// "application/ocsp-response; charset=UTF-8"
assertNotNull(con.getContentType());
assertTrue(con.getContentType().startsWith("application/ocsp-response"));
OCSPResp response = new OCSPResp(new ByteArrayInputStream(OcspJunitHelper.inputStreamToBytes(con.getInputStream())));
assertEquals("Response status not the expected.", OCSPRespGenerator.SUCCESSFUL, response.getStatus());
BasicOCSPResp brep = (BasicOCSPResp) response.getResponseObject();
// Just output the headers to stdout so we can visually inspect them if
// something goes wrong
Set<String> keys = con.getHeaderFields().keySet();
for (String field : keys) {
List<String> values = con.getHeaderFields().get(field);
for (String value : values) {
log.info(field + ": " + value);
}
}
String eTag = con.getHeaderField("ETag");
assertNotNull("RFC 5019 6.2: No 'ETag' HTTP header present as it SHOULD. (Make sure ocsp.untilNextUpdate is configured for this test)", eTag);
assertTrue("ETag is messed up.", ("\"" + new String(Hex.encode(MessageDigest.getInstance("SHA-1", "BC").digest(response.getEncoded()))) + "\"")
.equals(eTag));
long date = con.getHeaderFieldDate("Date", -1);
assertTrue("RFC 5019 6.2: No 'Date' HTTP header present as it SHOULD.", date != -1);
long lastModified = con.getHeaderFieldDate("Last-Modified", -1);
assertTrue("RFC 5019 6.2: No 'Last-Modified' HTTP header present as it SHOULD.", lastModified != -1);
// assertTrue("Last-Modified is after response was sent",
// lastModified<=date); This will not hold on JBoss AS due to the
// caching of the Date-header
long expires = con.getExpiration();
assertTrue("Expires is before response was sent", expires >= date);
assertTrue("RFC 5019 6.2: No 'Expires' HTTP header present as it SHOULD.", expires != 0);
String cacheControl = con.getHeaderField("Cache-Control");
assertNotNull("RFC 5019 6.2: No 'Cache-Control' HTTP header present as it SHOULD.", cacheControl);
assertTrue("RFC 5019 6.2: No 'public' HTTP header Cache-Control present as it SHOULD.", cacheControl.contains("public"));
assertTrue("RFC 5019 6.2: No 'no-transform' HTTP header Cache-Control present as it SHOULD.", cacheControl.contains("no-transform"));
assertTrue("RFC 5019 6.2: No 'must-revalidate' HTTP header Cache-Control present as it SHOULD.", cacheControl.contains("must-revalidate"));
Matcher matcher = Pattern.compile(".*max-age\\s*=\\s*(\\d+).*").matcher(cacheControl);
assertTrue("RFC 5019 6.2: No 'max-age' HTTP header Cache-Control present as it SHOULD.", matcher.matches());
int maxAge = Integer.parseInt(matcher.group(1));
assertTrue("RFC 5019 6.2: SHOULD be 'later than thisUpdate but earlier than nextUpdate'.", maxAge < (expires - lastModified) / 1000);
// assertTrue("Response cannot be produced after it was sent.",
// brep.getProducedAt().getTime() <= date); This might not hold on JBoss
// AS due to the caching of the Date-header
X509Certificate[] chain = brep.getCerts("BC");
boolean verify = brep.verify(chain[0].getPublicKey(), "BC");
assertTrue("Response failed to verify.", verify);
assertNull("No nonce should be present.", brep.getExtensionValue(OCSPObjectIdentifiers.id_pkix_ocsp_nonce.getId()));
SingleResp[] singleResps = brep.getResponses();
assertNotNull("SingleResps should not be null.", singleResps);
assertTrue("Expected a single SingleResp in the repsonse.", singleResps.length == 1);
assertEquals("Serno in response does not match serno in request.", singleResps[0].getCertID().getSerialNumber(), ocspTestCert.getSerialNumber());
assertEquals("Status is not null (null is 'good')", singleResps[0].getCertStatus(), null);
assertTrue("RFC 5019 6.2: Last-Modified SHOULD 'be the same as the thisUpdate timestamp in the request itself'", singleResps[0].getThisUpdate()
.getTime() == lastModified);
assertTrue("RFC 5019 6.2: Expires SHOULD 'be the same as the nextUpdate timestamp in the request itself'",
singleResps[0].getNextUpdate().getTime() == expires);
assertTrue("Response cannot be produced before it was last modified..", brep.getProducedAt().getTime() >= singleResps[0].getThisUpdate().getTime());
}