Class SecomRevocation

Namespace

EncDotNet.S100.Collections.Secom

Assembly

EncDotNet.S100.Collections.dll

Checks SECOM certificate chains against the certificate revocation lists (CRLs) their certificates name (issue #833). It is used for chains that reach a SecomTrustAnchors root: data signers (#823) and TLS servers (#829).

public sealed class SecomRevocation

Inheritance

object

SecomRevocation

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

CRLs are read here rather than by the platform: platform revocation differs by OS, and the MCP CAs serve PEM CRLs, which RFC 5280 does not allow and some platforms reject. One CRL covers every certificate its CA issued, so indexing many objects costs one fetch per CA. OCSP is not used.

A CRL is used only when its issuer name matches, its signature verifies against the issuer's key, and it is current (thisUpdate passed and nextUpdate not). CRLs are kept in memory and, given a cache directory, on disk. A copy is fetched again after RefreshAfter or once it is no longer current. Each fetch is bounded by FetchTimeout. After a fetch fails, that URL is not tried again for RetryAfterFailure, so an unreachable responder costs at most one timeout per interval.

The check soft-fails. When no current CRL can be had, the result is NotChecked, and callers show it and carry on. A listed certificate is always Revoked.

Constructors

SecomRevocation(HttpClient, string?, TimeProvider?)

Creates a checker.

public SecomRevocation(HttpClient httpClient, string? cacheDirectory = null, TimeProvider? timeProvider = null)

Parameters

httpClient HttpClient

The client CRLs are fetched with. Distribution points are plain HTTP, so this needs no SECOM server trust.

cacheDirectory string

Where fetched CRLs are kept between runs; null for memory only.

timeProvider TimeProvider

The clock CRL currency is judged by.

Properties

CacheOnly

The same checker, limited to CRLs already held in memory or on disk: it never waits on the network. Use it on read paths (recorded downloads), which may run on a UI thread.

public SecomRevocation CacheOnly { get; }

Property Value

SecomRevocation

FetchTimeout

How long one CRL fetch may take before it is abandoned. The default is 5 seconds.

public TimeSpan FetchTimeout { get; init; }

Property Value

TimeSpan

RefreshAfter

How long a fetched CRL is used before it is fetched again, even when it is still current. The default is 24 hours. MCP re-signs its CRL on each request with a nextUpdate a week ahead, so a week-old copy would miss that week's revocations.

public TimeSpan RefreshAfter { get; init; }

Property Value

TimeSpan

RetryAfterFailure

How long a URL whose fetch failed is left before it is tried again. The default is 5 minutes.

public TimeSpan RetryAfterFailure { get; init; }

Property Value

TimeSpan

Methods

Check(IReadOnlyList<X509Certificate2>)

Checks every certificate in chain but the root against the CRL its issuer publishes.

public SecomRevocationResult Check(IReadOnlyList<X509Certificate2> chain)

Parameters

chain IReadOnlyList<X509Certificate2>

The chain, leaf first and root last, as built against the trust anchors.

Returns

SecomRevocationResult

Revoked when any certificate is listed; NotChecked when one could not be checked; otherwise NotRevoked.