← Back to team overview

openjdk team mailing list archive

  1. openjdk team
  2. Mailing list archive
  3. Message #12991

[Bug 1770553] Re: [SRU] backport ca-certificates-java from cosmic (20180516ubuntu1)

  Thread Previous • Date Previous • • Thread Next 
** Description changed:

  [Impact]
- Any user doing a new install - or upgrading, if openjdk was not installed - can be affected as soon as they install any openjdk-11 package.
+ Any user doing a new install - or upgrading if openjdk was not installed - can be affected as soon as they install any openjdk-11 package.
  
  [Cause]
- The ca-certificate-java version 20170930 (or earlier) used the default keystore to create /etc/ssl/certs/java/cacerts - if the file already existed its contents were just updated.
+ The ca-certificate-java version 20170930 (or earlier) used the default keystore to create /etc/ssl/certs/java/cacerts - if the file already existed its contents were just updated without changing the keystore
+ type.
  
  From openjdk-9 upwards the default keystore type changed from 'jks' to
  'pkcs12' [1] by means of JEP 229 [2]. A JKS keystore can be read without
  supplying a password (or by supplying an empty one) while a PKCS12
  keystore requires a password to be set.
  
  Thus a /etc/ssl/certs/java/cacerts created in the pkcs12 format will
  fail to be loaded as, by default, the truststore password is empty - in
  order to avoid that the user must set
  -Djavax.net.ssl.trustStorePassword=<passwd> or define it in /etc/java-
  XX-openjdk/management/management.properties. A JKS keystore will work
  normally, as the certificates in it can be ready when the truststore
  password is empty.
  
+ Ubuntu does *not* set the javax.net.ssl.trustStorePassword by default
+ thus any user that got a cacerts generated in JKCS12 won't be able
+ to use any secure connections from java.
+ 
  [Test Case with cacerts 20170930ubuntu1 or earlier]
  Start on a new bionic install/chroot without openjdk
  
  1. Install openjdk-11
  $ sudo apt-get install openjdk-11-jdk
  
+ 
  2. Test the keystore with an empty password (optional) and make sure it is a PKCS12
  $ keytool -list -cacerts
- Enter keystore password:  
- 
+ Enter keystore password: <leave empty>
  *****************  WARNING WARNING WARNING  *****************
  * The integrity of the information stored in your keystore  *
  * has NOT been verified!  In order to verify its integrity, *
  * you must provide your keystore password.                  *
  *****************  WARNING WARNING WARNING  *****************
- 
  Keystore type: PKCS12
  Keystore provider: SUN
- 
  Your keystore contains 0 entries
  
+ 
  3. Test with the "changeit" password
- keytool -list -cacerts
- Enter keystore password: changeit 
+ $ keytool -list -cacerts
+ Enter keystore password: changeit
  Keystore type: PKCS12
  Keystore provider: SUN
- 
  Your keystore contains 133 entries
- 
  <snipped various certs>
  
+ 
  4. Create the java test file
- $ cat <<EOF >HttpsTester.java 
+ $ cat <<EOF >HttpsTester.java
  import java.net.URL;
  import javax.net.ssl.HttpsURLConnection;
  public class HttpsTester {
  public static void main(String[] args) throws java.io.IOException {
  HttpsURLConnection connection = (HttpsURLConnection) new URL("https://www.ubuntu.com";).openConnection();
  System.out.println("Response code: " + connection.getResponseCode());
  System.out.println("It worked!");
  }
  }
+ EOF
+ 
  
  5. Compile it
  $ javac HttpsTester.java
  
+ 
  6. Call it
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java HttpsTester
  
+ 
  7. Call it again, this time set the store password
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java \
-   -Djavax.net.ssl.trustStorePassword=changeit HttpsTester
+   -Djavax.net.ssl.trustStorePassword=changeit HttpsTester
  Response code: 200
  It worked!
  
- [Test Case with cacerts 20180413 or later]
+ 
+ 8. Install the newer ca-certificates-java 20180516, it should
+ migrate cacerts from PKCS12 to JKS. Check that by running step #2
+ again
+ $ keytool -list -cacerts
+ Enter keystore password: <leave empty>
+ *****************  WARNING WARNING WARNING  *****************
+ * The integrity of the information stored in your keystore  *
+ * has NOT been verified!  In order to verify its integrity, *
+ * you must provide your keystore password.                  *
+ *****************  WARNING WARNING WARNING  *****************
+ Keystore type: JKS
+ Keystore provider: SUN
+ Your keystore contains 133 entries
+ <snipped various certs>
+ 
+ 
+ 9. The old keystore should be saved in 
+ /etc/ssl/certs/java/cacerts.dpkg-old, test it exists:
+ $ keytool -list -keystore /etc/ssl/certs/java/cacerts.dpkg-old
+ Enter keystore password: <leave empty>
+ *****************  WARNING WARNING WARNING  *****************
+ * The integrity of the information stored in your keystore  *
+ * has NOT been verified!  In order to verify its integrity, *
+ * you must provide your keystore password.                  *
+ *****************  WARNING WARNING WARNING  *****************
+ Keystore type: PKCS12
+ Keystore provider: SUN
+ Your keystore contains 0 entries
+ 
+ [Test Case with cacerts 20180516 or later]
  Start on a new bionic install/chroot without openjdk
  
