Class HttpRevocationSource

Namespace

MiPdf.Signatures

Assembly

MiPdf.dll

Fetches issuer certificates (AIA caIssuers), OCSP responses (RFC 6960, HTTP POST) and CRLs (CRL distribution points) over HTTP. Responses are cached per instance; reuse the instance to benefit from the cache.

public sealed class HttpRevocationSource : IRevocationSource

Inheritance

object

HttpRevocationSource

Implements

IRevocationSource

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The URLs come from certificates inside the document and are therefore untrusted. By default only public internet addresses can be reached (checked for every connection, including redirects), so that uploaded documents cannot be used to probe internal services (SSRF). Set AllowPrivateNetworks for an internal CA, or restrict the hosts with AllowedHosts. A caller-supplied HttpClient is used as is, without these checks.

Constructors

HttpRevocationSource(HttpClient?)

Creates a revocation source.

public HttpRevocationSource(HttpClient? httpClient = null)

Parameters

httpClient HttpClient

Optional HttpClient (proxies, timeouts, ...). It is used as is, without the address checks of AllowPrivateNetworks and AllowedHosts. Default: an internal client with a 30-second timeout.

Properties

AllowPrivateNetworks

Allow connections to private, loopback and link-local addresses (default false).

public bool AllowPrivateNetworks { get; init; }

Property Value

bool

AllowedHosts

If set, only these host names may be contacted.

public IReadOnlyCollection<string>? AllowedHosts { get; init; }

Property Value

IReadOnlyCollection<string>

CacheDuration

How long downloaded CRLs and issuer certificates are cached (OCSP responses are not cached). Default 15 minutes.

public TimeSpan CacheDuration { get; set; }

Property Value

TimeSpan

MaxCacheEntries

Maximum number of cached responses (default 500).

public int MaxCacheEntries { get; set; }

Property Value

int

MaxCrlSize

CRLs larger than this are skipped (some CAs publish CRLs of more than 100 MB). Default 5 MB.

public long MaxCrlSize { get; set; }

Property Value

long

Methods

GetCrls(X509Certificate2)

Downloads the CRL from the first HTTP CRL distribution point of the certificate (PEM is converted to DER); an empty list if there is none.

public IReadOnlyList<byte[]> GetCrls(X509Certificate2 certificate)

Parameters

certificate X509Certificate2

Returns

IReadOnlyList<byte[]>

Exceptions

PdfException

The server returned an HTTP error or the CRL exceeds MaxCrlSize.

GetIssuers(X509Certificate2)

Downloads the issuer certificate(s) from the HTTP caIssuers URLs of the certificate's AIA extension (at most three URLs, stopping at the first that yields a certificate); an empty list if there are none.

public IReadOnlyList<X509Certificate2> GetIssuers(X509Certificate2 certificate)

Parameters

certificate X509Certificate2

Returns

IReadOnlyList<X509Certificate2>

Exceptions

PdfException

A server returned an HTTP error or a response that is too large.

GetOcspResponse(X509Certificate2, X509Certificate2)

Sends an OCSP request (HTTP POST) to the first HTTP OCSP URL of the certificate's AIA extension and returns the DER-encoded response; null if the certificate names no OCSP responder.

public byte[]? GetOcspResponse(X509Certificate2 certificate, X509Certificate2 issuer)

Parameters

certificate X509Certificate2

issuer X509Certificate2

Returns

byte[]

Exceptions

PdfException

The responder returned an HTTP error, a response that is too large or a non-successful OCSP status.