Enable certificate revocation check in NonBlockingSocketFactory

dogtagpki · Feb 26, 2025 · 3da9f69 · 3da9f69
1 parent d3ef7e8
commit 3da9f69
Showing 1 changed file with 1 addition and 9 deletions.
diff --git a/base/common/src/main/java/org/dogtagpki/client/NonBlockingSocketFactory.java b/base/common/src/main/java/org/dogtagpki/client/NonBlockingSocketFactory.java
@@ -79,18 +79,10 @@ public Socket connectSocket(Socket socket,
             KeyManagerFactory kmf = KeyManagerFactory.getInstance("NssX509", "Mozilla-JSS");
             KeyManager[] kms = kmf.getKeyManagers();
 
-            // Create JSSTrustManager since the default JSSNativeTrustManager
-            // does not support hostname validation and cert approval callback.
-            //
-            // JSSTrustManager currently does not support cert validation with
-            // OCSP and CRL.
-            //
-            // TODO: Fix JSSTrustManager to support OCSP and CRL, then replace
-            // DefaultSocketFactory with this class.
-
             JSSTrustManager trustManager = new JSSTrustManager();
             trustManager.setHostname(hostname);
             trustManager.setCallback(connection.getCallback());
+	    trustManager.setEnableCertRevokeVerify(true);
 
             TrustManager[] tms = new TrustManager[] { trustManager };