Author: tilman
Date: Wed Aug 19 13:34:03 2026
New Revision: 1937231
Log:
PDFBOX-6237: add LDAP download test; add some URIs
Added:
pdfbox/branches/2.0/examples/src/test/java/org/apache/pdfbox/examples/signature/
pdfbox/branches/2.0/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/
pdfbox/branches/2.0/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
(contents, props changed)
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 13:29:21 2026 (r1937230)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 13:34:03 2026 (r1937231)
@@ -91,7 +91,14 @@ public class SigUtils
"http://crl.adobe.com/cds.crl";,
"http://subca.crl.certum.pl/ctsca2021.crl";,
"http://subca.ocsp-certum.com";,
- "http://crl.certum.pl/ctnca2.crl";));
+ "http://crl.certum.pl/ctnca2.crl";,
+ "http://www.freetsa.org/tsa.crt";,
+ "http://www.freetsa.org:2560";,
+ "http://www.freetsa.org/crl/root_ca.crl";,
+ "http://www.gemboxsoftware.com/test/pki/cert/GemBoxCA.crt";,
+ "http://www.gemboxsoftware.com/test/pki/cert/GemBoxRSA.crt";,
+ "http://www.ca.gov.si/crt/si-trust-root.crt";,
+
"ldap://x500.gov.si/cn=SI-TRUST%20Root,oi=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList";));
private SigUtils()
{
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 13:29:21 2026 (r1937230)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 13:34:03 2026 (r1937231)
@@ -231,7 +231,7 @@ public final class CRLVerifier
/**
* Downloads CRL from given URL. Supports http, https and ldap based URLs.
*/
- private static X509CRL downloadCRL(String crlURL) throws IOException,
+ static X509CRL downloadCRL(String crlURL) throws IOException,
CertificateVerificationException, NamingException,
GeneralSecurityException, URISyntaxException
{
if (crlURL.startsWith("http://";) || crlURL.startsWith("https://";))
Added:
pdfbox/branches/2.0/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++
pdfbox/branches/2.0/examples/src/test/java/org/apache/pdfbox/examples/signature/cert/CRLVerifierTest.java
Wed Aug 19 13:34:03 2026 (r1937231)
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2026 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.pdfbox.examples.signature.cert;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
+import java.security.Security;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import javax.naming.NamingException;
+
+import static org.junit.Assert.assertTrue;
+import org.junit.Test;
+
+import org.apache.pdfbox.examples.signature.SigUtils;
+import org.apache.pdfbox.pdmodel.encryption.SecurityProvider;
+import org.junit.BeforeClass;
+
+/**
+ * @author Tilman Hausherr
+ */
+public class CRLVerifierTest
+{
+ @BeforeClass
+ static public void init() throws IOException
+ {
+ // CertificateVerifier.isSelfSigned() fails without this
+ Security.addProvider(SecurityProvider.getProvider());
+ }
+
+ /**
+ * Test downloadCRLFromLDAP(). Get a CRL through an LDAP URI and verify it
with the root certificate.
+ *
+ * @throws IOException
+ * @throws CertificateVerificationException
+ * @throws NamingException
+ * @throws URISyntaxException
+ * @throws GeneralSecurityException
+ */
+ @Test
+ public void testLDAP() throws IOException,
CertificateVerificationException, NamingException, URISyntaxException,
GeneralSecurityException
+ {
+ // ChatGPT prompt if the LDAP URI no longer works:
+ // Find me a certificate that has a CRL that must be downloaded
through LDAP.
+ // This gets
+ //
https://www.si-trust.gov.si/assets/Politike/si-pass-ca/verzija-2-7/SI-PASS-CA-politika-v2.7-2025.pdf
+ // which include the LDAP URL and the root certificate.
+ // Note that "%20" is needed for the spaces.
+ // ChatGPT wasn't able to find a certificate where the CRL
Distribution Points extension contains an LDAP URI and no HTTP/HTTPS URI.
+ X509CRL crl =
CRLVerifier.downloadCRL("ldap://x500.gov.si/cn=SI-TRUST%20Root,oi=VATSI-17659957,o=Republika%20Slovenija,c=SI?certificateRevocationList";);
+ InputStream is =
SigUtils.openURL("http://www.ca.gov.si/crt/si-trust-root.crt";);
+ CertificateFactory factory = CertificateFactory.getInstance("X.509");
+ X509Certificate cert = (X509Certificate)
factory.generateCertificate(is);
+ is.close();
+ assertTrue(CertificateVerifier.isSelfSigned(cert));
+ crl.verify(cert.getPublicKey());
+ }
+
+}
