[
https://issues.apache.org/jira/browse/QPID-8624?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126274#comment-18126274
]
ASF GitHub Bot commented on QPID-8624:
--------------------------------------
ikshwaks commented on code in PR #181:
URL: https://github.com/apache/qpid-broker-j/pull/181#discussion_r4247353612
##########
broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java:
##########
@@ -92,108 +111,25 @@ public class SSLUtil
private static final Logger LOGGER =
LoggerFactory.getLogger(SSLUtil.class);
private static final Integer DNS_NAME_TYPE = 2;
- private static final String[] TLS_PROTOCOL_PREFERENCES = new
String[]{"TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1"};
-
-
- private static final Constructor<?> CONSTRUCTOR;
- private static final Method GENERATE_METHOD;
- private static final Method GET_PRIVATE_KEY_METHOD;
- private static final Method GET_SELF_CERTIFICATE_METHOD;
- private static final Constructor<?> X500_NAME_CONSTRUCTOR;
- private static final Constructor<?> DNS_NAME_CONSTRUCTOR;
- private static final Constructor<?> IP_ADDR_NAME_CONSTRUCTOR;
- private static final Constructor<?> GENERAL_NAMES_CONSTRUCTOR;
- private static final Constructor<?> GENERAL_NAME_CONSTRUCTOR;
- private static final Method ADD_NAME_TO_NAMES_METHOD;
- private static final Constructor<?> ALT_NAMES_CONSTRUCTOR;
- private static final Constructor<?> CERTIFICATE_EXTENSIONS_CONSTRUCTOR;
- private static final Method SET_EXTENSION_METHOD;
- private static final Method EXTENSION_GET_NAME_METHOD;
- private static final boolean CAN_GENERATE_CERTS;
+ private static final String[] TLS_PROTOCOL_PREFERENCES = new String[] {
"TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1" };
+ private static final Pattern DNS_NAME_PATTERN =
Pattern.compile("[\\w&&[^\\d]][\\w\\d.-]*");
+
+ private static final Provider PROVIDER = new BouncyCastleProvider();
Review Comment:
@dakirily Sorry to comment on an old PR. I'd like to understand the reason
for setting the provider explicitly in
`SSLUtil.generateSelfSignedCertificate()`:
```java
private static final Provider PROVIDER = new BouncyCastleProvider();
...
new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(...)
```
Based on my understanding, without `setProvider`,
`JcaX509CertificateConverter` calls `CertificateFactory.getInstance("X.509")`,
so JCA picks the most-preferred registered provider that supports X.509
(normally `SUN`). Key-pair generation
(`KeyPairGenerator.getInstance(keyAlgorithm)`) and signing
(`JcaContentSignerBuilder` without a provider) in the same method already rely
on JCA's provider selection (Please feel free to correct me here).
**Why I'm asking:** I am trying to run the broker on a FIPS-enabled JVM in
my local, where BC-FIPS (`bc-fips`) is installed and its classes take
precedence over `bcprov-jdk18on`. In that setup, the static initializer `new
BouncyCastleProvider()` fails:
```
java.lang.NoSuchMethodError: 'void
org.bouncycastle.crypto.CryptoServicesRegistrar.checkConstraints(org.bouncycastle.crypto.CryptoServiceProperties)'
at org.bouncycastle.jce.provider.BouncyCastleProvider.loadAlgorithms(...)
at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(...)
```
Because this happens in a static field initializer, `SSLUtil` fails with
`ExceptionInInitializerError` and the broker can't start. In FIPS mode I
wouldn't want the non-FIPS `BouncyCastleProvider` instantiated at all.
Was there a specific case on Java 17 where the default provider didn't work
and `BouncyCastleProvider` was required? If not, would you be open to a small
change that drops the explicit provider? I'm happy to raise a JIRA and a PR.
> [Broker-J] Unable to auto generate self signed certificate on Java17
> --------------------------------------------------------------------
>
> Key: QPID-8624
> URL: https://issues.apache.org/jira/browse/QPID-8624
> Project: Qpid
> Issue Type: Bug
> Components: Broker-J
> Affects Versions: qpid-java-broker-9.0.0
> Reporter: Daniil Kirilyuk
> Priority: Major
> Fix For: qpid-java-broker-9.1.0
>
>
> When trying to autogenerate a keystore with self signed certificate on java
> 17 environment following error is thrown:
> {code:java}
> org.apache.qpid.server.configuration.IllegalConfigurationException: Unable to
> construct keystore
> at
> org.apache.qpid.server.security.AutoGeneratedSelfSignedKeyStoreImpl.generatePrivateKeyAndCertificate(AutoGeneratedSelfSignedKeyStoreImpl.java:296)
>
> at
> org.apache.qpid.server.security.AutoGeneratedSelfSignedKeyStoreImpl.postResolve(AutoGeneratedSelfSignedKeyStoreImpl.java:169)
>
> Caused by: java.lang.IllegalAccessException: class
> org.apache.qpid.server.transport.network.security.ssl.SSLUtil cannot access
> class sun.security.tools.keytool.CertAndKeyGen (in module java.base) because
> module java.base does not export sun.security.tools.keytool to unnamed module
> @6b37576e at
> java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Unknown
> Source) at java.base/java.lang.reflect.AccessibleObject.checkAccess(Unknown
> Source){code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