  1. Install openjdk-11
  $ sudo apt-get install openjdk-11-jdk
  
+ 
  2. Test the keystore with an empty password (optional) and make sure it is a JKS
- keytool -list -cacerts
- Enter keystore password:  
- 
+ $ keytool -list -cacerts
+ Enter keystore password:
  *****************  WARNING WARNING WARNING  *****************
  * The integrity of the information stored in your keystore  *
  * has NOT been verified!  In order to verify its integrity, *
  * you must provide your keystore password.                  *
  *****************  WARNING WARNING WARNING  *****************
- 
  Keystore type: JKS
  Keystore provider: SUN
+ Your keystore contains 133 entries
+ <snipped various certs>
  
- Your keystore contains 133 entries
- 
- <snipped various certs>
  
  3. Test with the "changeit" password
  keytool -list -cacerts
- Enter keystore password: changeit 
+ Enter keystore password: changeit
  Keystore type: JKS
  Keystore provider: SUN
- 
  Your keystore contains 133 entries
- 
  <snipped various certs>
  
+ 
  4. Create the java test file
- $ cat <<EOF >HttpsTester.java 
+ $ cat <<EOF >HttpsTester.java
  import java.net.URL;
  import javax.net.ssl.HttpsURLConnection;
  public class HttpsTester {
  public static void main(String[] args) throws java.io.IOException {
  HttpsURLConnection connection = (HttpsURLConnection) new URL("https://www.ubuntu.com";).openConnection();
  System.out.println("Response code: " + connection.getResponseCode());
  System.out.println("It worked!");
  }
  }
+ EOF
+ 
  
  5. Compile it
  $ javac HttpsTester.java
+ 
  
  6. Call it
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java HttpsTester
  Response code: 200
  It worked!
  
+ 
  7. Call it again, this time set the store password
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java \
-   -Djavax.net.ssl.trustStorePassword=changeit HttpsTester
+   -Djavax.net.ssl.trustStorePassword=changeit HttpsTester
  Response code: 200
  It worked!
  
  
- [Regression Potential] 
- 
-  * discussion of how regressions are most likely to manifest as a result
- of this change.
- 
-  * It is assumed that any SRU candidate patch is well-tested before
-    upload and has a low overall risk of regression, but it's important
-    to make the effort to think about what ''could'' happen in the
-    event of a regression.
- 
-  * This both shows the SRU team that the risks have been considered,
-    and provides guidance to testers in regression-testing the SRU.
+ [Regression Potential]
+ * If a user has manually set his own JKCS12 cacerts and didn't update
+ /etc/default/cacerts to set "cacerts_updates=no" (from the default
+ of "cacerts_updates=yes") then his custom cacerts will be converted and overwritten. Still, a copy from the previous cacert is kept at
+ /etc/ssl/certs/java/cacerts.dpkg-old.
  
  [Other Info]
-  
-  * Anything else you think is useful to include
-  * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board
-  * and address these questions in advance
+ The cacerts keystore fix is related to 2 bugs:
+ 1) bug #1739631, fixed by ca-certificates-java-20180413, which changed the default keystore type generated by ca-certificates-java to JKS
+ 2) bug #1771363, fixed by ca-certificates-java-20180516, which migrated
+ cacerts keystore previously generated in PKCS12 to the correct JKS keystore type.
+ 
  
  [References]
  [1] The default keystore is defined by the keystore.type in the
  /etc/java-XX-openjdk/security/java.security file.
  http://hg.openjdk.java.net/jdk-updates/jdk9u/jdk/annotate/46bd35a597eb/src/java.base/share/conf/security/java.security#l186
  
  [2] JEP 229: Create PKCS12 Keystores by Default
  http://openjdk.java.net/jeps/229

-- 
You received this bug notification because you are a member of OpenJDK,
which is subscribed to ca-certificates-java in Ubuntu.
https://bugs.launchpad.net/bugs/1770553

Title:
  [SRU] backport ca-certificates-java from cosmic (20180516ubuntu1)

Status in ca-certificates-java package in Ubuntu:
  Confirmed

Bug description:
  [Impact]
  Any user doing a new install - or upgrading if openjdk was not installed - can be affected as soon as they install any openjdk-11 package.

  [Cause]
  The ca-certificate-java version 20170930 (or earlier) used the default keystore to create /etc/ssl/certs/java/cacerts - if the file already existed its contents were just updated without changing the keystore
  type.

  From openjdk-9 upwards the default keystore type changed from 'jks' to
  'pkcs12' [1] by means of JEP 229 [2]. A JKS keystore can be read
  without supplying a password (or by supplying an empty one) while a
  PKCS12 keystore requires a password to be set.

