/**
     * Адрес службы.
     */
    public static final String OCSP_URL = "http://testca2012.cryptopro.ru/ocsp/ocsp.srf";

    /**
     * Создание OCSP запроса.
     *
     * @param client Проверяемый сертификат.
     * @param issuer Сертификат издателя.
     * @param digestOid Идентификатор алгоритма
     * хеширования.
     * @return OCSP запрос.
     * @throws Exception
     */
    private static OCSPRequest createOCSPRequest(X509Certificate client,
        X509Certificate issuer, String digestOid) throws Exception {

        // 1. Формирование certificate id.
        //
        // Идентификатор алгоритма хеширования.
        // Можно и SHA1 использовать.
        //

        AlgorithmIdentifier hashAlgorithm = new AlgorithmIdentifier(
            new OID(digestOid).value);

        // Хеш издателя.

        X500Principal issuerName = issuer.getSubjectX500Principal();

        MessageDigest md = MessageDigest.getInstance(
            digestOid, JCP.PROVIDER_NAME);

        md.update(issuerName.getEncoded());
        byte[] issuerNameHash = md.digest();

        // Хеш открытого ключа.

        PublicKey issuerKey = issuer.getPublicKey();
        byte[] encodedKey = issuerKey.getEncoded();

        Asn1BerDecodeBuffer buf = new Asn1BerDecodeBuffer(encodedKey);
        SubjectPublicKeyInfo keyInfo = new SubjectPublicKeyInfo();

        keyInfo.decode(buf);
        byte[] clearKey = keyInfo.subjectPublicKey.value;

        md.reset();
        md.update(clearKey);

        byte[] issuerKeyHash = md.digest();

        // Серийный номер проверяемого сертификата.

        CertificateSerialNumber ssn = new CertificateSerialNumber(
            client.getSerialNumber());

        CertID certId = new CertID(hashAlgorithm, issuerNameHash,
            issuerKeyHash, ssn);

        // 2. Формирование запроса.

        ReqCert reqCert = new ReqCert();
        reqCert.set_certID(certId);

        Request request = new Request(reqCert, null);

        // 3. Список запросов, состоит из 1 запроса.

        _SeqOfRequest _seqOfRequest = new _SeqOfRequest(
            new Request[] {request});

        // 4. Список расширений к запросу. nonce всегда
        // один и тот же.

        //Extension extension_nonce = new Extension(
        //    new OID("1.3.6.1.5.5.7.48.1.2").value,
        //    new byte[] {0, 1, 2, 3, 4, 5, 5, 7});
        //
        //Extensions requestExtensions = new Extensions(
        //    new Extension[] {extension_nonce});

        TBSRequest tbsRequest = new TBSRequest(/*new OCSPVersion(0)*/ null,
            null, _seqOfRequest, /*requestExtensions*/ null);

        // Готовый запрос.

        return new OCSPRequest(tbsRequest, null);

    }

    /**
     * Декодирование и проверка OCSP ответа.
     *
     * @param client Проверяемый сертификат.
     * @param encodedResponse OCSP ответ.
     * @param expectedChoice Предполагаемый статус
     * проверки сертификата.
     * @throws Exception
     */
    private static void decodeOCSPResponseAndCheck(X509Certificate client,
        byte[] encodedResponse, byte expectedChoice) throws Exception {

        // 1. Извлечение ответа службы.

        Asn1BerDecodeBuffer decoded = new Asn1BerDecodeBuffer(
            encodedResponse);

        OCSPResponse response = new OCSPResponse();
        response.decode(decoded);

        // 2. Проверка статуса запроса.

        OCSPResponseStatus responseStatus = response.responseStatus;
        int status = responseStatus.value;

        if (status != OCSPResponseStatus.successful) {
            throw new Exception("Invalid OCSP response status: " + status);
        } // if

        // 3. Декодирование полного ответа.

        ResponseBytes bytes = response.responseBytes;
        byte[] responseValue = bytes.response.value;

        decoded = new Asn1BerDecodeBuffer(responseValue);

        BasicOCSPResponse basicOCSPResponse = new BasicOCSPResponse();
        basicOCSPResponse.decode(decoded);

        // 4. Поиск ответа для данного сертификата и
        // проверка его статуса.

        _SeqOfSingleResponse _seqOfSingleResponse =
            basicOCSPResponse.tbsResponseData.responses;

        SingleResponse[] singleResponses = _seqOfSingleResponse.elements;
        boolean found = false;

        for (SingleResponse singleResponse : singleResponses) {

            ReqCert reqCert = singleResponse.reqCert;
            CertID certId = (CertID) reqCert.getElement();

            CertificateSerialNumber ssn = certId.serialNumber;
            BigInteger bgSerial = ssn.value;

            if (bgSerial.equals(client.getSerialNumber())) {

                CertStatus certStatus = singleResponse.certStatus;

                // Если не совпадает с ожидаемым - ошибка.

                if (certStatus.getChoiceID() != expectedChoice) {
                    throw new Exception("Invalid choice (cert status), expected: " +
                        expectedChoice + " but received " + certStatus.getChoiceID());
                } // if

                // Если отозван - выводим информацию.

