client validate certificate chai

java提供了工具用来支持校验certificate，包括证书的属性校验以及revocation校验。

Revocation校验

证书的revocation 校验主要有三种方式：
1.自己提供CRLfiles
2.通过证书内的CRLDP属性下载CRL files 然后做检查
3.将待检查的证书发给证书内的OCSP地址，然后检查返回结果

            System.setProperty("com.sun.security.enableCRLDP","true");
            List<X509Certificate> certList = Arrays.asList(x509Certificates);
            Set<TrustAnchor> trustAnchors = new HashSet<TrustAnchor>();
            for (X509Certificate trustedRootCert : getAcceptedIssuers()) {
                trustAnchors.add(new TrustAnchor(trustedRootCert, null));
            }
            PKIXBuilderParameters params = new PKIXBuilderParameters(trustAnchors, new X509CertSelector());
            params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(SSLHelper.loadCRL())));
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            CertPath certPath = cf.generateCertPath(certList);
            CertPathValidator certPathValidator = CertPathValidator.getInstance(CertPathValidator.getDefaultType());
            PKIXRevocationChecker revocationChecker = (PKIXRevocationChecker) certPathValidator.getRevocationChecker();
            revocationChecker.setOptions(EnumSet.of(PKIXRevocationChecker.Option.SOFT_FAIL));
            params.addCertPathChecker(revocationChecker);
            certPathValidator.validate(certPath, params);

SunJSSE的实现:

validate方法会调用一系列的checker做证书检查，包括RevocationChecker，Basic Checker

BouncyCastleFIPS实现：

目前所有的校验都写到了org.bouncycastle.jcajce.provider.PKIXCertPathValidatorSpi#engineValidate 这一个方法里，暂时没有实现java.security.cert.CertPathValidatorSpi#engineGetRevocationChecker方法。

FIPS 模式下client端如何对server的证书进行校验

背景：
SunJSSE在FIPS 模式下不允许对x509trustmanager进行扩展。
解决方案：
在TrustManagerFactory初始化时传入PKIXBuilderParameters 。
对于需要检查的证书参数，将其传入X509CertSelector中。
X509CertSelector 只会作用于user certificate.(BCFIPS源码)

        X509CertSelector x509CertSelector = new X509CertSelector();
        x509CertSelector.setKeyUsage(new boolean[]{true,false,true});
        x509CertSelector.setExtendedKeyUsage(Sets.newHashSet(EXTENDED_KEY_SERVER_AUTHENTICATION,EXTENDED_KEY_CLIENT_AUTHENTICATION));
        PKIXBuilderParameters params = new PKIXBuilderParameters(ts, x509CertSelector);
        params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(SSLHelper.loadCRL())));
        params.setRevocationEnabled(true);
        tmf.init(new CertPathTrustManagerParameters(params));