BasicOCSPResponse ("Entrust Authority Security Toolkit for the Java Platform")

java.lang.Object
- iaik.x509.ocsp.Response
- - iaik.x509.ocsp.BasicOCSPResponse

public class BasicOCSPResponse
extends Response

This class implements the OCSP type BasicOCSPResponse.

When sending an OCSPResponse in response to an OCSPRequest, a successful response may include ResponseBytes giving more detailed information about the status of the certificates asked for. ResponseBytes may include Response information of any type, identified by its object identifier (see RFC 2560):

 OCSPResponse ::= SEQUENCE {
    responseStatus         OCSPResponseStatus,
    responseBytes          [0] EXPLICIT ResponseBytes OPTIONAL }

 OCSPResponseStatus ::= ENUMERATED {
     successful            (0),  --Response has valid confirmations
     malformedRequest      (1),  --Illegal confirmation request
     internalError         (2),  --Internal error in issuer
     tryLater              (3),  --Try again later
                                 --(4) is not used
     sigRequired           (5),  --Must sign the request
      unauthorized          (6)   --Request unauthorized
  }

 ResponseBytes ::=       SEQUENCE {
    responseType   OBJECT IDENTIFIER,
    response       OCTET STRING }

This class implements the only one response type predefined by RFC 2560, BasicOCSResponse which shall be supported by all OCSP clients and servers:

 BasicOCSPResponse       ::= SEQUENCE {
   tbsResponseData      ResponseData,
   signatureAlgorithm   AlgorithmIdentifier,
   signature            BIT STRING,
   certs                [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }

  ResponseData ::= SEQUENCE {
    version              [0] EXPLICIT Version DEFAULT v1,
    responderID              ResponderID,
    producedAt               GeneralizedTime,
    responses                SEQUENCE OF SingleResponse,
     responseExtensions   [1] EXPLICIT Extensions OPTIONAL }

After creating a BasicOCSPResponse and setting ResponderID and producedAt date, add single responses for any single request included in the OCSPRequest received, e.g.:

 // the ocsp request received
 OCSPrequest ocspRequest = ...;
 Request[] requests = ocspRequest.getRequestList();
 SingleResponse[] singleResponses = new SingleResponse[requests.length];
 // create a single response for any request included:   
 for (int i = 0; i < requests.length; i++) {
   ...
   singleResponses[i] = ...;
   ...
 }
 // create the BasicOCSPResponse:
 BasicOCSPresponse basicOCSPResponse = new BasicOCSPResponse();
 // set the ResponderID:
 ResponderID responderID = ...;
 basicOCSPResponse.setResponderID(responderID);
 // set the producedAt date:
 basicOCSPResponse.setProducedAt(new Date());
 // add the single responses:
 basicOCSPResponse.setSingleResponses(singleResponses);

Before signing the BasicOCSPResponse extensions may be added and the certificates of the signer may be included to help the OCSP requestor to verify the signature, e.g.:

 // the certificates of the responder
 X509Certificate[] responderCerts = ...;
 // the private key of the responder, used for signing:
 PrivateKey responderKey = ...;
 // set the certificates:
 basicOCSPResponse.setCertificates(responderCerts);
 // sign the response:
 ocspResponse.sign(AlgorithmID.sha1WithRSAEncryption, responderKey);

Finally the BasicOCSPResponse has to be included into an OCSPResponse message for being sent back to the requestor:

 OCSPResponse ocspResponse = new OCSPResponse(basicOCSPResponse);
 OutputStream os = ...;
 // encode the OCSP response
 ocspResponse.writeTo(os);

A requestor receiving an ocsp response, checks the response status and -- if successful -- gets the BasicOCSPResponse included:

 // the stream supplying the encoded OCSP response:
 InputStream is = ...;
 OCSPResponse ocspResponse = new OCSPResponse(is);
 // get the response status:
 int responseStatus = ocspResponse.getResponseStatus();
 if (responseStatus != OCSPResponse.successful) {
   System.out.println("Not successful; got response status: " + 
                       ocspResponse.getResponseStatusName());   
   ...  
 } else {
   // get the basicOCSPResponse
   BasicOCSPResponse basicOCSPResponse = 
      (BasicOCSPResponse)ocspResponse.getResponse();

