diff --git a/src/SignatureXAdES_LT.cpp b/src/SignatureXAdES_LT.cpp index c17fe9e16..7d38e4c1d 100644 --- a/src/SignatureXAdES_LT.cpp +++ b/src/SignatureXAdES_LT.cpp @@ -32,6 +32,7 @@ #include #include +#include using namespace digidoc; using namespace std; @@ -130,18 +131,19 @@ void SignatureXAdES_LT::validate(const string &policy) const vector ocspExceptions; for(auto resp = ocspValues/"EncapsulatedOCSPValue"; resp; resp++) { - OCSP ocsp(resp); + optional ocsp; try { - ocsp.verifyResponse(signingCertificate()); - foundSignerOCSP = true; + ocsp.emplace(resp); + ocsp->verifyResponse(signingCertificate()); } catch(const Exception &e) { ocspExceptions.push_back(e); continue; } + foundSignerOCSP = true; if(profile().find(ASiC_E::ASIC_TM_PROFILE) != string::npos) { - vector policies = ocsp.responderCert().certificatePolicies(); + vector policies = ocsp->responderCert().certificatePolicies(); const set trusted = CONF(OCSPTMProfiles); if(!any_of(policies.cbegin(), policies.cend(), [&](const string &policy) { return trusted.find(policy) != trusted.cend(); })) { @@ -150,11 +152,11 @@ void SignatureXAdES_LT::validate(const string &policy) const } DEBUG("OCSP Responder contains valid TM OID"); - string method = Digest::digestInfoUri(ocsp.nonce()); + string method = Digest::digestInfoUri(ocsp->nonce()); if(method.empty()) THROW("Nonce digest method is missing"); vector digest = Digest(method).result(signatureValue()); - vector respDigest = Digest::digestInfoDigest(ocsp.nonce()); + vector respDigest = Digest::digestInfoDigest(ocsp->nonce()); if(digest != respDigest) { DEBUGMEM("Calculated signature HASH", digest.data(), digest.size()); @@ -164,7 +166,7 @@ void SignatureXAdES_LT::validate(const string &policy) const } else { - tm producedAt = ocsp.producedAt(); + tm producedAt = ocsp->producedAt(); string producedAt_s = util::date::to_string(producedAt); time_t producedAt_t = util::date::mkgmtime(producedAt); tm timeStampTime = TimeStamp().time(); @@ -276,5 +278,9 @@ OCSP SignatureXAdES_LT::getOCSPResponseValue() const } } // Return first OCSP response when chains are not complete and validation fails - return {ocspValues/"EncapsulatedOCSPValue"}; + try { + return OCSP(ocspValues/"EncapsulatedOCSPValue"); + } catch(const Exception &) { + return {}; + } }