8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs #20731

mcpowers · 2024-08-27T17:18:29Z

Please review this change to distrust TLS server certificates issued after October 31, 2024 and anchored by Entrust Root CAs. This change is in line with similar plans recently announced by Google and Mozilla. TLS server certificates issued before this date will continue to be valid until they expire. This restriction should have minimal compatibility impact since Entrust has announced they will be using a partner (SSL.com) for all TLS server certificates issued after Oct 31, 2024.

See the CSR for more details: https://bugs.openjdk.org/browse/JDK-8339194

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
Change requires CSR request JDK-8339194 to be approved

Issues

JDK-8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs (Enhancement - P3)
JDK-8339194: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs (CSR)

Reviewers

Sean Mullan (@seanjmullan - Reviewer)
Rajan Halade (@rhalade - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/20731/head:pull/20731
$ git checkout pull/20731

Update a local copy of the PR:
$ git checkout pull/20731
$ git pull https://git.openjdk.org/jdk.git pull/20731/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 20731

View PR using the GUI difftool:
$ git pr show -t 20731

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/20731.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2024-08-27T17:18:59Z

👋 Welcome back mpowers! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-08-27T17:20:25Z

@mcpowers This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs

Reviewed-by: mullan, rhalade

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 322 new commits pushed to the master branch:

a22e932: 8337163: Improve SA error message when failing to attach to a core file
a7120e2: 8311993: Test serviceability/sa/UniqueVtableTest.java failed: duplicate vtables detected
5ebdf2d: 8338708: Don't create/destroy debug agent cmdQueueLock for each connection
130ac13: 8337265: Test static-libs build in GitHub Actions
cfec3ac: 8337317: serviceability/jvmti tests failed with FATAL ERROR in native method: Failed during the GetClassSignature call
0d593cd: 8339419: [s390x] Problemlist compiler/c2/irTests/TestIfMinMax.java
c3adcb8: 8338916: Build warnings about overriding recipe for jvm-ldflags.txt
66945e5: 8339336: Fix build system whitespace to adhere to coding conventions
ad40a12: 8339214: Remove misleading CodeBuilder.loadConstant(Opcode, ConstantDesc)
4ca2c20: 8338740: java/net/httpclient/HttpsTunnelAuthTest.java fails with java.io.IOException: HTTP/1.1 header parser received no bytes
... and 312 more: https://git.openjdk.org/jdk/compare/7deee745254e5f32b75a09d84ac5078a122c8b8d...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2024-08-27T17:20:44Z

@mcpowers The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mcpowers · 2024-08-27T23:31:47Z

/csr

openjdk · 2024-08-27T23:32:28Z

@mcpowers has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@mcpowers this pull request must refer to an issue in JBS to be able to link it to a CSR request. To refer this pull request to an issue in JBS, please update the title of this pull request to just the issue ID.

mlbridge · 2024-08-30T19:33:36Z

Webrevs

seanjmullan

Looks good. Please also have Rajan review.

seanjmullan · 2024-08-28T13:02:30Z

src/java.base/share/classes/sun/security/validator/EntrustTLSPolicy.java

@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.


Copyright only needs 2024.

test/jdk/sun/security/ssl/X509TrustManagerImpl/Entrust/Distrust.java has the same problem.
Both have been fixed.

mcpowers · 2024-09-02T22:02:57Z

@rhalade You'll need to review this.

rhalade · 2024-09-03T17:38:30Z

test/jdk/sun/security/ssl/X509TrustManagerImpl/Entrust/Distrust.java

+            X509TrustManager xtm = (X509TrustManager)tm;
+            return xtm;
+        }
+        throw new Exception("No TrustManager for " + type);


Please update this and other Exception thrown in loadCertificateChain and testTM function to RuntimeException.

Will address with separate bug.

rhalade · 2024-09-03T17:41:24Z

test/jdk/sun/security/ssl/X509TrustManagerImpl/Entrust/Distrust.java

+        } catch (CertificateException ce) {
+            // expired TLS certificates should not be treated as failure
+            if (expired(ce)) {
+                System.err.println("Test is N/A, chain is expired");


Should this be updated to throw SkippedException so we know that certificates are expired?

The comment indicates this is normal and not deserving of an exception to grab someone's attention. Sean might think otherwise.

mcpowers · 2024-09-03T19:55:23Z

/integrate

openjdk · 2024-09-03T19:56:02Z

Going to push as commit bbb5161.
Since your change was applied there have been 322 commits pushed to the master branch:

a22e932: 8337163: Improve SA error message when failing to attach to a core file
a7120e2: 8311993: Test serviceability/sa/UniqueVtableTest.java failed: duplicate vtables detected
5ebdf2d: 8338708: Don't create/destroy debug agent cmdQueueLock for each connection
130ac13: 8337265: Test static-libs build in GitHub Actions
cfec3ac: 8337317: serviceability/jvmti tests failed with FATAL ERROR in native method: Failed during the GetClassSignature call
0d593cd: 8339419: [s390x] Problemlist compiler/c2/irTests/TestIfMinMax.java
c3adcb8: 8338916: Build warnings about overriding recipe for jvm-ldflags.txt
66945e5: 8339336: Fix build system whitespace to adhere to coding conventions
ad40a12: 8339214: Remove misleading CodeBuilder.loadConstant(Opcode, ConstantDesc)
4ca2c20: 8338740: java/net/httpclient/HttpsTunnelAuthTest.java fails with java.io.IOException: HTTP/1.1 header parser received no bytes
... and 312 more: https://git.openjdk.org/jdk/compare/7deee745254e5f32b75a09d84ac5078a122c8b8d...master