                if (certStatus.getChoiceID() == CertStatus._REVOKED) {

                    RevokedInfo info = (RevokedInfo) certStatus.getElement();
                    printDate("Revoked", info.revocationTime);

                    switch (info.revocationReason.value) {

                        case CRLReason.keyCompromise:        System.out.println("Revocation reason: keyCompromise");        break;
                        case CRLReason.cACompromise:         System.out.println("Revocation reason: cACompromise");         break;
                        case CRLReason.affiliationChanged:   System.out.println("Revocation reason: affiliationChanged");   break;
                        case CRLReason.superseded:           System.out.println("Revocation reason: superseded");           break;
                        case CRLReason.cessationOfOperation: System.out.println("Revocation reason: cessationOfOperation"); break;
                        case CRLReason.certificateHold:      System.out.println("Revocation reason: certificateHold");      break;
                        case CRLReason.removeFromCRL:        System.out.println("Revocation reason: removeFromCRL");        break;
                        case CRLReason.privilegeWithdrawn:   System.out.println("Revocation reason: privilegeWithdrawn");   break;
                        case CRLReason.aACompromise:         System.out.println("Revocation reason: aACompromise");         break;
                        default:                             System.out.println("Revocation reason: ");

                    } // switch

                } // if

                found = true;
                break;

            } // if

        } // for

        if (!found) {
            throw new Exception("Certificate not found among" +
                " the responses");
        } // if

        printDate("Produced at", basicOCSPResponse.tbsResponseData.producedAt);
        printDate("Next update", basicOCSPResponse.tbsResponseData.responses.elements[0].nextUpdate);
        printDate("This update", basicOCSPResponse.tbsResponseData.responses.elements[0].thisUpdate);

        // 5. Извлечение сертификата подписи.

        Asn1BerEncodeBuffer encoded = new Asn1BerEncodeBuffer();

        Certificate extractedSignOcspCert = basicOCSPResponse.certs.elements[0];
        extractedSignOcspCert.encode(encoded);

        X509Certificate signCert = (X509Certificate) CertificateFactory.getInstance("X.509")
            .generateCertificate(new ByteArrayInputStream(encoded.getMsgCopy()));

        // 6. Извлечение параметров подписи, самой подписи
        // и подписанных данных.

        byte[] encodedSign = basicOCSPResponse.signature.value;
        OID signAlg = new OID(basicOCSPResponse.signatureAlgorithm.algorithm.value);

        encoded = new Asn1BerEncodeBuffer();
        basicOCSPResponse.tbsResponseData.encode(encoded);

        // 7. Проверка подписи.

        Signature signature = Signature.getInstance(signAlg.toString(), JCP.PROVIDER_NAME);
        signature.initVerify(signCert);

        byte[] responseData = encoded.getMsgCopy();
        signature.update(responseData);

        boolean verified = signature.verify(encodedSign);
        if (!verified) {
            throw new Exception("Signature of OCSP response is invalid");
        } // if

    }

    /**
     * Вывод даты.
     *
     * @param msg Описание.
     * @param time Дата.
     * @throws Exception
     */
    private static void printDate(String msg, Asn1GeneralizedTime
        time) throws Exception {

        if (time != null) {

            System.out.println(msg + ", date: " + time.value);

            //final int hour   = time.getHour();
            //final int minute = time.getMinute();
            //final int second = time.getSecond();

            //System.out.println("Hour: " + hour + ", minute: " +
            //    minute + ", second: " + second);

        } // if
        else {
            System.out.println(msg + ": null");
        } // else

    }

    /**
     * Отправка OCSP запроса.
     *
     * @param url Адрес OCSP службы.
     * @param encodedRequest OCSP запрос.
     * @return OCSP ответ.
     * @throws Exception
     */
    private static byte[] sendRequest(String url, byte[]
        encodedRequest) throws Exception {

        System.out.println("Send request to: " + url);
        URL ocspUrl = new URL(url);

        HttpURLConnection connection = (HttpURLConnection)ocspUrl.openConnection();
        connection.setDoOutput(true);

        connection.setRequestProperty("Content-Type", "application/ocsp-request");
        connection.setRequestProperty("Accept", "application/ocsp-response");

        OutputStream outputStream = connection.getOutputStream();
        DataOutputStream dataOut = new DataOutputStream(new BufferedOutputStream(outputStream));

        dataOut.write(encodedRequest);
        dataOut.flush();
        dataOut.close();

        int responseCode = connection.getResponseCode();
        if (responseCode != 200) {
            throw new Exception("Invalid response code: " + responseCode);
        } // if

        InputStream inputStream = connection.getInputStream();
        byte[] buffer = new byte[1024];

        ByteArrayOutputStream reply = new ByteArrayOutputStream();
        int len;

        while ((len = inputStream.read(buffer)) != -1) {
            reply.write(buffer, 0, len);
        } // while

        inputStream.close();
        return reply.toByteArray();

    }

    /**
     *
     * @param args
     * @throws Exception
     */
    public static void main(String[] args) throws Exception {

        CertificateFactory factory = CertificateFactory.getInstance("X.509");

        // Загрузка сертификатов.

        X509Certificate client = (X509Certificate) factory.generateCertificate(
            new FileInputStream("client.cer")); // проверяемый клиентский

        X509Certificate ca1 = (X509Certificate) factory.generateCertificate(
            new FileInputStream("ca1.cer")); // сертификат издателя

        OCSPRequest request = createOCSPRequest(client, ca1,
            JCP.GOST_DIGEST_2012_256_OID); // алгоритм хеширования - ГОСТ 2012 (256)

        Asn1BerEncodeBuffer encoded = new Asn1BerEncodeBuffer();
        request.encode(encoded);

        // Выполнение запроса.

        byte[] encodedRequest  = encoded.getMsgCopy();
        byte[] encodedResponse = sendRequest(OCSP_URL, encodedRequest);

        // Обработка ответа. Ожидаем, что статус
        // сертификата - "отозван".

        decodeOCSPResponseAndCheck(client, encodedResponse, CertStatus._REVOKED);
        System.out.println("OK");

    }