8325766: Review seclibs tests for cert expiry #23700

mpdonova · 2025-02-19T15:48:10Z

This PR updates the CertificateBuilder with a new method that creates a new instance with common fields (subject name, public key, serial number, validity, and key uses) filled-in. One test, IPIdentities.java, is updated to show how the method can be used to create various certificates. I attached screenshots that compare the old hard-coded certificates (left) with the new generated certificates.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8325766: Review seclibs tests for cert expiry (Bug - P4)

Reviewers

Artur Barashev (@artur-oracle - Committer) 🔄 Re-review required (review applies to 440c0d9c)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/23700/head:pull/23700
$ git checkout pull/23700

Update a local copy of the PR:
$ git checkout pull/23700
$ git pull https://git.openjdk.org/jdk.git pull/23700/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 23700

View PR using the GUI difftool:
$ git pr show -t 23700

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/23700.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-02-19T15:49:10Z

👋 Welcome back mdonovan! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-02-19T15:50:21Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2025-02-19T15:51:02Z

@mpdonova The following labels will be automatically applied to this pull request:

net
security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-02-19T15:55:58Z

Webrevs

myankelev · 2025-02-20T11:22:31Z

test/lib/jdk/test/lib/security/CertificateBuilder.java

+            throws CertificateException, IOException {
+        SecureRandom random = new SecureRandom();
+
+        boolean [] keyUsage = new boolean[]{false, false, false,


Wouldn't it be easier to just use var keyUsage = new boolean[KeyUsage.values().length]?

I updated the array initialization.

test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java

wangweij · 2025-02-20T20:27:27Z

The similarity between the certificate pairs is impressive! Just curious - why the change in issuer and owner names?

mpdonova · 2025-02-21T13:47:59Z

The similarity between the certificate pairs is impressive! Just curious - why the change in issuer and owner names?

Looks like it's something between keytool and openssl x509. When i print the certificates with openssl, the issuer and owner names are in the opposite order from keytool.

mpdonova · 2025-03-18T14:59:29Z

The similarity between the certificate pairs is impressive! Just curious - why the change in issuer and owner names?

After looking into this some more, I found that X500Name(String dname) is expecting the string to be in the same order as RFC 1779, 2253, or 4514. If you give the constructor a "backwards" string, it will store and print it backwards.

OpenSSL prints them backwards and I was using OpenSSL to print the hard-coded certificates and then just copying and pasting the strings.

I changed the hard-coded DN strings to follow the RFC order.

artur-oracle · 2025-04-03T20:30:33Z

test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java

+                KeyUsage.DIGITAL_SIGNATURE, KeyUsage.NONREPUDIATION, KeyUsage.KEY_ENCIPHERMENT)
+                .addBasicConstraintsExt(false, false, -1)
+                .addExtension(CertificateBuilder.createIPSubjectAltNameExt(true, "127.0.0.1"))
+                .build(trustedCert, caKeys.getPrivate(), "MD5WithRSA");


MD5 algorithm is not allowed in TLSv1.3

I'll address this in JDK-8353738

Sounds good, thanks!

test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java

test/lib/jdk/test/lib/security/CertificateBuilder.java

artur-oracle

LGTM

bridgekeeper · 2025-05-16T20:13:03Z

@mpdonova This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

seanjmullan · 2025-05-30T19:28:27Z

test/lib/jdk/test/lib/security/CertificateBuilder.java

+    public static CertificateBuilder newCertificateBuilder(String subjectName,
+                           PublicKey publicKey, PublicKey caKey, KeyUsage... keyUsages)


My suggestion is to make this a regular constructor and have an additional method that sets the certificate lifetime as a Duration parameter, ex:

new CertificateBuilder(subject, pubKey, caPubKey, keyUsage).withValidity(Duration.ofHours(1));

I think the way it currently is follows the builder pattern better. All of the 'set' methods return this which means if I change this method to a constructor, I'd have to duplicate the "set" code from all those methods.

I like the idea of using Duration but the API for it doesn't really lend itself to this use case. When the certificate is finally created, we write Date objects to the DerOutputStream so I'd have to choose a start time and then calculate the end time based on the duration. It's not hard, but it doesn't seem worth it when the common use case of this class is to generate short-lived certificates for a test. The default one-hour validity will cover the vast majority of tests.

I think the way it currently is follows the builder pattern better. All of the 'set' methods return this which means if I change this method to a constructor, I'd have to duplicate the "set" code from all those methods.

I'm not sure what you mean - can you give an example? I don't see any advantages of using a static method here, but I agree it works either way.

I like the idea of using Duration but the API for it doesn't really lend itself to this use case. When the certificate is finally created, we write Date objects to the DerOutputStream so I'd have to choose a start time and then calculate the end time based on the duration. It's not hard, but it doesn't seem worth it when the common use case of this class is to generate short-lived certificates for a test. The default one-hour validity will cover the vast majority of tests.

