You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2026/10/12 11:13:00 UTC
[jira] [Commented] (QPID-8624) [Broker-J] Unable to auto generate self signed certificate on Java17
[ https://issues.apache.org/jira/browse/QPID-8624?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126274#comment-18126274 ]
ASF GitHub Bot commented on QPID-8624:
--------------------------------------
ikshwaks commented on code in PR #181:
URL: https://github.com/apache/qpid-broker-j/pull/181#discussion_r4247353612
##########
broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java:
##########
@@ -92,108 +111,25 @@ public class SSLUtil
private static final Logger LOGGER = LoggerFactory.getLogger(SSLUtil.class);
private static final Integer DNS_NAME_TYPE = 2;
- private static final String[] TLS_PROTOCOL_PREFERENCES = new String[]{"TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1"};
-
-
- private static final Constructor<?> CONSTRUCTOR;
- private static final Method GENERATE_METHOD;
- private static final Method GET_PRIVATE_KEY_METHOD;
- private static final Method GET_SELF_CERTIFICATE_METHOD;
- private static final Constructor<?> X500_NAME_CONSTRUCTOR;
- private static final Constructor<?> DNS_NAME_CONSTRUCTOR;
- private static final Constructor<?> IP_ADDR_NAME_CONSTRUCTOR;
- private static final Constructor<?> GENERAL_NAMES_CONSTRUCTOR;
- private static final Constructor<?> GENERAL_NAME_CONSTRUCTOR;
- private static final Method ADD_NAME_TO_NAMES_METHOD;
- private static final Constructor<?> ALT_NAMES_CONSTRUCTOR;
- private static final Constructor<?> CERTIFICATE_EXTENSIONS_CONSTRUCTOR;
- private static final Method SET_EXTENSION_METHOD;
- private static final Method EXTENSION_GET_NAME_METHOD;
- private static final boolean CAN_GENERATE_CERTS;
+ private static final String[] TLS_PROTOCOL_PREFERENCES = new String[] { "TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1" };
+ private static final Pattern DNS_NAME_PATTERN = Pattern.compile("[\\w&&[^\\d]][\\w\\d.-]*");
+
+ private static final Provider PROVIDER = new BouncyCastleProvider();
Review Comment:
@dakirily Sorry to comment on an old PR. I'd like to understand the reason for setting the provider explicitly in `SSLUtil.generateSelfSignedCertificate()`:
```java
private static final Provider PROVIDER = new BouncyCastleProvider();
...
new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(...)
```
Based on my understanding, without `setProvider`, `JcaX509CertificateConverter` calls `CertificateFactory.getInstance("X.509")`, so JCA picks the most-preferred registered provider that supports X.509 (normally `SUN`). Key-pair generation (`KeyPairGenerator.getInstance(keyAlgorithm)`) and signing (`JcaContentSignerBuilder` without a provider) in the same method already rely on JCA's provider selection (Please feel free to correct me here).
**Why I'm asking:** I am trying to run the broker on a FIPS-enabled JVM in my local, where BC-FIPS (`bc-fips`) is installed and its classes take precedence over `bcprov-jdk18on`. In that setup, the static initializer `new BouncyCastleProvider()` fails:
```
java.lang.NoSuchMethodError: 'void org.bouncycastle.crypto.CryptoServicesRegistrar.checkConstraints(org.bouncycastle.crypto.CryptoServiceProperties)'
at org.bouncycastle.jce.provider.BouncyCastleProvider.loadAlgorithms(...)
at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(...)
```
Because this happens in a static field initializer, `SSLUtil` fails with `ExceptionInInitializerError` and the broker can't start. In FIPS mode I wouldn't want the non-FIPS `BouncyCastleProvider` instantiated at all.
Was there a specific case on Java 17 where the default provider didn't work and `BouncyCastleProvider` was required? If not, would you be open to a small change that drops the explicit provider? I'm happy to raise a JIRA and a PR.
> [Broker-J] Unable to auto generate self signed certificate on Java17
> --------------------------------------------------------------------
>
> Key: QPID-8624
> URL: https://issues.apache.org/jira/browse/QPID-8624
> Project: Qpid
> Issue Type: Bug
> Components: Broker-J
> Affects Versions: qpid-java-broker-9.0.0
> Reporter: Daniil Kirilyuk
> Priority: Major
> Fix For: qpid-java-broker-9.1.0
>
>
> When trying to autogenerate a keystore with self signed certificate on java 17 environment following error is thrown:
> {code:java}
> org.apache.qpid.server.configuration.IllegalConfigurationException: Unable to construct keystore
> at org.apache.qpid.server.security.AutoGeneratedSelfSignedKeyStoreImpl.generatePrivateKeyAndCertificate(AutoGeneratedSelfSignedKeyStoreImpl.java:296)
> at org.apache.qpid.server.security.AutoGeneratedSelfSignedKeyStoreImpl.postResolve(AutoGeneratedSelfSignedKeyStoreImpl.java:169)
> Caused by: java.lang.IllegalAccessException: class org.apache.qpid.server.transport.network.security.ssl.SSLUtil cannot access class sun.security.tools.keytool.CertAndKeyGen (in module java.base) because module java.base does not export sun.security.tools.keytool to unnamed module @6b37576e at java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Unknown Source) at java.base/java.lang.reflect.AccessibleObject.checkAccess(Unknown Source){code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org