Red Hat Bugzilla – Full Text Bug Listing
|Summary:||OpenJDK not read jssecacerts file|
|Product:||Red Hat Enterprise Linux 7||Reporter:||Deepu K S <dkochuka>|
|Component:||java-1.8.0-openjdk||Assignee:||Andrew John Hughes <ahughes>|
|Status:||VERIFIED ---||QA Contact:||zzambers|
|Version:||7.4||CC:||ahughes, alanm, dbhole, dkochuka, jdoyle, jherrman, jvanek, sgehwolf, vchoudha, zzambers|
|Fixed In Version:||java-1.8.0-openjdk-188.8.131.52-5.b11.el7||Doc Type:||Bug Fix|
OpenJDK was recently updated to support reading the system certificate authority /etc/pki/java/cacerts database directly. As a consequence, this removed the ability to read certificates from the user-provided /usr/lib/jvm/<NVRA-of-JDK>/jre/lib/security/jssecacert file. With this update, that ability is restored by reading from that file first, if available.
|:||1593736 1593737 (view as bug list)||Environment:|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:|
|Bug Blocks:||1593736, 1593737|
Description Deepu K S 2018-04-13 10:47:43 EDT
Description of problem: After updating to OpenJDK 184.108.40.206-5.b12.el7_4 from 220.127.116.11-3.b12.el7_3; there is behavioral change that now it first read the cacerts file and ignore the jssecacerts file at all if cacerts exist. We have to explicitly set the option '-Djavax.net.ssl.trustStore=/usr/lib/jvm/jre/lib/security/jssecacerts' to get it to find that cert file. If cacerts file is renamed or removed, that the JRE will read the jssecacert file. However, it is against the Oracle JRE documentation, in normal case, the jssecacerts should always be read first. Referring to Oracle JRE document on JSSE (https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#X509TrustManager), the bug fix/behavioral change on OpenJDK is obviously deviated from Oracle JRE implementation. If the javax.net.ssl.trustStore system property was not specified, then: • if the file java-home/lib/security/jssecacerts exists, that file is used; <<===************ • if the file java-home/lib/security/cacerts exists, that file is used; • if neither of these files exists, then the SSL cipher suite is anonymous, does not perform any authentication, and thus does not need a truststore. Version-Release number of selected component (if applicable): Red Hat Enterprise Linux 7.4 java-1.8.0-openjdk-18.104.22.168-2.b14.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Use 'SSLContextPerform.java' from https://bugs.openjdk.java.net/browse/JDK-8129988 2. # java -Djavax.net.debug=ssl Main |& tee X | grep trustStore 3. Actual results: # java -Djavax.net.debug=ssl Main |& tee X | grep trustStore trustStore is: /etc/pki/java/cacerts trustStore type is : jks trustStore provider is : The problem is that we have all our Signer CA added to jssecacerts file, such change would mean that we have to modify all our codes to add the specific parameters “-Djavax.net.ssl.trustStore=/usr/lib/jvm/jre/lib/security/jssecacerts” in order to use the jssecacerts file. Expected results: If the file java-home/lib/security/jssecacerts exists, that file should be used. Additional info:
Comment 4 Andrew John Hughes 2018-04-13 14:32:52 EDT
This seems to be an oversight in PR2888 which shouldn't have altered the jssecacerts logic. The intention of that patch is simply to avoid traversing the symlink: $ ll /usr/lib/jvm/java-1.8.0-openjdk/jre/lib/security/cacerts lrwxrwxrwx. 1 root root 41 Nov 21 13:16 /usr/lib/jvm/java-1.8.0-openjdk/jre/lib/security/cacerts -> ../../../../../../../etc/pki/java/cacerts and use /etc/pki/java/cacerts directly. The symlink still needs to exist for some third-party software (e.g. Gradle, bug 1448802, https://github.com/gradle/gradle/issues/1782) that check specifically for that path, but is unused by the JDK itself. I'll fix this.
Comment 5 jiri vanek 2018-04-16 03:44:58 EDT
Just side note - due to parallel install feature, the config files in jdk are handled by postinstall scriplets. This may lead to some unexpected issues like leftover old file in previous directory. However, all glitches should be already fixed, and I have not seen issue with cacerts and/or jssecacerts being left over or other way corrupted for at least year. More likely longer. Still It may be point worthy of double checking.
Comment 17 zzambers 2018-07-02 13:24:39 EDT
Manually tested in rhel7 VM: package: java-1.8.0-openjdk-22.214.171.124-2.b14.el7_4.x86_64 result: PASSED
Comment 18 zzambers 2018-07-02 14:08:09 EDT
I accidentally reported on rhel-7.4.z package here. However now I have also tested 7.6 package: package: java-1.8.0-openjdk-126.96.36.199-3.b04.el7 result: PASSED