/// <summary>
/// Validates the time-stamp token in case of arbitration or with a specified trusted time.
/// </summary>
/// <param name="tst">The timestamp to validate</param>
/// <param name="extraCerts">Extra intermediate certificates</param>
/// <param name="crls">Known Crl's, new retrieved crl's will be added here</param>
/// <param name="ocsps">Known Ocsp's, new retrieved ocsp's will be added here</param>
/// <param name="trustedTime">The trusted time, <c>null</c> for the timestamp time</param>
/// <returns>The validation chain of the signing certificate</returns>
public static async Task <Timestamp> ValidateAsync(this TimeStampToken tst, X509Certificate2Collection extraCerts, IList <CertificateList> crls, IList <BasicOcspResponse> ocsps, DateTime?trustedTime)
{
var value = tst.CreateTimestamp();
//check if the indicated certificate is the signer
X509Certificate2 signer = tst.CheckSigner(value, extraCerts);
//check and extract the cert
var extraStore = tst.GetExtraStore();
if (extraCerts != null)
{
extraStore.AddRange(extraCerts);
}
//get the validation time
DateTime validationTime = value.GetValidationTime(trustedTime);
//build the chain
value.CertificateChain = await signer.BuildChainAsync(validationTime, extraStore, crls, ocsps); //we assume time-stamp signers aren't suspended, only permanently revoked
//get the renewal time
value.RenewalTime = value.CertificateChain.GetMinNotAfter();
return(value);
}
public async Task TestNewEid_GetRevocationAsync()
{
X509Certificate2 target = new X509Certificate2(@"files/eid79021802145-2027.crt");
X509Certificate2Collection extraStore = new X509Certificate2Collection();
extraStore.Add(new X509Certificate2(@"files/Citizen201709.crt"));
IList <CertificateList> crls = new List <CertificateList>();
IList <BasicOcspResponse> ocsps = new List <BasicOcspResponse>();
Chain rsp = await target.BuildChainAsync(DateTime.UtcNow, extraStore, crls, ocsps);
Assert.AreEqual(0, rsp.ChainStatus.Count(x => x.Status != X509ChainStatusFlags.NoError));
Assert.AreEqual(3, rsp.ChainElements.Count);
Assert.AreEqual("SERIALNUMBER=79021802145, G=Bryan Eduard, SN=Brouckaert, CN=Bryan Brouckaert (Authentication), C=BE", rsp.ChainElements[0].Certificate.Subject);
Assert.AreEqual("SERIALNUMBER=201709, CN=Citizen CA, O=http://repository.eid.belgium.be/, C=BE", rsp.ChainElements[1].Certificate.Subject);
Assert.AreEqual("CN=Belgium Root CA4, C=BE", rsp.ChainElements[2].Certificate.Subject);
Assert.AreEqual(1, crls.Count);
Assert.AreEqual(1, ocsps.Count);
}