After verifying the signature of the responder the basicOCSPResponse may be searched for the single response given for a particular certificate request sent to the server:

 // verify the response
 try {
  if (basicOCSPResponse.containsCertificates()) {
    X509Certificate signerCert = basicOCSPResponse.verify(); 
    System.out.println("Signature ok from response signer " + signerCert.getSubjectDN());
  } else {
    basicOCSPResponse.verify(responderCerts[0].getPublicKey()); 
    System.out.println("Signature ok!");
  }
 } catch (SignatureException ex) {
   System.out.println("Signature verification error!!!"); 
 } 
 // is there a single response for our request?
 SingleResponse singleResponse = null;
 try {
   singleResponse = basicOCSPResponse.getSingleResponse(CertID);
 } catch (OCSPException ex) {
   singleResponse = basicOCSPResponse.getSingleResponse(targetCerts[0], 
     targetCerts[1], null);  
 }    
 if (singleResponse != null) {
   System.out.println("Status information got for cert: ");
   System.out.println(singleResponse.getCertStatus());
   ...
 } else {
   System.out.println("No response got!");

See Also:: OCSPRequest, Request, OCSPResponse, ResponseBytes, SingleResponse, CertID, CertStatus

Field Summary

Fields
Modifier and Type Field and Description

static ObjectID responseType
The response type of the BasicOCSPResponse.

Fields
Modifier and Type	Field and Description
`static ObjectID`	`responseType` The response type of the BasicOCSPResponse.

Constructor Summary

Constructors
Constructor and Description
`BasicOCSPResponse()` Default constructor for creating a new empty BasicOCSPResponse.
`BasicOCSPResponse(byte[] array)` Creates a BasicOCSPResponse form a PEM or DER byte array.
`BasicOCSPResponse(java.io.InputStream is)` Creates a BasicOCSPResponse from an input stream.

