You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cxf.apache.org by "jgoodyear (via GitHub)" <gi...@apache.org> on 2024/04/27 00:07:13 UTC
[PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
jgoodyear opened a new pull request, #1836:
URL: https://github.com/apache/cxf/pull/1836
This change will allow the WSS40 cert check test to be skipped when using Red Hat JDK.
Red Hat OpenJDK must have RSA keySize 2048 or greater.
see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "reta (via GitHub)" <gi...@apache.org>.
reta commented on code in PR #1836:
URL: https://github.com/apache/cxf/pull/1836#discussion_r1581891218
##########
services/xkms/xkms-x509-handlers/src/test/java/org/apache/cxf/xkms/x509/validator/TrustedAuthorityValidatorCRLTest.java:
##########
@@ -91,8 +91,12 @@ public void testIsCertChainValid() throws CertificateException {
validator.isCertificateChainValid(Arrays.asList(certificateRoot)));
Assert.assertTrue("wss40rev should not be valid",
!validator.isCertificateChainValid(Arrays.asList(certificateWss40Rev)));
- Assert.assertTrue("wss40 should be valid",
- validator.isCertificateChainValid(Arrays.asList(certificateWss40)));
+ //Red Hat OpenJDK must have RSA keySize 2048 or greater.
+ //see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
Review Comment:
@jgoodyear I am wondering if this should be really treated as RedHat specific vs checking the `AlgorithmConstraints`:
```
final AlgorithmConstraints disabledAlgConstraints =
new DisabledAlgorithmConstraints(PROPERTY_CERTPATH_DISABLED_ALGS);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "ffang (via GitHub)" <gi...@apache.org>.
ffang commented on code in PR #1836:
URL: https://github.com/apache/cxf/pull/1836#discussion_r1583250344
##########
services/xkms/xkms-x509-handlers/src/test/java/org/apache/cxf/xkms/x509/validator/TrustedAuthorityValidatorCRLTest.java:
##########
@@ -91,8 +91,12 @@ public void testIsCertChainValid() throws CertificateException {
validator.isCertificateChainValid(Arrays.asList(certificateRoot)));
Assert.assertTrue("wss40rev should not be valid",
!validator.isCertificateChainValid(Arrays.asList(certificateWss40Rev)));
- Assert.assertTrue("wss40 should be valid",
- validator.isCertificateChainValid(Arrays.asList(certificateWss40)));
+ //Red Hat OpenJDK must have RSA keySize 2048 or greater.
+ //see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
Review Comment:
Hi @jgoodyear ,
Thanks for reporting and the investigation!
Could you please try out the new cer files I put on
https://issues.apache.org/jira/browse/CXF-9006
which are RSA2048 instead previous DSA 1024.
Please let me know if they are helpful.
Best Regards
Freeman
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "jgoodyear (via GitHub)" <gi...@apache.org>.
jgoodyear commented on code in PR #1836:
URL: https://github.com/apache/cxf/pull/1836#discussion_r1583288930
##########
services/xkms/xkms-x509-handlers/src/test/java/org/apache/cxf/xkms/x509/validator/TrustedAuthorityValidatorCRLTest.java:
##########
@@ -91,8 +91,12 @@ public void testIsCertChainValid() throws CertificateException {
validator.isCertificateChainValid(Arrays.asList(certificateRoot)));
Assert.assertTrue("wss40rev should not be valid",
!validator.isCertificateChainValid(Arrays.asList(certificateWss40Rev)));
- Assert.assertTrue("wss40 should be valid",
- validator.isCertificateChainValid(Arrays.asList(certificateWss40)));
+ //Red Hat OpenJDK must have RSA keySize 2048 or greater.
+ //see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
Review Comment:
The updated certificates allowed the test case to pass on Stream 9 OS on POWER.
I'm running some builds on other platforms/JVMs to ensure all is well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "ffang (via GitHub)" <gi...@apache.org>.
ffang merged PR #1836:
URL: https://github.com/apache/cxf/pull/1836
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "ffang (via GitHub)" <gi...@apache.org>.
ffang commented on code in PR #1836:
URL: https://github.com/apache/cxf/pull/1836#discussion_r1583463467
##########
services/xkms/xkms-x509-handlers/src/test/java/org/apache/cxf/xkms/x509/validator/TrustedAuthorityValidatorCRLTest.java:
##########
@@ -91,8 +91,12 @@ public void testIsCertChainValid() throws CertificateException {
validator.isCertificateChainValid(Arrays.asList(certificateRoot)));
Assert.assertTrue("wss40rev should not be valid",
!validator.isCertificateChainValid(Arrays.asList(certificateWss40Rev)));
- Assert.assertTrue("wss40 should be valid",
- validator.isCertificateChainValid(Arrays.asList(certificateWss40)));
+ //Red Hat OpenJDK must have RSA keySize 2048 or greater.
+ //see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
Review Comment:
Awesome, thanks for the update! I will commit new cer files.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "jgoodyear (via GitHub)" <gi...@apache.org>.
jgoodyear commented on code in PR #1836:
URL: https://github.com/apache/cxf/pull/1836#discussion_r1583203249
##########
services/xkms/xkms-x509-handlers/src/test/java/org/apache/cxf/xkms/x509/validator/TrustedAuthorityValidatorCRLTest.java:
##########
@@ -91,8 +91,12 @@ public void testIsCertChainValid() throws CertificateException {
validator.isCertificateChainValid(Arrays.asList(certificateRoot)));
Assert.assertTrue("wss40rev should not be valid",
!validator.isCertificateChainValid(Arrays.asList(certificateWss40Rev)));
- Assert.assertTrue("wss40 should be valid",
- validator.isCertificateChainValid(Arrays.asList(certificateWss40)));
+ //Red Hat OpenJDK must have RSA keySize 2048 or greater.
+ //see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
Review Comment:
Given we can not change JVM Parameters at runtime for the test case we have 2 options:
1. Skip on RH JVM,
2. Generate a RSA >= 2048 certificate to replace the wss40 cer we currently have.
I've tried some self signed certs, however i keep getting invalid cert errors - may need to reach out to Colm.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CXF-9006] Skip WSS40 cer validation check when on Red Hat JDK [cxf]
Posted by "jgoodyear (via GitHub)" <gi...@apache.org>.
jgoodyear commented on code in PR #1836:
URL: https://github.com/apache/cxf/pull/1836#discussion_r1583415604
##########
services/xkms/xkms-x509-handlers/src/test/java/org/apache/cxf/xkms/x509/validator/TrustedAuthorityValidatorCRLTest.java:
##########
@@ -91,8 +91,12 @@ public void testIsCertChainValid() throws CertificateException {
validator.isCertificateChainValid(Arrays.asList(certificateRoot)));
Assert.assertTrue("wss40rev should not be valid",
!validator.isCertificateChainValid(Arrays.asList(certificateWss40Rev)));
- Assert.assertTrue("wss40 should be valid",
- validator.isCertificateChainValid(Arrays.asList(certificateWss40)));
+ //Red Hat OpenJDK must have RSA keySize 2048 or greater.
+ //see jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
Review Comment:
Test suite testing:
Windows 11 Pro, x64 , IBM Semeru Java 17: Passed
Ubuntu 22.04 LTS, x64, Eclipse Adoptium Java 17: Passed
MacOS 14.4.1, AArch64, IBM Semeru Java 17: Passed
Stream 9 OS, PPC64LE, Red Hat OpenJDK 17: Passed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cxf.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org