KB Article #56239

CRL, illegal character in scheme name at index 0 (Unable to build URI from CRL distribution point " ldap://crl.gds.disa.mil/cn%3dDOD%20CA-13%2cou%3dPKI%2cou%3dDoD%2co%3dU.S.%20Government%2cc%3dUS?certificaterevocationlist;binary")

Problem

Unable to build URI from CRL distribution point " ldap://crl.gds.disa.mil/cn%3dDOD%20CA-13%2cou%3dPKI%2cou%3dDoD%2co%3dU.S.%20Government%2cc%3dUS?certificaterevocationlist;binary"
java.net.URISyntaxException: Illegal character in scheme name at index 0:  ldap://crl.gds.disa.mil/cn%3dDOD%20CA-13%2cou%3dPKI%2cou%3dDoD%2co%3dU.S.%20Government%2cc%3dUS?certificaterevocationlist;binary
       at java.net.URI$Parser.fail(Unknown Source)
       at java.net.URI$Parser.checkChars(Unknown Source)
       at java.net.URI$Parser.checkChar(Unknown Source)
       at java.net.URI$Parser.parse(Unknown Source)
       at java.net.URI.<init>(Unknown Source)
       at com.cyclonecommerce.crossworks.x509.GeneralNames.getFirstUrl(GeneralNames.java:44)
       at com.cyclonecommerce.crossworks.x509.extensions.DistributionPoint.getFirstUrl(DistributionPoint.java:80)
       at com.cyclonecommerce.crossworks.x509.extensions.CRLDistributionPoints.getFirstDistributionPointUrl(CRLDistributionPoints.java:10)
       at com.cyclonecommerce.crossworks.x509.X509Certificate.getFirstCrlDistributionPointUrl(X509Certificate.java:82)
       at com.cyclonecommerce.crossworks.provider.X509CertPathValidatorImpl.getDistributionPoint(X509CertPathValidatorImpl.java:173)
       at com.cyclonecommerce.crossworks.provider.X509CertPathValidatorImpl.findCrl(X509CertPathValidatorImpl.java:212)
       at com.cyclonecommerce.crossworks.provider.X509CertPathValidatorImpl.checkCRL(X509CertPathValidatorImpl.java:183)
       at com.cyclonecommerce.crossworks.provider.X509CertPathValidatorImpl.validate(X509CertPathValidatorImpl.java:214)
       at com.cyclonecommerce.crossworks.provider.X509CertPathValidatorImpl.engineValidate(X509CertPathValidatorImpl.java:1)
       at java.security.cert.CertPathValidator.validate(Unknown Source)
       at com.cyclonecommerce.crossworks.certmgmt.CertificatePathValidator.validate(CertificatePathValidator.java:39)


Resolution

Interchange rejected the CRL's URI becuase it has a leading space character. Spaces are restricted characters in URI syntax. From RFC 2396, secition 2.4.3. Excluded US-ASCII Characters.



  The space character is excluded because significant spaces may
  disappear and insignificant spaces may be introduced when URI are
  transcribed or typeset or subjected to the treatment of word-
  processing programs.  Whitespace is also used to delimit URI in many
  contexts.



  space       = <US-ASCII coded character 20 hexadecimal>



The space character can be translated into a URI with an escape character denoting its Ascii numeric equivalent. For the space character this translation is "%20".