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`void`	`addExtension(V3Extension e)` Adds the given extension.
`boolean`	`containsCertificates()` Checks if certificates are included.
`int`	`countExtensions()` Returns the number of extensions included in this basic ocsp response.
`int`	`countSingleResponses()` Returns the number of single responses included.
`void`	`decode(ASN1Object obj)` Decodes a BasicOCSPResponse from an ASN1Object.
`void`	`decode(byte[] enc)` Decodes a BasicOCSPResponse from an byte array.
`void`	`decode(java.io.InputStream is)` Decodes a BasicOCSPResponse from an InputStream.
`CertificateResponse`	`getCertificateResponse(CertID certid)` Searches for the certificate response corresponding to the certificate identified by the given CertID.
`CertificateResponse`	`getCertificateResponse(X509Certificate targetCert, X509Certificate issuerCert)` Searches this BasicOCSPReponse for status information about the certificate identified by the given certificate information.
`X509Certificate[]`	`getCertificates()` Returns the signer certificates that may be included in this response.
`byte[]`	`getEncoded()` Returns this BasicOCSPResponse as DER encoded ASN.1 data structure
`V3Extension`	`getExtension(ObjectID oid)` Returns a specific extension, identified by its object identifier.
`byte[]`	`getNonce()` A convenience method for getting the value of the Nonce extension, if included in this response.
`java.util.Date`	`getProducedAt()` Returns the `producedAt` date of this BasicOCSPResponse.
`ResponderID`	`getResponderID()` Returns the responderID.
`ObjectID`	`getResponseType()` Returns the response type identifying this `BasicOCSPResponse` The corresponding OID string is "1.3.6.1.5.5.7.1.11.1".
`byte[]`	`getSignature()` Returns the signature of this BasicOCSPResponse.
`AlgorithmID`	`getSignatureAlgorithm()` Returns the signature algorithm of this BasicOCSPResponse.
`SingleResponse`	`getSingleResponse(CertID certid)` Searches for the single response corresponding to the certificate identified by the given CertID.
`SingleResponse`	`getSingleResponse(X509Certificate targetCert, X509Certificate issuerCert)` Searches this BasicOCSPReponse for status information about the certificate identified by the given certificate information.
`SingleResponse[]`	`getSingleResponses()` Returns all single responses included in this BasicOCSPResponse.
`byte[]`	`getTBSResponseData()` Returns the DER encoded `TBSResponseData` ASN.1 data structure specifying response data to be signed.
`int`	`getVersion()` Returns the version number of this BasicOCSPResponse as `int`.
`boolean`	`hasExtensions()` Checks, if there are any extensions included in this basic ocsp response.
`boolean`	`hasUnsupportedCriticalExtension()` Returns true if there are unsupported critical extensions.
`java.util.Enumeration`	`listExtensions()` Returns an enumeration of all extensions included in this basic ocsp response.
`void`	`removeAllExtensions()` Removes all extensions from this basic ocsp response.
`boolean`	`removeExtension(ObjectID oid)` Removes the extension specified by its object identifier.
`void`	`setCertificates(X509Certificate[] signerCerts)` Sets the certificates to be included into this BasicOCSPResponse.
`void`	`setNonce(byte[] nonce)` A convenience method for setting the value of the Nonce extension.
`void`	`setProducedAt(java.util.Date producedAtDate)` Sets the `producedAt` date of this certificate.
`void`	`setResponderID(ResponderID responderID)` Sets the responderID.
`void`	`setSignature(AlgorithmID signatureAlg, byte[] signature)` Sets the signature value of this BasicOCSPResponse.
`void`	`setSingleResponses(SingleResponse[] singleResponses)` Sets the single responses of this BasicOCSPResponse.
`void`	`sign(AlgorithmID signatureAlg, java.security.PrivateKey issuerPK)` Signs the BasicOCSPResponse with the private key of the issuer.
`void`	`sign(AlgorithmID signatureAlg, java.security.PrivateKey issuerPK, java.lang.String provider)` Signs the BasicOCSPResponse with the private key of the issuer.
`ASN1Object`	`toASN1Object()` Returns the BasicOCSPResponse as an ASN1Object.
`java.lang.String`	`toString()` Returns a string that represents the contents of this BasicOCSPResponse.
`java.lang.String`	`toString(boolean detailed)` Returns a string that represents the contents of this BasicOCSPResponse.
`X509Certificate`	`verify()` Verifies this BasicOCSPResponse using the included signer certificates.
`void`	`verify(java.security.PublicKey key)` Uses the given public key to verify this BasicOCSPResponse.
`void`	`verify(java.security.PublicKey key, java.lang.String sigProvider)` Uses the given public key to verify this BasicOCSPResponse.
`void`	`writeTo(java.io.OutputStream os)` Writes this BasicOCSPResponse DER encoded to the given output stream.

Methods inherited from class iaik.x509.ocsp.Response
getName

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

- Field Detail
  - responseType
```
public static final ObjectID responseType
```
    The response type of the BasicOCSPResponse. The corresponding OID string is "1.3.6.1.5.5.7.48.1.1".
- Constructor Detail
  - BasicOCSPResponse
```
public BasicOCSPResponse()
```
    Default constructor for creating a new empty BasicOCSPResponse.
    Any value may be set using the corrseponding set<Value> method. The version number per default is set to 0 indicating a v1 response.
  - BasicOCSPResponse
```
public BasicOCSPResponse(java.io.InputStream is)
                  throws java.io.IOException,
                         CodingException
```
    Creates a BasicOCSPResponse from an input stream.
    The supplied BasicOCSPResponse can be in PEM or DER format. This constructor reads a BasicOCSPResponse previously written with method writeTo(OutputStream).
    For instance:
```
 InputStream is = ...;
 BasicOCSPResponse response = new BasicOCSPResponse(is);
 is.close();
 
```
    Parameters:
    
    is - InputStream from which to create the BasicOCSPResponse
    
    Throws:
    
    java.io.IOException - if the response could not be read
    
    CodingException - if there is a problem with the response
  - BasicOCSPResponse
```
public BasicOCSPResponse(byte[] array)
                  throws CodingException
```
    Creates a BasicOCSPResponse form a PEM or DER byte array.
    This constructor may be used for parsing an already exisiting BasicOCSPResponse ASN.1 object, supplied as DER encoded byte array, which may have been created by calling method getEncoded.
    
