Upgrade to Tomcat 8.5.5

[philwebb]

See #6657 for background.

[qerub]

Another reason to update is that Tomcat 8.5.{3-4} has a serious regression with TLS connectors: https://bz.apache.org/bugzilla/show_bug.cgi?id=60035

[snicoll]

Some tests (for instance this one) are failing with the following exception:

Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
    at java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
    at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:157)
    at java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:130)
    at org.apache.tomcat.util.net.jsse.JSSEUtil.getParameters(JSSEUtil.java:341)
    at org.apache.tomcat.util.net.jsse.JSSEUtil.getTrustManagers(JSSEUtil.java:273)
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:101)
    ... 44 more

It looks like these are the ones configuring a custom trustStore. I can see some changes in 8.5.5 about that but I still need to get to the bottom of this. Maybe @markt-asf knows?

[markt-asf]

It will be this commit:
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/net/jsse/JSSEUtil.java?r1=1755010&r2=1758484&diff_format=h

Looking at it now to figure out what is going wrong

[markt-asf]

Try setting the truststoreAlgorithm algorithm on the SSLHostConfig to "CUSTOM" (or anything that isn't the default). If that fixes the failing tests, I'll look into what I can do to fix this in Tomcat.

[markt-asf]

Scratch that. I don't think that will work.

[markt-asf]

It appears that the custom trust manager doesn't contain any X509 certificates. That looks more like a problem with the trust manager than Tomcat at this point.

[snicoll]

@markt-asf I came to the same conclusion. However, these tests are shared with Undertow and Jetty and that doesn't seem to be a problem. Could you please educate us a bit more so that we understand whether this is a test setup issue that Tomcat reveals now or something that should affect our users as well. The fact that Jetty and Undertow aren't complaining bothers me.

Thanks!

[markt-asf]

The commit in question is for this entry in the change log:
"Refactor the JSSE client certificate validation so that the effectiveness of the certificateVerificationDepth configuration attribute does not depend on the presence of a certificate revokation list."

PKIXParameters have always been used to enable CRL support. As far as I am aware, this is the only way to do this with JSSE.

I noticed that certificateVerificationDepth (that also requires the use of PKIXParameters to enforce it) was only being enforced if a CRL was also configured. That seemed wrong to me so I refactored the code to always enforce the certificateVerificationDepth.

Constructing the PKIXParameters needs a trust store and that trust store must contain at least one certificate.

If I had to guess, I'd say that neither Undertow nor Jetty enforce a limit on certificateVerificationDepth by default so neither needs to use PKIXParameters so they don't hit this issue.

[snicoll]

See also #1545 that added this trust store