CRL fallback not used when OCSP responder not reachable

[joe-dimar]

Version: 2.73.10

Is: OcspCache.getOcspResponse() throws CertPathValidatorException when OCSP responder is not reachable or hostname unknown (when NoRouteToHostException, UnknownHostException, or any other IOException occurs)

Expected: Certain (all?) IOExceptions are caught, optionally handled, and thrown as RecoverableCertPathValidatorException so that ProvRevocationChecker can properly catch them and fallback to CRLs.

Impact: CRLs will not be used as fallback when these situations occur. Instead, the cert path validation fails immediately.

[roy-basmacier]

Hi @joe-dimar.

An unreachable or failing responder now surfaces as a recoverable failure ("unable to get OCSP response from : ..."), so CRL fallback runs as you expected. With Option.NO_FALLBACK set, validation still fails as before (with the clearer message). Genuine configuration errors (malformed responder URL/property) remain hard failures.

The fix is will be available in the beta: https://downloads.bouncycastle.org/betas/

[joe-dimar]

Hi @roy-basmacier,

That's great, thank you. I just noticed that I've opened this issue in the bc-java repo instead of bc-lts-java. Do you know if this issue will be fixed there as well? It looks like the betas page contains all BC betas but I don't see one for java LTS.