Bug 567504 - Use system trust store on Windows instead of cacerts

[sratz]

Use the Windows operating system trust store instead of the cacerts bundled with the JVM.

https://bugs.eclipse.org/bugs/show_bug.cgi?id=567504

[merks]

Do we generally expect that the Windows trust store will be more up-to-date? I.e., is there a possibility that a recently published Termurin-based JRE would have root certificates not in the Windows trust store?

[sratz]

Do we generally expect that the Windows trust store will be more up-to-date? I.e., is there a possibility that a recently published Termurin-based JRE would have root certificates not in the Windows trust store?

That's certainly a possibility but unlikely that this should cause any trouble. Microsoft regularly updates the trusted roots:
https://learn.microsoft.com/en-us/security/trusted-root/release-notes

I guess it comes down to what expectations of users we want to fulfill. The operating system trust store is the one users are used to (e.g. in browsers) and what they probably expect to be used in arbitrary 3rd party applications. It may also contains corporate specific certificates.

Our experience is that it is quite unintuitive that the EPP packages come with their own cacerts ('Why does it work in my browser but not in Eclipse?')

[merks]

This issue of certificates used by a corporate firewall is quite a common problem and with an embedded JRE this is even harder for users to fix, especially for the installer where the whole thing is packaged as a *.exe...

[merks]

@sratz

Note that I tried these options in the installer, but the result just hangs trying to access the internet. I have not had time to track down what might be causing that. Maybe the installer is special because it extracts itself into the temp folder. Using the options with a debug launch works fine...

[sratz]

@sratz

Note that I tried these options in the installer, but the result just hangs trying to access the internet. I have not had time to track down what might be causing that. Maybe the installer is special because it extracts itself into the temp folder. Using the options with a debug launch works fine...

I went trough the JDK sources and apparently the correct properties to set actually are

-Djavax.net.ssl.trustStoreType=Windows-ROOT -Djavax.net.ssl.trustStore=NONE

instead of

-Djavax.net.ssl.trustStoreType=Windows-ROOT -Djavax.net.ssl.trustStore=NUL

Can you see if using NONE helps in the Installer?

[merks]

Yes, the installer works with this in the product:

      <vmArgsWin>-Djavax.net.ssl.trustStoreType=Windows-ROOT
-Djavax.net.ssl.trustStore=NONE
      </vmArgsWin>

[akurtakov]

Is there anything still planned here?

[merks]

I've not changed this for the installer because I'm kind of scared to do that because this isn't something I can really test...

[akurtakov]

So should this one be closed if nothing will be done?

[merks]

I do get the feeling this is a correct and good thing. I’ve seen more than once this solves problems inside firewalls.

[BeckerWdf]

@sratz: Should we merge this?

[sratz]

@sratz: Should we merge this?

I updated the PR to use the correct NONE instead of NUL.

Technically this works, but

• This is only the platform product. The impact would probably be bigger if that was done in the EPPs' INI files.
• This only improves the situation on Windows.

[akurtakov]

@niraj-modi Would you please review this one as it's Windows specific?