8353749: Improve security warning when using JKS or JCEKS keystores by haimaychao · Pull Request #27624 · openjdk/jdk

haimaychao · 2025-10-03T16:26:13Z

This PR improves security warning when using JKS or JCEKS keystores.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8353749: Improve security warning when using JKS or JCEKS keystores (Enhancement - P3)

Reviewers

Weijun Wang (@wangweij - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/27624/head:pull/27624
$ git checkout pull/27624

Update a local copy of the PR:
$ git checkout pull/27624
$ git pull https://git.openjdk.org/jdk.git pull/27624/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 27624

View PR using the GUI difftool:
$ git pr show -t 27624

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/27624.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-10-03T16:27:11Z

👋 Welcome back hchao! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-10-03T16:27:32Z

@haimaychao This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8353749: Improve security warning when using JKS or JCEKS keystores

Reviewed-by: weijun

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 136 new commits pushed to the master branch:

d887359: 8370976: Review the behavioral changes of core reflection descriptor parsing migration
0972ba6: 8371383: Test sun/security/tools/jarsigner/DefaultOptions.java failed due to CertificateNotYetValidException
45246bc: 8371965: Convert TaskQueueSuper to use Atomic
... and 133 more: https://git.openjdk.org/jdk/compare/279f39f14a6329d0147613edc3836b7d6d043186...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-10-03T16:28:12Z

@haimaychao The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-10-03T16:31:30Z

Webrevs

seanjmullan · 2025-10-06T12:24:34Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/resources/jarsigner.properties

 jar.contains.internal.inconsistencies.result.in.different.contents.via.jarfile.and.jarinputstream=This JAR file contains internal inconsistencies that may result in different contents when reading via JarFile and JarInputStream:
 signature.verification.failed.on.entry.1.when.reading.via.jarinputstream=Signature verification failed on entry %s when reading via JarInputStream
 signature.verification.failed.on.entry.1.when.reading.via.jarfile=Signature verification failed on entry %s when reading via JarFile
+outdated.storetype.warning=%1$s uses outdated cryptographic algorithms and will be removed in a future release. Migrate to PKCS12 using:\n\


Call this "jks.storetype.warning" so it is consistent with keytool.properties.

seanjmullan · 2025-10-06T12:27:08Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

    private boolean signerSelfSigned = false;
    private boolean allAliasesFound = true;
    private boolean hasMultipleManifests = false;
+    private boolean outdatedFormat = false;


Suggest calling this variable "weakKeyStore".

seanjmullan · 2025-10-06T12:32:29Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

+            File storeFile = new File(keyStoreName);
+            if (storeFile.isFile()) {
+                KeyStore keyStore = KeyStore.getInstance(storeFile, storepass);
+                realStoreType = keyStore.getType();
+                if (realStoreType.equalsIgnoreCase("JKS")
+                        || realStoreType.equalsIgnoreCase("JCEKS")) {
+                    outdatedFormat = true;
+                }
+            }


I don't think you need the realStoreType field. If you move this check to the end of the else block starting on line 2424 (which means the keystore is a file), and just check the KeyStore.type() I think it should be sufficient, ex:

if (store.getType().equalsIgnoreCase("JKS") || store.getType().equalsIgnoreCase("JCEKS")) { weakKeyStore = true; }

seanjmullan · 2025-10-06T12:33:11Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

+        if (outdatedFormat) {
+            warnings.add(String.format(rb.getString(
+                    "outdated.storetype.warning"),
+                    realStoreType, keystore));


You can pass store.getType() instead of realStoreType here.

seanjmullan · 2025-10-06T12:35:32Z

src/java.base/share/classes/java/security/KeyStore.java

        return (provider == null) ? "(no provider)" : provider.getName();
    }

+    private static void outdatedKeyStoreLog(String type) {


I think it would be simpler to include this warning in the constructor of sun.security.provider.JavaKeyStore. Then you don't need to call this method.

Moved the warning to engineLoad() in JceKeyStore and JavaKeyStore, instead of in their constructors. Otherwise, we may get false positive warnings from KeyStore.getInstance() when it goes thru the list of providers to probe for the right keystore.

seanjmullan · 2025-10-10T13:40:54Z

test/jdk/sun/security/tools/jarsigner/compatibility/Compatibility.java

 /*
 * @test
- * @bug 8217375 8260286 8267319
+ * @bug 8217375 8260286 8267319 8353749


This is not specifically testing this issue, so I don't think you should include the bugid.