    Parameters:
    
    array - the byte array containing the DER encoded response
    
    Throws:
    
    CodingException - if the response cannot be decoded
- Method Detail
  - decode
```
public void decode(ASN1Object obj)
            throws CodingException
```
    Decodes a BasicOCSPResponse from an ASN1Object.
    The given ASN1Object represents an already existing BasicOCSPResponse which may have been created by calling the toASN1Object method.
    
    Parameters:
    
    obj - the ASN1Object which representing the response
    
    Throws:
    
    CodingException - if there is a problem when parsing the response
  - decode
```
public void decode(byte[] enc)
            throws CodingException
```
    Decodes a BasicOCSPResponse from an byte array. The given byte array supplies the OCSP response in DER encoded format. This method internally is called when creating a BasicOCSPResponse from an byte array.
    
    Specified by:
    
    decode in class Response
    
    Parameters:
    
    enc - the byte array from where the response should be read
    
    Throws:
    
    CodingException - if an decoding/parsing error occurs
  - decode
```
public void decode(java.io.InputStream is)
            throws java.io.IOException
```
    Decodes a BasicOCSPResponse from an InputStream. The given InputStream supplies the OCSP response in DER encoded format. This method internally is called when creating a BasicOCSPResponse from an InputStream.
    
    Parameters:
    
    is - the InputStream from where the response should be read
    
    Throws:
    
    java.io.IOException - if something is wrong with the InputStream
  - sign
```
public void sign(AlgorithmID signatureAlg,
                 java.security.PrivateKey issuerPK)
          throws OCSPException,
                 java.security.InvalidKeyException,
                 java.security.NoSuchAlgorithmException
```
    Signs the BasicOCSPResponse with the private key of the issuer.
    
    Parameters:
    
    signatureAlg - the AlgorithmID of the signature algorithm
    
    issuerPK - the private key of the issuer
    
    Throws:
    
    OCSPException - if the response could not be signed
    
    java.security.InvalidKeyException - if the format of the key is wrong
    
    java.security.NoSuchAlgorithmException - if there is no implementation for the specified algorithm
  - sign
```
public void sign(AlgorithmID signatureAlg,
                 java.security.PrivateKey issuerPK,
                 java.lang.String provider)
          throws OCSPException,
                 java.security.InvalidKeyException,
                 java.security.NoSuchAlgorithmException
```
    Signs the BasicOCSPResponse with the private key of the issuer.
    
    Parameters:
    
    signatureAlg - the AlgorithmID of the signature algorithm
    
    issuerPK - the private key of the issuer
    
    provider - the name of the provider supplying the Signature engine to be used
    
    Throws:
    
    OCSPException - if the response could not be signed
    
    java.security.InvalidKeyException - if the format of the key is wrong
    
    java.security.NoSuchAlgorithmException - if there is no implementation for the specified algorithm
  - setSignature
```
public void setSignature(AlgorithmID signatureAlg,
                         byte[] signature)
                  throws OCSPException
```
    Sets the signature value of this BasicOCSPResponse.
    This method provides an alternative way to method sign for "signing" this basic OCSP response with a precalculated signature value. If using this method please make sure that the signature value provided actually has beeb calculated over the TBS responseData.
    
    Parameters:
    
    signatureAlg - the AlgorithmID of the signature algorithm
    
    signature - the (precalculated) signature value
    
    Throws:
    
    OCSPException - if the response could not be signed
  - getEncoded
```
public byte[] getEncoded()
```
    Returns this BasicOCSPResponse as DER encoded ASN.1 data structure
    
    Specified by:
    
    getEncoded in class Response
    
    Returns:
    
    a byte array holding the DER encoded BasicOCSPResponse as ASN.1 data structure
  - getVersion
```
public int getVersion()
```
    Returns the version number of this BasicOCSPResponse as int. Default version: v1.
    ASN.1 definition:
    Version ::= INTEGER { v1(0) }
    Returns:
    
    version number of the response as int, 1 for v1.
  - getResponseType
```
public ObjectID getResponseType()
```
    Returns the response type identifying this BasicOCSPResponse The corresponding OID string is "1.3.6.1.5.5.7.1.11.1".
    
