-
Bug
-
Resolution: Fixed
-
P2
-
7u40
-
b36
-
Verified
| Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
|---|---|---|---|---|---|---|
| JDK-8022425 | 7u60 | Vincent Ryan | P2 | Resolved | Fixed | b01 |
| JDK-8022377 | 7u51 | Vincent Ryan | P2 | Resolved | Fixed | b01 |
| JDK-8022017 | 7u45 | Vincent Ryan | P2 | Closed | Fixed | b05 |
PKIX certpath validation is normally performed using the current time.
It may also be requested to be performed at a specific time.
OCSP is a network protocol for checking whether a certificate has been revoked.
OCSP responses are returned with a specific validity interval.
The OCSP client examines that validity interval to ensure that the response is still current.
This check is performed incorrectly for backdated OCSP requests.
Specifically, the current time should be used when validating the
OCSP response's thisUpdate and nextUpdate, rather than the requested time.
It may also be requested to be performed at a specific time.
OCSP is a network protocol for checking whether a certificate has been revoked.
OCSP responses are returned with a specific validity interval.
The OCSP client examines that validity interval to ensure that the response is still current.
This check is performed incorrectly for backdated OCSP requests.
Specifically, the current time should be used when validating the
OCSP response's thisUpdate and nextUpdate, rather than the requested time.
- backported by
-
JDK-8022377 Valid OCSP responses are rejected for backdated enquiries
-
- Resolved
-
-
-
- Resolved
-
-
-
- Closed
-
- relates to
-
-
- Closed
-
-
-
- Closed
-