Do cert revocation improvement to validate with only one client certificate in the request when the issuer of that cert is present in the client trust store

[Akila94]

Purpose

• This improvement contains the certificate revocation validation improvement so the validation can be done without the full certificate chain sent in the request.

• The validation can also be done when only one intermediate client certificate is sent in the request. For this to happen the immediate issuer of that certificate should contain in the client trust store.

• Also a cert cache (LRU) is implemented to keep the issuer certificate found after traversing the client trust store.

• A data holder is introduced to avoid client trust store loading multiple times for a single server start-up.

• One of the following configurations can be used to enable this improvement,

1. Enforce glocally using axis2.xml. The following configuration should be added inside the <transportReceiver name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpMultiSSLListener">.

<parameter name="CertificateRevocationVerifier" enable="true">
    <CacheSize>1024</CacheSize>
    <CacheDelay>1000</CacheDelay>
    <FullChainValidation>false</FullChainValidation>
    <ExpiryValidation>true</ExpiryValidation>
</parameter>

2. Enforce per security listener profile. The following configuration should be added inside the relevant profile.

<CertificateRevocationVerifier>
    <Enable>true</Enable>
    <CacheSize>1024</CacheSize>
    <CacheDelay>1000</CacheDelay>
    <FullChainValidation>false</FullChainValidation>
    <ExpiryValidation>true</ExpiryValidation>
</CertificateRevocationVerifier>