    Specified by:
    
    getResponseType in class Response
    
    Returns:
    
    the response type identifying this BasicOCSPResponse
  - getResponderID
```
public ResponderID getResponderID()
```
    Returns the responderID.
    
    Returns:
    
    the responderID identifying the responder by name or key
  - getSingleResponses
```
public SingleResponse[] getSingleResponses()
```
    Returns all single responses included in this BasicOCSPResponse.
    
    Returns:
    
    an Enumeration holding all the single responses included in this BasicOCSPResponse; the list may be null
  - countSingleResponses
```
public int countSingleResponses()
```
    Returns the number of single responses included.
    
    Returns:
    
    the number of single resonses included
  - getSingleResponse
```
public SingleResponse getSingleResponse(X509Certificate targetCert,
                                        X509Certificate issuerCert)
                                 throws OCSPException
```
    Searches this BasicOCSPReponse for status information about the certificate identified by the given certificate information.
    This method only calls method getCertificateResponse and casts the result to SingleResponse.
    Each particular single response included is expected to be identified by its CertID identifying the corresponding certificate.
```
    CertID          ::=     SEQUENCE {
    hashAlgorithm       AlgorithmIdentifier,
    issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
    issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
    serialNumber        CertificateSerialNumber }

 
```
    When searching an OCSP response for a SingleResponse the search has to be done by checking the CertID identifiers of the single responses included.
    
    If method getSingleResponse does not find a single response for a given CertID thereby throwing an OCSPException there maybe single responses using different hash algorithms as the one queried for. In this case this method can be used for stepping through the single responses included and using their CertID types for searching for a single response for the cert identified by the given certificate data. t.
    Assumimg, for instance, that you have used method getSingleResponse for asking if a response for your request is included. The search has stopped by throwing an OCSPException indicating that no single response for your CertID is included
    Parameters:
    
    targetCert - the target cert, if required
    
    issuerCert - the cert of the target cert issuer, if required
    
    Returns:
    
    a single response giving status information about the certificate identified by the given certificate information; or null if no single response for the certificate in mind is included
    
    Throws:
    
    OCSPException - if some processing error occurs, e.g. if the CertID's hash algorithm is not supported by the installed providers
  - getSingleResponse
```
public SingleResponse getSingleResponse(CertID certid)
                                 throws OCSPException
```
    Searches for the single response corresponding to the certificate identified by the given CertID.
    This method only calls method getCertificateResponse and casts the result to SingleResponse.
    Each single response included in this BasicOCSPResponse is identified by its CertID ID. This method steps through all the single responses included in this BasicOCSPResponse and compares their CertIDs with the given CertID.
    
    Parameters:
    
    certid - the CertID of the certificate for which status information shall be obtained
    
    Returns:
    
    a single response giving status information about the certificate identified by the given reqCert; or null if no single response for the certificate in mind is included
    
    Throws:
    
    OCSPException - if a single response for the given CertID cannot be found, but single responses include hash algorithms different to the given certID´s one; in this case you may try method getSingleResponse to use the CertID types of the single responses included
  - getCertificateResponse
```
public CertificateResponse getCertificateResponse(X509Certificate targetCert,
                                                  X509Certificate issuerCert)
                                           throws OCSPException
```
    Searches this BasicOCSPReponse for status information about the certificate identified by the given certificate information.
    This method overrides the corresponding method of the parent Response class.
    Each particular certificate response included is expected to be identified by its CertID When searching an OCSP response for a CertificateResponse the search has to be done by checking the CertID identifiers of the certificate responses included.
    If method getCertificateResponse does not find a certificate response for a given CertID thereby throwing an OCSPException.
    - If a certificate response uses a reqCert of type certID, both targetCert and issuerCert are required; generalName is ignored. From the given certs, a certID is created and checked for equality with the certID of the reqCert of the particular certificate response. Note that any reqCert type can be created if target cert and issuer cert a set.
      Assumimg, for instance, that you have used method getCertificateResponse for asking if a response for your request is included. The search has stopped by throwing an OCSPException indicating that no certificate response for your CertID is included, but there are certificate responses present having a different CertID type.
    Specified by:
    
