Re: [PR] QPID-8624: [Broker-J] Unable to auto generate self signed certificate on Java17 [qpid-broker-j]

["ikshwaks (via GitHub)" <gi...@apache.org>]

ikshwaks commented on code in PR #181:
URL: https://github.com/apache/qpid-broker-j/pull/181#discussion_r4247353612


##########
broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java:
##########
@@ -92,108 +111,25 @@ public class SSLUtil
     private static final Logger LOGGER = LoggerFactory.getLogger(SSLUtil.class);
 
     private static final Integer DNS_NAME_TYPE = 2;
-    private static final String[] TLS_PROTOCOL_PREFERENCES = new String[]{"TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1"};
-
-
-    private static final Constructor<?> CONSTRUCTOR;
-    private static final Method GENERATE_METHOD;
-    private static final Method GET_PRIVATE_KEY_METHOD;
-    private static final Method GET_SELF_CERTIFICATE_METHOD;
-    private static final Constructor<?> X500_NAME_CONSTRUCTOR;
-    private static final Constructor<?> DNS_NAME_CONSTRUCTOR;
-    private static final Constructor<?> IP_ADDR_NAME_CONSTRUCTOR;
-    private static final Constructor<?> GENERAL_NAMES_CONSTRUCTOR;
-    private static final Constructor<?> GENERAL_NAME_CONSTRUCTOR;
-    private static final Method ADD_NAME_TO_NAMES_METHOD;
-    private static final Constructor<?> ALT_NAMES_CONSTRUCTOR;
-    private static final Constructor<?> CERTIFICATE_EXTENSIONS_CONSTRUCTOR;
-    private static final Method SET_EXTENSION_METHOD;
-    private static final Method EXTENSION_GET_NAME_METHOD;
-    private static final boolean CAN_GENERATE_CERTS;
+    private static final String[] TLS_PROTOCOL_PREFERENCES = new String[] { "TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1" };
+    private static final Pattern DNS_NAME_PATTERN = Pattern.compile("[\\w&&[^\\d]][\\w\\d.-]*");
+
+    private static final Provider PROVIDER = new BouncyCastleProvider();

Review Comment:
   @dakirily Sorry to comment on an old PR. I'd like to understand the reason for setting the provider explicitly in `SSLUtil.generateSelfSignedCertificate()`:
   
   ```java
   private static final Provider PROVIDER = new BouncyCastleProvider();
   ...
   new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(...)
   ```
   
   Based on my understanding, without `setProvider`, `JcaX509CertificateConverter` calls `CertificateFactory.getInstance("X.509")`, so JCA picks the most-preferred registered provider that supports X.509 (normally `SUN`). Key-pair generation (`KeyPairGenerator.getInstance(keyAlgorithm)`) and signing (`JcaContentSignerBuilder` without a provider) in the same method already rely on JCA's provider selection (Please feel free to correct me here).
   
   **Why I'm asking:** I am trying to run the broker on a FIPS-enabled JVM in my local, where BC-FIPS (`bc-fips`) is installed and its classes take precedence over `bcprov-jdk18on`. In that setup, the static initializer `new BouncyCastleProvider()` fails:
   
   ```
   java.lang.NoSuchMethodError: 'void org.bouncycastle.crypto.CryptoServicesRegistrar.checkConstraints(org.bouncycastle.crypto.CryptoServiceProperties)'
       at org.bouncycastle.jce.provider.BouncyCastleProvider.loadAlgorithms(...)
       at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(...)
   ```
   
   Because this happens in a static field initializer, `SSLUtil` fails with `ExceptionInInitializerError` and the broker can't start. In FIPS mode I wouldn't want the non-FIPS `BouncyCastleProvider` instantiated at all.
   
   Was there a specific case on Java 17 where the default provider didn't work and `BouncyCastleProvider` was required? If not, would you be open to a small change that drops the explicit provider? I'm happy to raise a JIRA and a PR.
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org