Author: tilman
Date: Wed Aug 19 13:34:09 2026
New Revision: 1937232
Log:
PDFBOX-6237: add LDAP download test; add some URIs
Added:
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
(contents, props changed)
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
==============================================================================
---
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 13:34:03 2026 (r1937231)
+++
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 13:34:09 2026 (r1937232)
@@ -93,7 +93,14 @@ public class SigUtils
"http://crl.adobe.com/cds.crl";,
"http://subca.crl.certum.pl/ctsca2021.crl";,
"http://subca.ocsp-certum.com";,
- "http://crl.certum.pl/ctnca2.crl";);
+ "http://crl.certum.pl/ctnca2.crl";,
+ "http://www.freetsa.org/tsa.crt";,
+ "http://www.freetsa.org:2560";,
+ "http://www.freetsa.org/crl/root_ca.crl";,
+ "http://www.gemboxsoftware.com/test/pki/cert/GemBoxCA.crt";,
+ "http://www.gemboxsoftware.com/test/pki/cert/GemBoxRSA.crt";,
+ "http://www.ca.gov.si/crt/si-trust-root.crt";,
+
"ldap://x500.gov.si/cn=SI-TRUST%20Root,oi=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList";);
private SigUtils()
{
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
==============================================================================
---
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 13:34:03 2026 (r1937231)
+++
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 13:34:09 2026 (r1937232)
@@ -234,7 +234,7 @@ public final class CRLVerifier
/**
* Downloads CRL from given URL. Supports http, https and ldap based URLs.
*/
- private static X509CRL downloadCRL(String crlURL) throws IOException,
+ static X509CRL downloadCRL(String crlURL) throws IOException,
CertificateVerificationException, NamingException,
URISyntaxException, GeneralSecurityException
{
if (crlURL.startsWith("http://";) || crlURL.startsWith("https://";))
Added:
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
pdfbox/trunk/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
Wed Aug 19 13:34:09 2026 (r1937232)
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2026 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.pdfbox.examples.signature.cert;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import javax.naming.NamingException;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import org.junit.jupiter.api.Test;
+
+import org.apache.pdfbox.examples.signature.SigUtils;
+
+/**
+ * @author Tilman Hausherr
+ */
+class CRLVerifierTest
+{
+ /**
+ * Test downloadCRLFromLDAP(). Get a CRL through an LDAP URI and verify it
with the root certificate.
+ *
+ * @throws IOException
+ * @throws CertificateVerificationException
+ * @throws NamingException
+ * @throws URISyntaxException
+ * @throws GeneralSecurityException
+ */
+ @Test
+ void testLDAP() throws IOException, CertificateVerificationException,
NamingException, URISyntaxException, GeneralSecurityException
+ {
+ // ChatGPT prompt if the LDAP URI no longer works:
+ // Find me a certificate that has a CRL that must be downloaded
through LDAP.
+ // This gets
+ //
https://www.si-trust.gov.si/assets/Politike/si-pass-ca/verzija-2-7/SI-PASS-CA-politika-v2.7-2025.pdf
+ // which include the LDAP URL and the root certificate.
+ // Note that "%20" is needed for the spaces.
+ // ChatGPT wasn't able to find a certificate where the CRL
Distribution Points extension contains an LDAP URI and no HTTP/HTTPS URI.
+ X509CRL crl =
CRLVerifier.downloadCRL("ldap://x500.gov.si/cn=SI-TRUST%20Root,oi=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList";);
+ try (InputStream is =
SigUtils.openURL("http://www.ca.gov.si/crt/si-trust-root.crt";))
+ {
+ CertificateFactory factory =
CertificateFactory.getInstance("X.509");
+ X509Certificate cert = (X509Certificate)
factory.generateCertificate(is);
+ assertTrue(CertificateVerifier.isSelfSigned(cert));
+ assertDoesNotThrow(() -> crl.verify(cert.getPublicKey()));
+ }
+ }
+
+}