    getCertificateResponse in class Response
    
    Parameters:
    
    targetCert - the target cert, if required
    
    issuerCert - the cert of the target cert issuer, if required
    
    Returns:
    
    a certificate response giving status information about the certificate identified by the given certificate information; or null if no certificate response for the certificate in mind is included
    
    Throws:
    
    OCSPException - if some processing error occurs, e.g. if the CertID's hash algorithm is not supported by the installed providers
  - getCertificateResponse
```
public CertificateResponse getCertificateResponse(CertID certid)
                                           throws OCSPException
```
    Searches for the certificate response corresponding to the certificate identified by the given CertID.
    This method overrides the corresponding method of the parent Response class.
    Each single response included in this BasicOCSPResponse is identified by its CertID ID. This method steps through all the single responses included in this BasicOCSPResponse and compares their CertIDs with the given CertID.
    
    Specified by:
    
    getCertificateResponse in class Response
    
    Parameters:
    
    certid - the CertID of the certificate for which status information shall be obtained
    
    Returns:
    
    a certificate response giving status information about the certificate identified by the given CertID; or null if no certificate response for the certificate in mind is included
    
    Throws:
    
    OCSPException - if a single response for the given CertID cannot be found, but single responses include hash algorithms different to the given certID´s one; in this case you may try method getSingleResponse to use the CertID types of the single responses included
  - getProducedAt
```
public java.util.Date getProducedAt()
```
    Returns the producedAt date of this BasicOCSPResponse.
    The producedAt value denotes the time at which the response was produced and can be set using the setProducedAt method.
    
    Returns:
    
    the date at which the response was produced, or null if the producedAt date has yet not been set
  - getTBSResponseData
```
public byte[] getTBSResponseData()
                          throws CodingException
```
    Returns the DER encoded TBSResponseData ASN.1 data structure specifying response data to be signed.
```
 ResponseData ::= SEQUENCE {
   version            [0] EXPLICIT Version DEFAULT v1,
   responderID            ResponderID,
   producedAt             GeneralizedTime,
   responses              SEQUENCE OF SingleResponse,
   responseExtensions [1] EXPLICIT Extensions OPTIONAL }
 
```
    Returns:
    
    the inherent TBSResponseData as DER encoded ASN.1 structure
    
    Throws:
    
    CodingException - if an encoding error occurs
  - getSignature
```
public byte[] getSignature()
```
    Returns the signature of this BasicOCSPResponse. The signature is defined as an ASN.1 BIT STRING structure. This method returns the inherent signature value as byte array.
    
    Returns:
    
    the signature value as byte array
  - getSignatureAlgorithm
```
public AlgorithmID getSignatureAlgorithm()
```
    Returns the signature algorithm of this BasicOCSPResponse.
    
    Returns:
    
    the AlgorithmID of the algorithm used for signing this response
    
    See Also:
    
    AlgorithmID
  - verify
```
public void verify(java.security.PublicKey key)
            throws java.security.NoSuchAlgorithmException,
                   java.security.InvalidKeyException,
                   java.security.SignatureException
```
    Uses the given public key to verify this BasicOCSPResponse.
    
    Parameters:
    
    key - the public key (of the issuer) to verify the response
    
    Throws:
    
    java.security.NoSuchAlgorithmException - if there is no implementation for the algorithm that has been used to sign this response
    
    java.security.InvalidKeyException - if the format of the public key is wrong
    
    java.security.SignatureException - if the signature does not verify
  - verify
```
public void verify(java.security.PublicKey key,
                   java.lang.String sigProvider)
            throws java.security.NoSuchAlgorithmException,
                   java.security.InvalidKeyException,
                   java.security.SignatureException
```
    Uses the given public key to verify this BasicOCSPResponse.
    
