 Add immutability to RevocationInfo and ValidationInfo

2ba8bfa

AUT-2758 Improve exception creation in ResilientOcspCertificateRevoca…

f82445c

…tionChecker

mrts requested changes Apr 24, 2026

View reviewed changes

-    }
+    }
+  private static RevocationInfo withOcspResponse(RevocationInfo revocationInfo, byte[] ocspResponse) {
+      return revocationInfo.withAdditionalOcspResponseAttribute(RevocationInfo.KEY_OCSP_RESPONSE, ocspResponse);
+  }
+  private static RevocationInfo withHttpStatusCode(RevocationInfo revocationInfo, Integer statusCode) {
+      return revocationInfo.withAdditionalOcspResponseAttribute(RevocationInfo.KEY_HTTP_STATUS_CODE, statusCode);
+  }
+  private static RevocationInfo withCircuitBreakerStatistics(RevocationInfo revocationInfo, CircuitBreakerStatistics circuitBreakerStatistics) {
+      return revocationInfo.withAdditionalOcspResponseAttribute(RevocationInfo.KEY_CIRCUIT_BREAKER_STATISTICS, circuitBreakerStatistics);
+  }

	revocationInfo = revocationInfo.withCircuitBreakerStatistics(circuitBreakerStatistics);
	revocationInfo = withCircuitBreakerStatistics(revocationInfo, circuitBreakerStatistics);

-        Map<String, Object> newOcspResponseAttributes = new HashMap<>(ocspResponseAttributes);
+        Map<String, Object> newOcspResponseAttributes = ocspResponseAttributes != null
+          ? new HashMap<>(ocspResponseAttributes)
+          : new HashMap<>();

	if (firstFallbackServiceOpt.isEmpty()) {
	if (firstFallbackServiceOpt.isEmpty()) {
	// Without a configured fallback, use the primary service directly without retry or circuit-breaker.

Conversation

madislm commented Feb 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mrts Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants