This is an automated email from the ASF dual-hosted git repository.
jamesnetherton pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git
The following commit(s) were added to refs/heads/main by this push:
new e729457e2e5 Fixes #9443. Generate cxf-soap-ws-trust test keystores
without MAC to make them readable by JDK 21 on RHEL FIPS
e729457e2e5 is described below
commit e729457e2e5215f69fa5e6ac1ecf68acbff60913
Author: Jiří Ondrušek <[email protected]>
AuthorDate: Mon Nov 9 08:35:12 2026 +0100
Fixes #9443. Generate cxf-soap-ws-trust test keystores without MAC to make
them readable by JDK 21 on RHEL FIPS
OpenSSL on RHEL in FIPS mode protects PKCS#12 files with a PBMAC1 MAC,
which keytool from JDK 21 cannot verify:
"Algorithm HmacPBE1.2.840.113549.1.5.14 not available".
Co-authored-by: jiriOndrusek-agent <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
integration-test-groups/cxf-soap/cxf-soap-ws-trust/generate-certs.sh | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git
a/integration-test-groups/cxf-soap/cxf-soap-ws-trust/generate-certs.sh
b/integration-test-groups/cxf-soap/cxf-soap-ws-trust/generate-certs.sh
index 9f4a5881e05..c635223a8dd 100755
--- a/integration-test-groups/cxf-soap/cxf-soap-ws-trust/generate-certs.sh
+++ b/integration-test-groups/cxf-soap/cxf-soap-ws-trust/generate-certs.sh
@@ -63,7 +63,8 @@ for actor in client service sts actas; do
openssl x509 -req -in "$workDir/$actor.csr" -CA "$workDir/cxfca.pem" -CAkey
"$workDir/cxfca.key" -CAcreateserial -days $days -out "$workDir/$actor.crt"
# Export keystores
- openssl pkcs12 -export -in "$workDir/$actor.crt" -inkey
"$workDir/$actor.key" -certfile "$workDir/cxfca.crt" -name "my${actor}key" -out
"$destinationDir/${actor}store.pkcs12" -passout pass:"$password" -keypbe
"$encryptionAlgo" -certpbe "$encryptionAlgo"
+ # -nomac: OpenSSL on RHEL in FIPS mode would use a PBMAC1 MAC that JDK 21
keytool cannot verify
+ openssl pkcs12 -export -in "$workDir/$actor.crt" -inkey
"$workDir/$actor.key" -certfile "$workDir/cxfca.crt" -name "my${actor}key" -out
"$destinationDir/${actor}store.pkcs12" -passout pass:"$password" -keypbe
"$encryptionAlgo" -certpbe "$encryptionAlgo" -nomac
done
keytool -import -trustcacerts -alias mystskey -file "$workDir/sts.crt"
-noprompt -keystore "$destinationDir/servicestore.pkcs12" -storepass
"$password"
