NullPointerException if trustedCert of trustAnchor is null in CertPathValidator parameter

[limo520]

I'm not sure whether this is a bug or not.

The following code works on JDK17 and BC 1.73.

public static void main(String[] args) throws Exception {
        Security.addProvider(new BouncyCastleProvider());
        KeyPair ca = KeyPairGenerator.getInstance("RSA", "BC").genKeyPair();
        KeyPair client = KeyPairGenerator.getInstance("RSA", "BC").genKeyPair();

        Date notBefore = new SimpleDateFormat("yyyyMMdd").parse("20000101");
        Date notAfter = new SimpleDateFormat("yyyyMMdd").parse("30000101");
        X509Certificate cacer;
        {
            ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256withRSA").build(ca.getPrivate());
            X509CertificateHolder certHolder = new JcaX509v3CertificateBuilder(new X500Name("CN=ca"),
                    new BigInteger(256, new SecureRandom()), notBefore, notAfter, new X500Name("CN=ca"),
                    ca.getPublic()).build(contentSigner);
            cacer = new JcaX509CertificateConverter().getCertificate(certHolder);
        }
        X509Certificate clientcer;
        {
            ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256withRSA").build(ca.getPrivate());
            X509CertificateHolder certHolder = new JcaX509v3CertificateBuilder(new X500Name("CN=ca"),
                    new BigInteger(256, new SecureRandom()), notBefore, notAfter, new X500Name("CN=client"),
                    client.getPublic()).build(contentSigner);
            clientcer = new JcaX509CertificateConverter().getCertificate(certHolder);
        }
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509", "BC");
        CertPath clientCertPath = certificateFactory.generateCertPath(List.of(clientcer));


        CertPathValidator validator = CertPathValidator.getInstance("PKIX", "BC");

        PKIXParameters paramsWithTrustedCert = new PKIXParameters(Set.of(new TrustAnchor(cacer, null)));
        paramsWithTrustedCert.setRevocationEnabled(false);
        assertThatCode(() -> validator.validate(clientCertPath, paramsWithTrustedCert)).doesNotThrowAnyException();


        PKIXParameters paramsWithoutTrustedCert = new PKIXParameters(Set.of(new TrustAnchor("CN=ca", ca.getPublic(), null)));
        paramsWithoutTrustedCert.setRevocationEnabled(false);
        assertThatThrownBy(() -> validator.validate(clientCertPath, paramsWithoutTrustedCert)).isInstanceOf(NullPointerException.class);
    }

[dghgit]

Thanks for the report. Yes, this is a bug. Now fixed and available on https://www.bouncycastle.org/betas