openjdk team mailing list archive

[Brian Kelley <Brian.Kelley@xxxxxxxxxxx>]

Looks like it was caused by the fix to this bug:
https://bugs.launchpad.net/ubuntu/+source/openjdk-6/+bug/556549

-- 
SunPKCS11 provider auto enabled NSS problem
https://bugs.launchpad.net/bugs/580982
You received this bug notification because you are a member of OpenJDK,
which is subscribed to openjdk-6 in ubuntu.

Status in “openjdk-6” package in Ubuntu: New

Bug description:
There is a problem with OpenJDK latest version inside Ubuntu 10.04. The NSS provider is now enabled by default, breaking the applications using the Firefox certificate database, since it is not possible to unload the provider once it is already loaded. Applications using JSS are also broken.

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=473

Currently we are advising our end user customers to remove OpenJDK and install Sun Java as a workaround.
Alternative is to remove the provider from security.policy, but it is not possible without a root.

The reason for auto enabled NSS patch inside Icedtea was to add support for ECC algorithms (Elliptic curve cryptograph) so unit tests would pass. But it is possible add provider inside code providing such algorithms in rare case you need it. However for Keystore support there is no alternative with nss enabled patch (http://icedtea.classpath.org/hg/icedtea6/file/756cd53fa326/patches/icedtea-nss-config.patch).