SCEP CertRep成功:响应中有多少证书？

Question

我正在研究SCEP实现(请求者和权限)。该项目使用JScep作为库。

在PKCSReq通信期间，客户端接收到CertRep成功。草案规定如下：

`+----------------+--------------------------------------------------+    | Request-type   | Reply-contents                                   |    +----------------+--------------------------------------------------+    | PKCSReq        | the reply MUST contain at least the issued       |    |                | certificate in the certificates field of the     |    |                | Signed-Data.  The reply MAY contain additional   |    |                | certificates, but the issued certificate MUST be |    |                | the first in the list.  The reply MUST NOT       |    |                | contain a CRL.  All returned certificates MUST   |    |                | conform to [RFC5280].                            |`

我对MAY contain additional certificates的解释有点困惑。

这是否意味着整个证书链将以Collection (JScep)的形式出现在响应中？

Answer 1

可以显示整个证书链，但不一定。通常，我希望SCEP服务器提供建立信任链所需的一切。

如果调用enrol并且结果EnrollmentResponse成功(isSuccess())，则可以调用getCertStore来访问java.security.cert.CertStore。该CertStore将包含服务器发送的所有证书。

可以使用jscep中的CertStoreInspector直接提取相关证书，如下所示：

CertStoreInspector inspector = DefaultCertStoreInspectorFactory.getInstance(certStore);
X509Certificate ca = inspector.getIssuer();
X509Certificate signer_ra = inspector.getSigner();
X509Certificate recipient_ra = inspector.getSigner();

请参阅https://github.com/jscep/jscep/issues/48