On 12/19/2013 07:10 PM, Porter, Andrew wrote:
Florian:By backtrace I'm guessing you mean Java debug output, below is what I get in the Tomcat catalina.out with "JAVA_TOOL_OPTIONS=-Djavax.net.debug=ssl,handshake" set in the script that starts Tomcat. Problem happens with the stock OpenJDK 1.7.0-45 java.security file enabling the pkcs11 provider, contrary to what the comment in front of it says: security.provider.9=sun.security.smartcardio.SunPCSC # the NSS security provider was not enabled for this build; it can be enabled # if NSS (libnss3) is available on the machine. The nss.cfg file may need # editing to reflect the location of the NSS installation. security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg If that last line is commented out the problem goes away.
We reverted OpenJDK to use the SunJCE provider in version 1.7.0.40-2.4.3.4.el6.
If you want the debug output as an attachment off-list, just let me know and I'll email you directly.
It would be great to have a self-contained reproducer, so that we can test this before we enable the NSS-backed crypto provider in OpenJDK again. Can you use official channels for this?
-- Florian Weimer / Red Hat Product Security Team ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
