Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Xuelei Fan
On 10/8/2014 12:21 PM, Wang Weijun wrote: > There are two keystores here. -keystore points to user's keystore that > keytool will save into. cacerts is a read-only keystore that is used to find > trusted certs. Got it. Is it possible to add an optional argument for the "-trustcacerts" option? I

Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Wang Weijun
On Oct 8, 2014, at 12:00, Xuelei Fan wrote: > On 10/8/2014 11:37 AM, Wang Weijun wrote: >> >> On Oct 8, 2014, at 11:10, Xuelei Fan wrote: However, I can think of adding a new system property called "jdk.keytool.cacerts" so that people can point it to a file not jre/lib/s

Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Xuelei Fan
On 10/8/2014 11:37 AM, Wang Weijun wrote: > > On Oct 8, 2014, at 11:10, Xuelei Fan wrote: >>> >>> However, I can think of adding a new system property called >>> "jdk.keytool.cacerts" so that people can point it to a file not >>> jre/lib/security/cacerts. This would be useful for the bug report

Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Wang Weijun
On Oct 8, 2014, at 11:10, Xuelei Fan wrote: >> >> However, I can think of adding a new system property called >> "jdk.keytool.cacerts" so that people can point it to a file not >> jre/lib/security/cacerts. This would be useful for the bug reporter and we >> can now finally testing the -trustc

Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Xuelei Fan
On 10/8/2014 10:53 AM, Wang Weijun wrote: > > On Oct 8, 2014, at 10:43, Xuelei Fan wrote: > >> I think Keytool should be independent of JSSE. > > Yes. > > However, I can think of adding a new system property called > "jdk.keytool.cacerts" so that people can point it to a file not > jre/lib/s

Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Wang Weijun
On Oct 8, 2014, at 10:43, Xuelei Fan wrote: > I think Keytool should be independent of JSSE. Yes. However, I can think of adding a new system property called "jdk.keytool.cacerts" so that people can point it to a file not jre/lib/security/cacerts. This would be useful for the bug reporter an

Re: [tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Xuelei Fan
I think Keytool should be independent of JSSE. Xuelei On 10/8/2014 9:35 AM, Wang Weijun wrote: > Hi, SSL/TLS experts > > A bug was recently filed at > >https://bugs.openjdk.java.net/browse/JDK-8059818 > > The reporter requests for keytool -importcert to pre-trust certs in > jre/lib/securi

[tls] On 8059818 Keytool does not recognize jssecacerts for -trustcacerts command line option

2014-10-07 Thread Wang Weijun
Hi, SSL/TLS experts A bug was recently filed at https://bugs.openjdk.java.net/browse/JDK-8059818 The reporter requests for keytool -importcert to pre-trust certs in jre/lib/security/jssecacerts. The command only recognizes jre/lib/security/cacerts now. It is always possible to import a pri

Re: Issue JDK-8048194 backport in jdk9 ?

2014-10-07 Thread Koen Serry
Great!! Thanks a bunch Koen On 07/10/14 12:45, Seán Coffey wrote: Yes - fix pushed to 8u40 code line : https://bugs.openjdk.java.net/browse/JDK-8059564 Tentative timeline for 8u40 can be found at : http://openjdk.java.net/projects/jdk8u/releases/8u40.html Early access builds are at https:/

Re: Issue JDK-8048194 backport in jdk9 ?

2014-10-07 Thread Seán Coffey
Yes - fix pushed to 8u40 code line : https://bugs.openjdk.java.net/browse/JDK-8059564 Tentative timeline for 8u40 can be found at : http://openjdk.java.net/projects/jdk8u/releases/8u40.html Early access builds are at https://jdk8.java.net/download.html This fix should make into a build in the

Re: Issue JDK-8048194 backport in jdk9 ?

2014-10-07 Thread Koen Serry
Hi, sorry to be a bit of a nuisance, just for my info, were you able to apply the patch in JDK8u ? Thanks, Koen On 01/10/14 11:41, Seán Coffey wrote: On 01/10/14 01:38, Wang Weijun wrote: On Oct 1, 2014, at 0:05, Seán Coffey wrote: Iris is correct. This fix is in JDK 9 only. I'm not sure

Re: RFR 8059313: Enable keytool NSS test on Mac

2014-10-07 Thread Vincent Ryan
Yes. OSX supports a mechanism to locate (nested) shared libraries using a path relative to the loading library: @loader_path/… Running ‘otool -L’ on a shared library shows the linker paths that have been configured. On 7 Oct 2014, at 00:10, Wang Weijun wrote: > I'll use your libs. > > Why