recheckList.add(new RecheckEntry(certificateDataList.get(caRowIndex).getFingerprint(), certificateDataList.get(caRowIndex).getUpdateTime(), i));
}
continue;
}
// Compare one row from CA database with one row from the current OCSP responder
CertificateData certificateData = certificateDataList.get(caRowIndex);
CertificateData ocspCertificateData = ocspCertificateDataList.get(ocspRowIndex);
if (!certificateData.equals(ocspCertificateData, inclusionMode, strictStatus)) {
int test = certificateData.getFingerprint().compareTo(ocspCertificateData.getFingerprint());
if (log.isDebugEnabled()) {
log.debug("cd.fp=" + certificateData.getFingerprint() +" ocd.fp=" + ocspCertificateData.getFingerprint());
}
if (test > 0) {
// Extra row in OCSP database
if (log.isDebugEnabled()) {
log.debug("An extra cert with fingerprint "+ocspCertificateData.getFingerprint()+" might exist in the OCSP database " + ocspEntityManagerName);
}
if (ocspCertificateData.getUpdateTime() > new Date().getTime()+timeToConfirmError) {
handleError(errorList, ocspEntityManagerNames.get(i), ocspCertificateData.getFingerprint(), ocspCertificateData.getIssuerDN(), ocspCertificateData.getSerialNumber()
,ERROR_NOTEXISTINGCALIMIT);
} else {
recheckList.add(new RecheckEntry(ocspCertificateData.getFingerprint(), ocspCertificateData.getUpdateTime(), i));
}
ocspRowIndex++;
continue;
} else if (test < 0) {
// Missing row in OCSP database
if (log.isDebugEnabled()) {
log.debug("A cert with fingerprint "+certificateData.getFingerprint()+" might be missing in the OCSP database " + ocspEntityManagerName);
}
recheckList.add(new RecheckEntry(certificateData.getFingerprint(), certificateData.getUpdateTime(), i));
caRowIndex++;
continue;
} else {
// Row exists but is not equal
if (log.isDebugEnabled()) {
log.debug("A cert with fingerprint "+ocspCertificateData.getFingerprint()+" might not be in sync in the OCSP database " + ocspEntityManagerName);
}
if (certificateData.getUpdateTime() == ocspCertificateData.getUpdateTime()) {
// Since the time is the same, someone has tampered with the rest of the data
handleError(errorList, ocspEntityManagerName, certificateData.getFingerprint(), certificateData.getIssuerDN(), certificateData.getSerialNumber()
,ERROR_TAMPERED);
} else if (certificateData.getUpdateTime() > ocspCertificateData.getUpdateTime()) {
// Might have a pending update for this OCSP, re-check later
if (log.isDebugEnabled()) {
log.debug("A cert with fingerprint "+ocspCertificateData.getFingerprint()+" might not have been updated in the OCSP database " + ocspEntityManagerName);
}
recheckList.add(new RecheckEntry(certificateData.getFingerprint(), certificateData.getUpdateTime(), i));
} else {
// An update for this OCSP might have gone through since we read the CA database, re-check later
if (log.isDebugEnabled()) {
log.debug("A cert with fingerprint "+ocspCertificateData.getFingerprint()+" in the OCSP database " + ocspEntityManagerName + " might not have been updated in the CA database.");
}
if (ocspCertificateData.getUpdateTime() > new Date().getTime()+timeToConfirmError) {
handleError(errorList, ocspEntityManagerNames.get(i), ocspCertificateData.getFingerprint(), ocspCertificateData.getIssuerDN(), ocspCertificateData.getSerialNumber()
,ERROR_NOTEXISTINGCALIMIT);
} else {
recheckList.add(new RecheckEntry(ocspCertificateData.getFingerprint(), ocspCertificateData.getUpdateTime(), i));
}
}
}
}
ocspRowIndex++;
caRowIndex++;
}
}
currentFingerprint = certificateDataList.get(certificateDataList.size()-1).getFingerprint();
recheckList = processRecheckList(recheckList, caEntityManager, ocspEntityManagers, ocspEntityManagerNames, inclusionMode, strictStatus, errorList, timeToConfirmError);
}
// Make sure we don't have any unhandled CertificateData at any of the OCSP responders left
for (int i=0; i<ocspEntityManagers.size(); i++) {
String ocspCurrentFingerprint = currentFingerprint;
EntityManager ocspEntityManager = ocspEntityManagers.get(i);
List<CertificateData> ocspCertificateDataList;
while ( (ocspCertificateDataList = CertificateData.getNextBatch(ocspEntityManager, certificateProfileId, ocspCurrentFingerprint, batchSize)) != null
&& ocspCertificateDataList.size()>0) {
for (CertificateData ocspCertificateData : ocspCertificateDataList) {
// An update for this OCSP might have gone through since we read the CA database, re-check later
if (ocspCertificateData.getUpdateTime() > new Date().getTime()+timeToConfirmError) {
handleError(errorList, ocspEntityManagerNames.get(i), ocspCertificateData.getFingerprint(), ocspCertificateData.getIssuerDN(), ocspCertificateData.getSerialNumber()
,ERROR_NOTEXISTINGCALIMIT);
} else {
recheckList.add(new RecheckEntry(ocspCertificateData.getFingerprint(), ocspCertificateData.getUpdateTime(), i));
}
}
ocspCurrentFingerprint = ocspCertificateDataList.get(ocspCertificateDataList.size()-1).getFingerprint();
}
}