bc-java bc-fips-2.0.jar: java.security.cert.CertPathValidatorException: OCSP responder failed: 1

I am using bc-fips-2.0.jar to do ocsp check for certificate generated from entrust. The ocsp responder url is: http://ocsps.ssl.com/

JDK version: openjdk version "11.0.25" 2024-10-15 LTS OpenJDK Runtime Environment Zulu11.76+22-SA (build 11.0.25+9-LTS) OpenJDK 64-Bit Server VM Zulu11.76+22-SA (build 11.0.25+9-LTS, mixed mode)

However, I keep getting the following error when doing ocsp check:

Caused by: java.security.cert.CertPathValidatorException: OCSP responder failed: 1
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.OcspCache.getOcspResponse(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.ProvOcspRevocationChecker.check(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.ProvRevocationChecker.check(Unknown Source)
        at java.base/java.security.cert.PKIXCertPathChecker.check(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.RFC3280CertPathUtilities.processCertA(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.PKIXCertPathValidatorSpi_8.engineValidate(Unknown Source)
        at org.bouncycastle.fips.core/org.bouncycastle.jcajce.provider.PKIXCertPathBuilderSpi_8.build(Unknown Source)

The following is the testing code which can be used to reproduce the issue:

import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;

import java.io.FileInputStream;
import org.bouncycastle.util.Properties;

import java.security.Security;
import java.security.cert.*;
import java.util.*;

public class PKIXRevocationCheckerTest {

    public static void main(String[] args) throws Exception {
        String path = "/tmpcerts/";

        try {
            // Add Bouncy Castle FIPS as a security provider
            Security.addProvider(new BouncyCastleFipsProvider());

            // Paths to the certificates
            String rootCertPath = path + "RootCA.crt";

            // Load the certificates
            X509Certificate rootCert = loadCertificate(rootCertPath);
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509", "BCFIPS");

            // Load certificates individually
            X509Certificate leafCert = (X509Certificate) certFactory.generateCertificate(new FileInputStream(path + "leaf.crt"));
            X509Certificate intermediateCert1 = (X509Certificate) certFactory.generateCertificate(new FileInputStream(path + "intermediate1.crt"));
            X509Certificate intermediateCert2 = (X509Certificate) certFactory.generateCertificate(new FileInputStream(path + "intermediate2.crt"));

            // Add certificates to the chain
            List<Certificate> certChain = new ArrayList<>();
            certChain.add(leafCert);
            certChain.add(intermediateCert1);
            certChain.add(intermediateCert2);

            // Load the leaf certificate and its chain
            CertPath certPath = certFactory.generateCertPath(certChain);

            // Set up the trust anchor (root certificate)
            TrustAnchor trustAnchor = new TrustAnchor(rootCert, null);

            System.setProperty("ocsp.responderURL", "http://ocsps.ssl.com");

            // Retrieve and print the property using Properties.getPropertyValue
            String ocspResponderURL = Properties.getPropertyValue("ocsp.responderURL");
            System.out.println("OCSP Responder URL: " + ocspResponderURL);

            // Set up PKIX parameters
            PKIXParameters pkixParams = new PKIXParameters(Collections.singleton(trustAnchor));
            pkixParams.setRevocationEnabled(true);

            // Add PKIXRevocationChecker to perform OCSP checks
            CertPathValidator validator = CertPathValidator.getInstance("PKIX", "BCFIPS");
            PKIXRevocationChecker revocationChecker = (PKIXRevocationChecker) validator.getRevocationChecker();

            // Configure revocation checker to use OCSP/CRL
            revocationChecker.setOptions(EnumSet.of (PKIXRevocationChecker.Option.SOFT_FAIL,
                    PKIXRevocationChecker.Option.ONLY_END_ENTITY));
            pkixParams.addCertPathChecker(revocationChecker);

            // Validate the certification path
            try {
                System.out.println(((PKIXRevocationChecker) validator.getRevocationChecker()).getClass());
                validator.validate(certPath, pkixParams);
                System.out.println("Certificate chain is valid.");
            } catch (CertPathValidatorException e) {
                e.printStackTrace();
                System.err.println("Certificate chain validation failed: " + e.getMessage());
            }

        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }

    /**
     * Loads a certificate from a file.
     *
     * @param certPath Path to the certificate file.
     * @return The loaded X509Certificate.
     * @throws Exception If an error occurs while loading the certificate.
     */
    private static X509Certificate loadCertificate(String certPath) throws Exception {
        try (FileInputStream fis = new FileInputStream(certPath)) {
            CertificateFactory factory = CertificateFactory.getInstance("X.509");
            return (X509Certificate) factory.generateCertificate(fis);
        }
    }

    private static X509CRL loadCRL(String crlPath) throws Exception {
        try (FileInputStream fis = new FileInputStream(crlPath)) {
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509", "BCFIPS");
            return (X509CRL) certFactory.generateCRL(fis);
        }
    }
}

Nov 27 '24 08:11 yhuang01

This the leaf.crt:

Nov 27 '24 08:11 yhuang01

The following is intermediate1.crt:

Nov 27 '24 08:11 yhuang01

The following is intermediate2.crt

Nov 27 '24 08:11 yhuang01

The following is RootCA.crt

Nov 27 '24 08:11 yhuang01

It appears that this issue is related to https://github.com/bcgit/bc-java/issues/1548, which was fixed in 1.78. But it is not included in bc-fips-2.0.0 distribution.

Dec 02 '24 04:12 yhuang01

Yes, unfortunately this showed up well after submission. It's fixed in the FIPS PQC update which we are working on now.

Dec 15 '24 05:12 dghgit

FIPS PQC update

Thank you for your response. Do you have an estimated timeline for the next BC-FIPS library release and its certification?

Dec 15 '24 05:12 yhuang01

This is also fixed in BC-FJA 2.0.1 which should be appearing next week.

Aug 16 '25 10:08 dghgit