Removed the bugid.

seanjmullan · 2025-10-10T13:46:55Z

test/jdk/sun/security/tools/jarsigner/warnings/Test.java

I think you should create a new test which is a subclass of this Test which checks that JKS and JCEKS produce the proper warnings when using jarsigner.

A new test was created under sun/security/tools/keytool to provide test coverage for keytool on JKS and JCEKS followed by using jarsigner.

seanjmullan · 2025-10-10T14:19:18Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

                            is.close();
                        }
                    }
+                    if (store.getType().equalsIgnoreCase("JKS")


We should put in the same logic here as in keytool to check if the real storetype is JKS or JCEKS. See

jdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java

Line 1392 in f6d77cb

// Probe for real type. A JKS can be loaded as PKCS12 because

wangweij · 2025-10-10T15:31:09Z

Do we need to add a warning at store? For example, someone getInstance("JKS") and load(null, null), and finally store it.

bridgekeeper · 2025-11-07T23:38:12Z

@haimaychao This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

haimaychao · 2025-11-13T07:47:13Z

Do we need to add a warning at store? For example, someone getInstance("JKS") and load(null, null), and finally store it.

Added warning at engineStore(), and added a testcase for this scenario.

wangweij · 2025-11-18T23:59:35Z

src/java.base/share/classes/com/sun/crypto/provider/JceKeyStore.java

+                + "release. Migrate to PKCS12 using:\n"
+                + "keytool -importkeystore -srckeystore <keystore> "
+                + "-destkeystore <keystore> -deststoretype pkcs12");
+    }


Currently the debug output has a long prefix containing timestamp etc. If the warning is separated on two lines, does it make sense to call debug.println twice so both lines have the prefix?

haimaychao · 2025-11-21T01:10:04Z

/integrate

openjdk · 2025-11-21T01:10:38Z

Going to push as commit c2ea75b.
Since your change was applied there have been 137 commits pushed to the master branch:

2358d40: 8371953: Document null handling in core reflection APIs
d887359: 8370976: Review the behavioral changes of core reflection descriptor parsing migration
0972ba6: 8371383: Test sun/security/tools/jarsigner/DefaultOptions.java failed due to CertificateNotYetValidException
... and 134 more: https://git.openjdk.org/jdk/compare/279f39f14a6329d0147613edc3836b7d6d043186...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-11-21T01:10:45Z

@haimaychao Pushed as commit c2ea75b.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

haimaychao added 2 commits September 30, 2025 23:12

8353749: Improve security warning when using JKS or JCEKS keystores

c2b90c0

Merge

560d416

openjdk bot added the security security-dev@openjdk.org label Oct 3, 2025

openjdk bot added the rfr Pull request is ready for review label Oct 3, 2025

seanjmullan reviewed Oct 6, 2025

View reviewed changes

haimaychao added 4 commits October 9, 2025 23:38

Remove test TestOutdatedKeyStore.java

9fc01d1

Revert changes to KeyStore.java

3a2334f

Updates with review comments

8246e4d

Updates with review comments

452e5cd

seanjmullan reviewed Oct 10, 2025

View reviewed changes

haimaychao added 2 commits November 12, 2025 23:28

Add warning at store and probe for real type in jarsigner

4f9d90c

Merge

f582d0f

Removed bugid from Compatibility.java test

af30106

wangweij reviewed Nov 18, 2025

View reviewed changes

separate debug.println output

9f3d6ca

wangweij approved these changes Nov 21, 2025

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Nov 21, 2025

openjdk bot added the integrated Pull request has been integrated label Nov 21, 2025

openjdk bot closed this Nov 21, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Nov 21, 2025

Conversation

haimaychao commented Oct 3, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Oct 3, 2025

Uh oh!

openjdk bot commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mlbridge bot commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wangweij commented Oct 10, 2025

Uh oh!

bridgekeeper bot commented Nov 7, 2025

Uh oh!

haimaychao commented Nov 13, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

haimaychao commented Nov 21, 2025

Uh oh!

openjdk bot commented Nov 21, 2025

Uh oh!

openjdk bot commented Nov 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

haimaychao commented Oct 3, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Oct 3, 2025 •

edited

Loading

openjdk bot commented Oct 3, 2025 •

edited

Loading

mlbridge bot commented Oct 3, 2025 •

edited

Loading