# HG changeset patch
# User vinnie
# Date 1372685987 -3600
# Node ID d70aed7424f6e02e5829b1a2293b8b2f9b304b34
# Parent  36bbc241ad6e9cdf8aca1748d9a2b832b463bd11
8019259: Failover to CRL checking does not happen if wrong OCSP responder URL is set
Reviewed-by: xuelei

diff -r 36bbc241ad6e -r d70aed7424f6 jdk/src/share/classes/sun/security/provider/certpath/RevocationChecker.java
--- a/jdk/src/share/classes/sun/security/provider/certpath/RevocationChecker.java	Mon Jul 01 11:13:56 2013 +0200
+++ b/jdk/src/share/classes/sun/security/provider/certpath/RevocationChecker.java	Mon Jul 01 14:39:47 2013 +0100
@@ -675,8 +675,12 @@
                                       responderURI, respCert, params.date(),
                                       ocspExtensions);
             }
-        } catch (IOException e) {
-            throw new CertPathValidatorException(e);
+        } catch (Exception e) {
+            if (e instanceof CertPathValidatorException) {
+                throw (CertPathValidatorException) e;
+            } else {
+                throw new CertPathValidatorException(e);
+            }
         }
 
         RevocationStatus rs =
diff -r 36bbc241ad6e -r d70aed7424f6 jdk/test/java/security/cert/CertPathValidator/OCSP/FailoverToCRL.java
--- a/jdk/test/java/security/cert/CertPathValidator/OCSP/FailoverToCRL.java	Mon Jul 01 11:13:56 2013 +0200
+++ b/jdk/test/java/security/cert/CertPathValidator/OCSP/FailoverToCRL.java	Mon Jul 01 14:39:47 2013 +0100
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -23,7 +23,7 @@
 
 /**
  * @test
- * @bug 6383095
+ * @bug 6383095 8019259
  * @summary CRL revoked certificate failures masked by OCSP failures
  *
  * Note that the certificate validity is from Mar 16 14:55:35 2009 GMT to
@@ -254,12 +254,32 @@
         CertPathValidator validator = CertPathValidator.getInstance("PKIX");
 
         try {
+            System.out.println("Validating cert via OCSP: no responder URL");
             validator.validate(path, params);
         } catch (CertPathValidatorException cpve) {
             if (cpve.getReason() != BasicReason.REVOKED) {
                 throw new Exception(
-                    "unexpect exception, should be a REVOKED CPVE", cpve);
+                    "unexpected exception, should be a REVOKED CPVE", cpve);
             }
+            System.out.println("  successful failover to using CRLs");
+        }
+
+        java.security.cert.PKIXRevocationChecker revocationChecker =
+            (java.security.cert.PKIXRevocationChecker)
+                validator.getRevocationChecker();
+        revocationChecker.setOCSPResponder(
+            new java.net.URI("bad_ocsp_responder_url"));
+        params.addCertPathChecker(revocationChecker);
+
+        try {
+            System.out.println("Validating cert via OCSP: bad responder URL");
+            validator.validate(path, params);
+        } catch (CertPathValidatorException cpve) {
+            if (cpve.getReason() != BasicReason.REVOKED) {
+                throw new Exception(
+                    "unexpected exception, should be a REVOKED CPVE", cpve);
+            }
+            System.out.println("  successful failover to using CRLs");
         }
     }
 }