Repository navigation
OCSP::Request#add_nonce raises NullPointerException when the request has a certid #396
Description
OpenSSL::OCSP::Request#add_nonce raises a NullPointerException when the request also has a certificate ID, in either order. Adding a certid and then a nonce is the example in the OpenSSL::OCSP docs:
request = OpenSSL::OCSP::Request.new
request.add_certid(certificate_id)
request.add_noncejava.lang.NullPointerException: Cannot invoke "org.bouncycastle.asn1.x509.Extensions.oids()" because "extensions" is null
addNonceImpl at org/jruby/ext/openssl/OCSPRequest.java:187
add_nonce at org/jruby/ext/openssl/OCSPRequest.java:171
addNonceImpl iterates over getRequestExtensions(), which is null while the request has no extensions. add_certid calls it again when a nonce is set, so add_nonce followed by add_certid fails the same way.
When the request does have an extension, add_nonce doesn't raise, but it rebuilds the request with an empty request list and no requestor name, so the certids are lost: a request parsed from DER with one certid has none in to_der after add_nonce. certid can't show this, since it returns [] for a request parsed from DER.
Reproduced with 0.16.3 in JRuby 10.0 and with master at f25d6ab, on JDK 21 with BouncyCastle 1.86.
Reproducer
require 'openssl'
key = OpenSSL::PKey::RSA.new(2048)
cert = OpenSSL::X509::Certificate.new
cert.version = 2
cert.serial = 1
cert.subject = cert.issuer = OpenSSL::X509::Name.parse('/CN=test')
cert.public_key = key.public_key
cert.not_before = Time.now
cert.not_after = Time.now + 3600
cert.sign(key, 'SHA256')
cid = OpenSSL::OCSP::CertificateId.new(cert, cert)
request = OpenSSL::OCSP::Request.new
request.add_certid(cid)
request.add_nonce # NullPointerExceptionFor the lost certids, with the same setup up to cid, and a request that has one certid and an extension, built with BouncyCastle:
bc = org.bouncycastle
id = bc.cert.ocsp.CertificateID.new(bc.asn1.ocsp.CertID.getInstance(cid.to_der.to_java_bytes))
ext = bc.asn1.x509.Extension.new(bc.asn1.ocsp.OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, bc.asn1.DEROctetString.new('abc'.to_java_bytes))
der = String.from_java_bytes(bc.cert.ocsp.OCSPReqBuilder.new.addRequest(id).setRequestExtensions(bc.asn1.x509.Extensions.new(ext)).build.getEncoded)
requests = ->(der) { OpenSSL::ASN1.decode(der).value[0].value.find { |v| v.is_a?(OpenSSL::ASN1::Sequence) }.value.size }
request = OpenSSL::OCSP::Request.new(der)
p requests[der] # => 1
request.add_nonce
p requests[request.to_der] # => 0
Activity
kares commentedon Nov 2, 2026
There's many issues that are fixed in 0.19.x but not in 0.16 at this point.
While 10.0 and 9.4 are still on 0.16 users can upgrade to 0.19.x, we're rolling out 0.19 in JRuby 10.1(.3) first.
Is this coming from an actual use-case with JRuby 10.0/9.4 where you can not upgrade JOSSL?
matrei commentedon Nov 2, 2026
No, neither this nor #397 comes from a production case: both turned up in the sweep from #395.
This one isn't fixed in 0.19.x though: 0.19.4 and
masterat cd0d8ce have the sameOCSPRequest.javaas the f25d6ab build I reproduced it with. I can open a PR againstmasterif that helps.#397 is only worth it if you want 0.16 to get fixes like that, so feel free to close it.
kares commentedon Nov 4, 2026
Okay, thanks - it's a good find (found another similar NPE in OCSP). We should really also align compatibility better.
[fix] `OCSP::Request` nonce and certid handling (#396)