On Mon, 24 Aug 2026 12:16:59 GMT, Daniel Jeliński <[email protected]> wrote:
> there are 2 easy options to ensure that the PKCS11 generator is used: either > use the FIPS mode (see > `test/jdk/sun/security/pkcs11/tls/fips/FipsModeTLS.java`), which ensures that > keys are only usable by the PKCS11 provider, or remove the SunJCE provider, > ensuring that the SunPKCS11 implementation is the only one available. > > Alternatively, you could add an explicit check that the > `SunTlsExtendedMasterSecret` in the PKCS11 provider is usable. Here the > SunJCE implementation was used because the SunPKCS11 implementation was > throwing exceptions and a fallback was required. > > There's no easy way to check which provider was used at run time, and the > hard ways are probably out of scope for this PR. Thanks! I think the second solution is the better fit for this test. Unfortunately, I cannot remove providers because PKCS11Test depend on services provided by other providers. When I tried reducing the provider set, the test started failing for unrelated reasons. Therefore, I left the provider configuration unchanged and added an explicit check that SunTlsExtendedMasterSecret from the SunPKCS11 provider can be instantiated and used. This should catch cases where JSSE falls back to the SunJCE implementation because the SunPKCS11 implementation is not functioning correctly. ------------- PR Comment: https://git.openjdk.org/jdk/pull/32081#issuecomment-5409955591