Your commit was automatically rebased without conflicts.

openjdk · 2024-09-03T19:56:07Z

@mcpowers Pushed as commit bbb5161.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

mcpowers added 4 commits August 19, 2024 10:08

first iteration

3c374e7

second iteration

666169e

Affirmtrust

cb6ed11

ready for review

06b1a76

openjdk bot added the security security-dev@openjdk.org label Aug 27, 2024

mcpowers marked this pull request as draft August 27, 2024 17:21

mcpowers changed the title ~~8337664 Distrust TLS server certificates anchored by Entrust Root CAs~~ 8337664: Distrust TLS server certificates anchored by Entrust Root CAs Aug 27, 2024

openjdk bot added the csr Pull request needs approved CSR before integration label Aug 27, 2024

mcpowers changed the title ~~8337664: Distrust TLS server certificates anchored by Entrust Root CAs~~ 8337664 Aug 27, 2024

openjdk bot changed the title ~~8337664~~ 8337664: Aug 27, 2024

final iteration

6b21fc1

mcpowers changed the title ~~8337664:~~ 8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs Aug 30, 2024

mcpowers marked this pull request as ready for review August 30, 2024 18:54

openjdk bot added rfr Pull request is ready for review and removed csr Pull request needs approved CSR before integration labels Aug 30, 2024

remove unused files

62cbbe5

seanjmullan approved these changes Aug 30, 2024

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Aug 30, 2024

copyright fixes

c9dac1b

openjdk bot removed the ready Pull request is ready to be integrated label Aug 31, 2024

beware moving lines around

ec068cf

rhalade reviewed Sep 3, 2024

View reviewed changes

rhalade approved these changes Sep 3, 2024

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Sep 3, 2024

seanjmullan approved these changes Sep 3, 2024

View reviewed changes

openjdk bot added the integrated Pull request has been integrated label Sep 3, 2024

openjdk bot closed this Sep 3, 2024

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Sep 3, 2024

mcpowers deleted the JDK-8337664 branch September 4, 2024 19:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs #20731

8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs #20731

mcpowers commented Aug 27, 2024 •

edited by openjdk bot

Loading

bridgekeeper bot commented Aug 27, 2024

openjdk bot commented Aug 27, 2024 •

edited

Loading

openjdk bot commented Aug 27, 2024

mcpowers commented Aug 27, 2024

openjdk bot commented Aug 27, 2024

mlbridge bot commented Aug 30, 2024 •

edited

Loading

seanjmullan left a comment

seanjmullan Aug 28, 2024

mcpowers Aug 30, 2024

mcpowers commented Sep 2, 2024

rhalade Sep 3, 2024

mcpowers Sep 3, 2024

rhalade Sep 3, 2024

mcpowers Sep 3, 2024

mcpowers commented Sep 3, 2024

openjdk bot commented Sep 3, 2024

openjdk bot commented Sep 3, 2024

		@@ -0,0 +1,136 @@
		/*
		* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.

8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs #20731

8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs #20731

Conversation

mcpowers commented Aug 27, 2024 • edited by openjdk bot Loading

Progress

Issues

Reviewers

Reviewing

Webrev

bridgekeeper bot commented Aug 27, 2024

openjdk bot commented Aug 27, 2024 • edited Loading

openjdk bot commented Aug 27, 2024

mcpowers commented Aug 27, 2024

openjdk bot commented Aug 27, 2024

mlbridge bot commented Aug 30, 2024 • edited Loading

Webrevs

seanjmullan left a comment

Choose a reason for hiding this comment

seanjmullan Aug 28, 2024

Choose a reason for hiding this comment

mcpowers Aug 30, 2024

Choose a reason for hiding this comment

mcpowers commented Sep 2, 2024

rhalade Sep 3, 2024

Choose a reason for hiding this comment

mcpowers Sep 3, 2024

Choose a reason for hiding this comment

rhalade Sep 3, 2024

Choose a reason for hiding this comment

mcpowers Sep 3, 2024

Choose a reason for hiding this comment

mcpowers commented Sep 3, 2024

openjdk bot commented Sep 3, 2024

openjdk bot commented Sep 3, 2024

mcpowers commented Aug 27, 2024 •

edited by openjdk bot

Loading

openjdk bot commented Aug 27, 2024 •

edited

Loading

mlbridge bot commented Aug 30, 2024 •

edited

Loading