    Parameters:
    
    key - the public key (of the issuer) to verify the response
    
    sigProvider - the crypto provider supplying the Signature engine to be used
    
    Throws:
    
    java.security.NoSuchAlgorithmException - if there is no implementation for the algorithm that has been used to sign this response
    
    java.security.InvalidKeyException - if the format of the public key is wrong
    
    java.security.SignatureException - if the signature does not verify
  - verify
```
public X509Certificate verify()
                       throws java.security.NoSuchAlgorithmException,
                              java.security.InvalidKeyException,
                              java.security.SignatureException,
                              OCSPException
```
    Verifies this BasicOCSPResponse using the included signer certificates.
    This method only can be used for verifying this response if signer certificates are included. If so, this method assumes that all certificates included belong to same chain. It tries to sort the chain to get the signer certificate public key for verifying the response. If no certificates are included or the chain cannot be sorted, an OCSPException is thrown. In this case you may use method verify for verifying the response with the right public key supplied by other means.
    
    Returns:
    
    the certificate of the signer; if included and verification is successful
    
    Throws:
    
    java.security.NoSuchAlgorithmException - if there is no implementation for the algorithm that has been used to sign this response
    
    java.security.InvalidKeyException - if the format of the public key is wrong
    
    java.security.SignatureException - if the signature does not verify
    
    OCSPException - if no certs are included or the signer cert cannot be found in the certificate list included
  - containsCertificates
```
public boolean containsCertificates()
```
    Checks if certificates are included.
    
    Returns:
    
    true if certificates are included, false otherwise
  - toASN1Object
```
public ASN1Object toASN1Object()
```
    Returns the BasicOCSPResponse as an ASN1Object.
    
    Returns:
    
    this response as ASN1Object
  - writeTo
```
public void writeTo(java.io.OutputStream os)
             throws java.io.IOException
```
    Writes this BasicOCSPResponse DER encoded to the given output stream.
    
    Parameters:
    
    os - the output stream where the response shall be written to
    
    Throws:
    
    java.io.IOException - if an I/O error occurs
  - setResponderID
```
public void setResponderID(ResponderID responderID)
```
    Sets the responderID.
    
    Parameters:
    
    responderID - the responderID identifying the responder by name or key
  - setProducedAt
```
public void setProducedAt(java.util.Date producedAtDate)
```
    Sets the producedAt date of this certificate.
    For instance:
```
 GregorianCalendar date = (GregorianCalendar)Calendar.getInstance();
 response.setProducedAt(date.getTime());
 
```
    Parameters:
    
    producedAtDate - the Date at which this response is produced
  - setSingleResponses
```
public void setSingleResponses(SingleResponse[] singleResponses)
```
    Sets the single responses of this BasicOCSPResponse. Any response already included is cleared.
    
    Parameters:
    
    singleResponses - the single responses to be set
  - setCertificates
```
public void setCertificates(X509Certificate[] signerCerts)
```
    Sets the certificates to be included into this BasicOCSPResponse.
    
    Parameters:
    
    signerCerts - the certificates of the signer to be included
  - getCertificates
```
public X509Certificate[] getCertificates()
```
    Returns the signer certificates that may be included in this response.
    
    Returns:
    
    the certificates of the signer, if included; null otherwise
  - addExtension
```
public void addExtension(V3Extension e)
                  throws X509ExtensionException
```
    Adds the given extension.
    The extension to be added shall be an implemented V3Extension. If an extension with the same object ID already exists, it is replaced.
    For reading back some extension use the getExtension(ObjectID) method.
    
    Parameters:
    
    e - the extension to be added
    
    Throws:
    
    X509ExtensionException - if the extension cannot be added
  - removeExtension
```
public boolean removeExtension(ObjectID oid)
```
    Removes the extension specified by its object identifier.
    
    Parameters:
    
    oid - the object ID of the extension to remove
    
    Returns:
    
    true if the extension has been successfully removed, false otherwise
  - removeAllExtensions
```
public void removeAllExtensions()
```
    Removes all extensions from this basic ocsp response.
  - listExtensions
```
public java.util.Enumeration listExtensions()
```
    Returns an enumeration of all extensions included in this basic ocsp response.
    The returned enumeration may contain unknown extensions (instances of UnknownExtension if there are any extensions included in basic response, for which there exists no registered implementation, and it may contain error extensions (instances of ErrorExtension) indicating extensions which cannot be parsed properly because of some kind of error.
    
