Use system time in OcspService.validateResponderCertificate()

WE2-868

Signed-off-by: Mihkel Kivisild [email protected]

Author: Mihkel Kivisild

src/WebEid.Security.Tests/Validator/Validators/SubjectCertificateNotRevokedValidatorTests.cs

@@ -225,7 +225,7 @@ public void WhenOcspResponseUnknownThenThrows()
         }
 
         [Test]
-        public void WhenOcspResponseCaNotTrustedThenThrows()
+        public void WhenOcspResponseCaCertNotTrustedThenThrows()
         {
             using var _ = DateTimeProvider.OverrideUtcNow(new DateTime(2021, 3, 1));
             var validator = this.GetSubjectCertificateNotRevokedValidatorWithAiaOcsp(
@@ -239,6 +239,17 @@ public void WhenOcspResponseCaNotTrustedThenThrows()
                     ));
         }
 
+        [Test]
+        public void WhenOcspResponseCACertExpiredThenThrows()
+        {
+            var validator = this.GetSubjectCertificateNotRevokedValidatorWithAiaOcsp(
+                new OcspClientMock(Certificates.ResourceReader.ReadFromResource("ocsp_response_unknown.der")));
+            var ex = Assert.ThrowsAsync<UserCertificateOcspCheckFailedException>(() =>
+                    validator.Validate(this.esteid2018Cert));
+            Assert.That(ex.InnerException, Is.TypeOf<CertificateExpiredException>());
+            Assert.That(ex.InnerException.Message,
+                Does.StartWith("AIA OCSP responder certificate has expired"));
+        }
 
         private static byte[] BuildOcspResponseBodyWithInternalErrorStatus()
         {

src/WebEid.Security/Validator/CertValidators/SubjectCertificateNotRevokedValidator.cs

@@ -33,6 +33,7 @@ namespace WebEid.Security.Validator.CertValidators
     using Org.BouncyCastle.Asn1.Ocsp;
     using Org.BouncyCastle.Ocsp;
     using Org.BouncyCastle.Security;
+    using WebEid.Security.Util;
 
     internal sealed class SubjectCertificateNotRevokedValidator : ISubjectCertificateValidator
     {
@@ -154,8 +155,7 @@ private void VerifyOcspResponse(BasicOcspResp basicResponse,
             //   4. The signer is currently authorized to provide a response for the
             //      certificate in question.
 
-            var producedAt = basicResponse.ProducedAt;
-            ocspService.ValidateResponderCertificate(responderCert, producedAt);
+            ocspService.ValidateResponderCertificate(responderCert, DateTimeProvider.UtcNow);
 
             //   5. The time at which the status being indicated is known to be
             //      correct (thisUpdate) is sufficiently recent.

src/WebEid.Security/Validator/Ocsp/Service/AiaOcspService.cs

@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright © 2020-2024 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -60,17 +60,17 @@ private Uri GetOcspAiaUrlFromCertificate(Org.BouncyCastle.X509.X509Certificate c
                                                                      "from the certificate failed");
         }
 
-        public void ValidateResponderCertificate(Org.BouncyCastle.X509.X509Certificate responderCertificate, DateTime producedAt)
+        public void ValidateResponderCertificate(Org.BouncyCastle.X509.X509Certificate responderCertificate, DateTime now)
         {
             try
             {
-                responderCertificate.ValidateCertificateExpiry(producedAt, "AIA OCSP responder");
+                responderCertificate.ValidateCertificateExpiry(now, "AIA OCSP responder");
                 // Trusted certificates validity has been already verified in ValidateCertificateExpiry().
                 OcspResponseValidator.ValidateHasSigningExtension(responderCertificate);
                 _ = new X509Certificate2(DotNetUtilities.ToX509Certificate(responderCertificate))
                     .ValidateIsValidAndSignedByTrustedCa(this.trustedCaCertificates);
             }
-            catch (Exception ex) when (!(ex is CertificateNotTrustedException))
+            catch (Exception ex) when (!(ex is CertificateNotTrustedException) && !(ex is CertificateExpiredException))
             {
                 throw new OcspCertificateException("Invalid certificate", ex);
             }

src/WebEid.Security/Validator/Ocsp/Service/DesignatedOcspService.cs

@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright © 2020-2024 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -44,7 +44,7 @@ public DesignatedOcspService(DesignatedOcspServiceConfiguration configuration)
 
         public bool SupportsIssuerOf(X509Certificate certificate) => this.configuration.SupportsIssuerOf(certificate);
 
-        public void ValidateResponderCertificate(X509Certificate responderCertificate, DateTime producedAt)
+        public void ValidateResponderCertificate(X509Certificate responderCertificate, DateTime now)
         {
             // Certificate pinning is implemented simply by comparing the certificates or their public keys,
             // see https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning.
@@ -53,7 +53,7 @@ public void ValidateResponderCertificate(X509Certificate responderCertificate, D
                 throw new OcspCertificateException(
                     "Responder certificate from the OCSP response is not equal to the configured designated OCSP responder certificate");
             }
-            responderCertificate.ValidateCertificateExpiry(producedAt, "Designated OCSP responder");
+            responderCertificate.ValidateCertificateExpiry(now, "Designated OCSP responder");
         }
     }
 }

src/WebEid.Security/Validator/Ocsp/Service/IOcspService.cs

@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright © 2020-2024 Estonian Information System Authority
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -27,6 +27,7 @@ public interface IOcspService
     {
         bool DoesSupportNonce { get; }
         Uri AccessLocation { get; }
-        void ValidateResponderCertificate(Org.BouncyCastle.X509.X509Certificate responderCertificate, DateTime producedAt);
+
+        void ValidateResponderCertificate(Org.BouncyCastle.X509.X509Certificate responderCertificate, DateTime now);
     }
 }