I view this test utility class as being flexible enough for different cases. This is a useful method in that the other parameters are common fields that all certs usually have but it also means I can't use this method to to create a certificate with a longer, or shorter validity period. Alternatively, how about adding another method that hard-codes it as one hour:

CertificateBuilder oneHourValidity()

As a constructor, the code would look like this

public CertificateBuilder(String subjectName, PublicKey publicKey, PublicKey caKey, KeyUsage... keyUsages) throws CertificateException, IOException { factory = CertificateFactory.getInstance("X.509"); SecureRandom random = new SecureRandom(); boolean [] keyUsage = new boolean[KeyUsage.values().length]; for (KeyUsage ku : keyUsages) { keyUsage[ku.ordinal()] = true; } this.subjectName = new X500Principal(subjectName); this.publicKey = Objects.requireNonNull(publicKey, "Caught null public key"); notBefore = (Date)Date.from(Instant.now().minus(1, ChronoUnit.HOURS)); notAfter = Date.from(Instant.now().plus(1, ChronoUnit.HOURS)); serialNumber = BigInteger.valueOf(random.nextLong(1000000)+1); byte[] keyIdBytes = new KeyIdentifier(publicKey).getIdentifier(); Extension e = new SubjectKeyIdentifierExtension(keyIdBytes); extensions.put(e.getId(), e); KeyIdentifier kid = new KeyIdentifier(caKey); e = new AuthorityKeyIdentifierExtension(kid, null, null); extensions.put(e.getId(), e); if (keyUsages.length != 0) { e = new KeyUsageExtension(keyUsage); extensions.put(e.getId(), e); } }

it also means I can't use this method to to create a certificate with a longer, or shorter validity period

There are methods to set the not-before and not-after fields. Any field set in this static method can be changed:

newCertificateBuilder(...).notAfter(Date.from(Instant.now().plus(10, TimeUnit.YEARS)));

I don't like using Date here and would be happy to overload it to take Instant as well.

As a constructor, the code would look like this

Ah, I see. Well technically you could call the set methods from the ctor but you would get this-escape compiler warnings, which you probably want to avoid.

it also means I can't use this method to to create a certificate with a longer, or shorter validity period

There are methods to set the not-before and not-after fields. Any field set in this static method can be changed:

newCertificateBuilder(...).notAfter(Date.from(Instant.now().plus(10, TimeUnit.YEARS)));

I don't like using Date here and would be happy to overload it to take Instant as well.

Yes, but I don't think the static method which is generically named newCertificateBuilder should be hard-coding a one hour validity period, that detail should be either in a different method (my preference) or this method should be named more clearly like oneHourCertificateBuilder. I realize this is just a test method, but this is a nicely designed API that has been very useful so I would prefer if we keep the flexibility.

…NotBefore

artur-oracle · 2025-06-24T16:41:26Z

test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java

+
+    private static void setupCertificates() throws Exception {
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
+        kpg.initialize(1024);


This line can be removed so implementation uses a default value.

artur-oracle · 2025-06-24T16:46:16Z

test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java

-        Certificate trusedCert = cf.generateCertificate(is);
-        is.close();
+    private static SSLContext getSSLContext(X509Certificate trustedCert,
+            X509Certificate keyCert, KeyPair key, char[] passphrase) throws Exception {

        // create a key store
        KeyStore ks = KeyStore.getInstance("JKS");


I suggest changing a key store type to PKCS12, should be a better choice in the long run.

8325766: Review seclibs tests for cert expiry

e0da93d

openjdk bot added the rfr Pull request is ready for review label Feb 19, 2025

openjdk bot added security [email protected] net [email protected] labels Feb 19, 2025

myankelev reviewed Feb 20, 2025

View reviewed changes

changed boolean array initialization

9257293

mpdonova added 5 commits February 21, 2025 10:11

Merge branch 'master' into certbuilder

654b951

Merge branch 'master' into certbuilder

ad597c3

Merge branch 'master' into certbuilder

04e85af

Merge branch 'master' into certbuilder

da52a57

reversed order of DN strings when making certificates.

84a6710

artur-oracle reviewed Apr 3, 2025

View reviewed changes

test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java Show resolved Hide resolved

mpdonova added 3 commits April 7, 2025 10:36

Merge branch 'master' into certbuilder

ab90246

Merge branch 'master' into certbuilder

e3754e9

expanded wildcard imports

440c0d9

artur-oracle reviewed Apr 18, 2025

View reviewed changes

test/lib/jdk/test/lib/security/CertificateBuilder.java Show resolved Hide resolved

artur-oracle approved these changes Apr 18, 2025

View reviewed changes

seanjmullan reviewed May 30, 2025

View reviewed changes

mpdonova added 2 commits June 3, 2025 07:46

Merge branch 'master' into certbuilder

17eda49

fixed redundant setNotAfter() calls. One of them should have been set…

2b5533a

…NotBefore

artur-oracle reviewed Jun 24, 2025

View reviewed changes

		public static CertificateBuilder newCertificateBuilder(String subjectName,
		PublicKey publicKey, PublicKey caKey, KeyUsage... keyUsages)

8325766: Review seclibs tests for cert expiry #23700

Are you sure you want to change the base?

8325766: Review seclibs tests for cert expiry #23700

Conversation

mpdonova commented Feb 19, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Feb 19, 2025

Uh oh!

openjdk bot commented Feb 19, 2025

Uh oh!

openjdk bot commented Feb 19, 2025

Uh oh!

mlbridge bot commented Feb 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wangweij commented Feb 20, 2025

Uh oh!

mpdonova commented Feb 21, 2025

Uh oh!

mpdonova commented Mar 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

artur-oracle left a comment

Choose a reason for hiding this comment

Uh oh!

bridgekeeper bot commented May 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mpdonova commented Feb 19, 2025 •

edited by openjdk bot

Loading

mlbridge bot commented Feb 19, 2025 •

edited

Loading