JDK-6355295 : Certificate validation using OCSP fails for a particular class of certificates
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 6
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2005-11-24
  • Updated: 2010-04-02
  • Resolved: 2005-12-03
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other JDK 6
5.0u7Fixed 6 b63Fixed
Description
OCSP is the on-line certificate status protocol. It is used to determine the validity
of a given certificate. An error exists in the OCSP client implementation such that
certain OCSP requests are immediately rejected by the OCSP server.

The error occurs during validation of a certain class of certificates: those that
have been issued by a CA that is not a root CA. A root CA has a certificate where
the subject name and issuer name are identical. OCSP validation requests for
certificates issued by root CAs do not exhibit the problem.

When the error occurs, the OCSP validation request is encoded incorrectly and the
request is subsequently rejected by the OCSP server.
Comments
SUGGESTED FIX The fix is to modify the OCSP request to include the subject name of the issuer certificate (rather than the issuer name). *** (#1 of 1): [ UNSAVED ] ###@###.###
24-11-2005
EVALUATION The problem exists in OCSP requests for certificate that have not been issued by a root CA.
24-11-2005