Hello, What also should be mentioned is that the old CAPI clients cannot access CNG Keys. Which is especially a pity since only the new keys benefit from the cryptographic process isolation (not to mention the confusion that it’s hard to see which provide hosts them)
Gruss Bernd Gruss Bernd -- http://bernd.eckenfels.net ________________________________ Von: -980814368m Auftrag von Gesendet: Mittwoch, August 8, 2018 12:35 PM An: Oddbjørn Kvalsund; security-dev@openjdk.java.net Betreff: Re: JDK-6782021 Vinnie is not working on security-libs any more and I think the JBS report should be marked as unassigned. If any contributors want to suggest a patch, then I think it can be reviewed on this list! regards, Sean. On 07/08/2018 06:36, Oddbjørn Kvalsund wrote: Hi, I was just bit by this issue [JDK-6782021] It is not possible to read local computer certificates with the SunMSCAPI provider<https://bugs.openjdk.java.net/browse/JDK-6782021> and from StackOverflow I notice that several other people (see [1][2][3]) have come across the same problem. Coming up on the 10th anniversary for this issue; any chance we'll see some love for it? Or at least a comment on the issue on what timeline to expect and a list of workaround/alternative solutions for the meantime? Background: I'm working with a company having primarily Microsoft infrastructure and they have a routine where all Windows servers automatically receive new certificates/keys when the old ones expire. These certificates are installed in the "Local Computer → Private" certificate store. They're quite fond of this system and hesitant to diverge from it, so my preferred option is to just "get with the program". To temporarily get around JDK-6782021 I created a small utility [5] that intercepts the JDKs call to 'CertOpenSystemStore' [4] and presents a read-only virtual certificate store combining all certificates and keys from the "Current User" and "Local Computer" certificate stores, but this may have unexpected implications that I've not yet uncovered, so I'd much prefer not having to do this. A more thorough solution would be to use the commercial Pheox JCAPI [6] product, but this is rather expensive and way overkill for what I (and most others, it seems) need. References: [1] https://stackoverflow.com/questions/3612962/access-local-machine-certificate-store-in-java/51708360 [2] https://stackoverflow.com/questions/51205158/access-windows-local-machine-personal-keystore-with-java-sunmscapi [3] https://stackoverflow.com/questions/51193143/use-jna-to-get-local-machine-certificate [4] http://hg.openjdk.java.net/jdk/jdk/file/tip/src/jdk.crypto.mscapi/windows/native/libsunmscapi/security.cpp [5] https://github.com/oddbjornkvalsund/wcsa [6] https://pheox.com/products/jcapi/ Best regards, Oddbjørn Kvalsund
