SSL TCK tests errors on IBM JDK

[nziakova]

These 4 tests have errors on IBM JDK 1.8:

• org.eclipse.microprofile.rest.client.tck.ssl.SslContextTest.arquillianBeforeClass
• org.eclipse.microprofile.rest.client.tck.ssl.SslHostnameVerifierTest.arquillianBeforeClass
• org.eclipse.microprofile.rest.client.tck.ssl.SslMutualTest.arquillianBeforeClass
• org.eclipse.microprofile.rest.client.tck.ssl.SslTrustStoreTest.arquillianBeforeClass

Caused by: java.io.IOException: Invalid keystore format
	at com.ibm.crypto.provider.JavaKeyStore.engineLoad(Unknown Source)
	at java.security.KeyStore.load(KeyStore.java:1456)
	at org.eclipse.jetty.util.security.CertificateUtils.getKeyStore(CertificateUtils.java:54)
	at org.eclipse.jetty.util.ssl.SslContextFactory.loadKeyStore(SslContextFactory.java:1194)
	at org.eclipse.jetty.util.ssl.SslContextFactory.load(SslContextFactory.java:334)
	at org.eclipse.jetty.util.ssl.SslContextFactory.doStart(SslContextFactory.java:256)
	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
	at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:167)
	at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:119)
	at org.eclipse.jetty.server.SslConnectionFactory.doStart(SslConnectionFactory.java:94)
	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
	at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:167)
	at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:119)
	at org.eclipse.jetty.server.AbstractConnector.doStart(AbstractConnector.java:282)
	at org.eclipse.jetty.server.AbstractNetworkConnector.doStart(AbstractNetworkConnector.java:81)
	at org.eclipse.jetty.server.ServerConnector.doStart(ServerConnector.java:236)
	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
	at org.eclipse.jetty.server.Server.doStart(Server.java:396)
	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
	at org.eclipse.microprofile.rest.client.tck.ssl.HttpsServer.start(HttpsServer.java:92)
	... 75 more

Java version:

Java(TM) SE Runtime Environment (build 8.0.5.31 - pxa6480sr5fp31-20190311_03(SR5 FP31))
IBM J9 VM (build 2.9, JRE 1.8.0 Linux amd64-64-Bit Compressed References 20190306_411656 (JIT enabled, AOT enabled)
OpenJ9   - d97ae0f
OMR      - a975735
IBM      - ad515e8)
JCL - 20190307_01 based on Oracle jdk8u201-b09```

Run with Resteasy implementation available at https://github.com/resteasy/Resteasy/releases/tag/3.8.0.Final

[kwsutter]

Thanks for the input on Resteasy. We just discovered this ourselves running against the Open Liberty and CXF implementation. It looks to be isolated to the IBM JDK 8 since other JDKs work just fine (OpenJDK 8 + OpenJ9 and OpenJDK 8 + Hotspot). We're investigating with the IBM JDK team.

[nziakova]

Thanks for your reply! I can confirm this is IBM JDK only issue. Runs fine for us on OpenJDK11, OpenJDK8, Oracle JDK 8 and Oracle JDK 11.

[NottyCode]

The keystore and truststore files appear to be of type PKCS12. The TCK relies on Jetty to set the type which it sets to "JKS" by default. It looks like the IBM JSSE implementation doesn't support this but the OpenJDK one does.

[andymc12]

@NottyCode correct, we confirmed with the IBM JDK/JSSE team that the IBM JDK does not support the "compatibility" flag. I'll have a PR shortly that explicitly sets the store types to PKCS12 when starting Jetty and in the MP Config properties for the rest client itself.