    Returns:
    
    an enumeration of the extensions, or null if there are no extensions present at all
  - hasExtensions
```
public boolean hasExtensions()
```
    Checks, if there are any extensions included in this basic ocsp response.
    
    Returns:
    
    true if there are extensions, false if not
  - hasUnsupportedCriticalExtension
```
public boolean hasUnsupportedCriticalExtension()
```
    Returns true if there are unsupported critical extensions.
    
    Returns:
    
    true, if there are unsupported critical extensions
  - countExtensions
```
public int countExtensions()
```
    Returns the number of extensions included in this basic ocsp response.
    
    Returns:
    
    the number of extensions
  - getExtension
```
public V3Extension getExtension(ObjectID oid)
                         throws X509ExtensionInitException
```
    Returns a specific extension, identified by its object identifier.
    If the extension cannot be initialized for some reason, an X509ExtensionInitException is thrown. If the requested extension is an unknown extension, which is not supported by a registered implementation, this method creates and returns an UnknownExtension which may be queried for obtaining as much information as possible about the unknown extension.
    
    Parameters:
    
    oid - the object ID of the extension
    
    Returns:
    
    the desired extension or null if the requested extension is not present
    
    Throws:
    
    X509ExtensionInitException - if the extension can not be initialized
  - setNonce
```
public void setNonce(byte[] nonce)
              throws X509ExtensionException
```
    A convenience method for setting the value of the Nonce extension.
    This method provides an convenient alternative to method addExtension for including the Nonce extension in this response. From the given nonce value a Nonce extension object is created an added to the list of response extensions.
    The Nonce extension can be used for cryptographically binding a request and a response to prevent replay attacks.
    
    Parameters:
    
    nonce - the nonce value
    
    Throws:
    
    X509ExtensionException - if the Nonce extension cannot be created
  - getNonce
```
public byte[] getNonce()
                throws X509ExtensionInitException
```
    A convenience method for getting the value of the Nonce extension, if included in this response.
    This method provides an convenient alternative to method getExtension for getting the value of the Nonce extension, if included in this response.
    The Nonce extension can be used for cryptographically binding a request and a response to prevent replay attacks.
    
    Returns:
    
    the value of the Nonce extension, if included in this response; otherwise null
    
    Throws:
    
    X509ExtensionInitException - if the Nonce extension cannot be initialized from its encoding
  - toString
```
public java.lang.String toString()
```
    Returns a string that represents the contents of this BasicOCSPResponse.
    
    Specified by:
    
    toString in class Response
    
    Returns:
    
    the string representation
  - toString
```
public java.lang.String toString(boolean detailed)
```
    Returns a string that represents the contents of this BasicOCSPResponse.
    
    Parameters:
    
    detailed - whether or not to give detailed information about the included single responses and extensions
    
    Returns:
    
    the string representation

Class BasicOCSPResponse

Field Summary

Constructor Summary

Method Summary

Methods inherited from class iaik.x509.ocsp.Response

Methods inherited from class java.lang.Object

Field Detail

responseType

Constructor Detail

BasicOCSPResponse

BasicOCSPResponse

BasicOCSPResponse

Method Detail

decode

decode

decode

sign

sign

setSignature

getEncoded

getVersion

getResponseType

getResponderID

getSingleResponses

countSingleResponses

getSingleResponse

getSingleResponse

getCertificateResponse

getCertificateResponse

getProducedAt

getTBSResponseData

getSignature

getSignatureAlgorithm

verify

verify

verify

containsCertificates

toASN1Object

writeTo

setResponderID

setProducedAt

setSingleResponses

setCertificates

getCertificates

addExtension

removeExtension

removeAllExtensions

listExtensions

hasExtensions

hasUnsupportedCriticalExtension

countExtensions

getExtension

setNonce

getNonce

toString

toString