  Thus a /etc/ssl/certs/java/cacerts created in the pkcs12 format will
  fail to be loaded as, by default, the truststore password is empty -
  in order to avoid that the user must set
  -Djavax.net.ssl.trustStorePassword=<passwd> or define it in /etc/java-
  XX-openjdk/management/management.properties. A JKS keystore will work
  normally, as the certificates in it can be ready when the truststore
  password is empty.

  Ubuntu does *not* set the javax.net.ssl.trustStorePassword by default
  thus any user that got a cacerts generated in JKCS12 won't be able
  to use any secure connections from java.

  [Test Case with cacerts 20170930ubuntu1 or earlier]
  Start on a new bionic install/chroot without openjdk

  1. Install openjdk-11
  $ sudo apt-get install openjdk-11-jdk

  
  2. Test the keystore with an empty password (optional) and make sure it is a PKCS12
  $ keytool -list -cacerts
  Enter keystore password: <leave empty>
  *****************  WARNING WARNING WARNING  *****************
  * The integrity of the information stored in your keystore  *
  * has NOT been verified!  In order to verify its integrity, *
  * you must provide your keystore password.                  *
  *****************  WARNING WARNING WARNING  *****************
  Keystore type: PKCS12
  Keystore provider: SUN
  Your keystore contains 0 entries

  
  3. Test with the "changeit" password
  $ keytool -list -cacerts
  Enter keystore password: changeit
  Keystore type: PKCS12
  Keystore provider: SUN
  Your keystore contains 133 entries
  <snipped various certs>

  
  4. Create the java test file
  $ cat <<EOF >HttpsTester.java
  import java.net.URL;
  import javax.net.ssl.HttpsURLConnection;
  public class HttpsTester {
  public static void main(String[] args) throws java.io.IOException {
  HttpsURLConnection connection = (HttpsURLConnection) new URL("https://www.ubuntu.com";).openConnection();
  System.out.println("Response code: " + connection.getResponseCode());
  System.out.println("It worked!");
  }
  }
  EOF

  
  5. Compile it
  $ javac HttpsTester.java

  
  6. Call it
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java HttpsTester

  
  7. Call it again, this time set the store password
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java \
    -Djavax.net.ssl.trustStorePassword=changeit HttpsTester
  Response code: 200
  It worked!

  
  8. Install the newer ca-certificates-java 20180516, it should
  migrate cacerts from PKCS12 to JKS. Check that by running step #2
  again
  $ keytool -list -cacerts
  Enter keystore password: <leave empty>
  *****************  WARNING WARNING WARNING  *****************
  * The integrity of the information stored in your keystore  *
  * has NOT been verified!  In order to verify its integrity, *
  * you must provide your keystore password.                  *
  *****************  WARNING WARNING WARNING  *****************
  Keystore type: JKS
  Keystore provider: SUN
  Your keystore contains 133 entries
  <snipped various certs>

  
  9. The old keystore should be saved in 
  /etc/ssl/certs/java/cacerts.dpkg-old, test it exists:
  $ keytool -list -keystore /etc/ssl/certs/java/cacerts.dpkg-old
  Enter keystore password: <leave empty>
  *****************  WARNING WARNING WARNING  *****************
  * The integrity of the information stored in your keystore  *
  * has NOT been verified!  In order to verify its integrity, *
  * you must provide your keystore password.                  *
  *****************  WARNING WARNING WARNING  *****************
  Keystore type: PKCS12
  Keystore provider: SUN
  Your keystore contains 0 entries

  [Test Case with cacerts 20180516 or later]
  Start on a new bionic install/chroot without openjdk

  1. Install openjdk-11
  $ sudo apt-get install openjdk-11-jdk

  
  2. Test the keystore with an empty password (optional) and make sure it is a JKS
  $ keytool -list -cacerts
  Enter keystore password:
  *****************  WARNING WARNING WARNING  *****************
  * The integrity of the information stored in your keystore  *
  * has NOT been verified!  In order to verify its integrity, *
  * you must provide your keystore password.                  *
  *****************  WARNING WARNING WARNING  *****************
  Keystore type: JKS
  Keystore provider: SUN
  Your keystore contains 133 entries
  <snipped various certs>

  
  3. Test with the "changeit" password
  keytool -list -cacerts
  Enter keystore password: changeit
  Keystore type: JKS
  Keystore provider: SUN
  Your keystore contains 133 entries
  <snipped various certs>

  
  4. Create the java test file
  $ cat <<EOF >HttpsTester.java
  import java.net.URL;
  import javax.net.ssl.HttpsURLConnection;
  public class HttpsTester {
  public static void main(String[] args) throws java.io.IOException {
  HttpsURLConnection connection = (HttpsURLConnection) new URL("https://www.ubuntu.com";).openConnection();
  System.out.println("Response code: " + connection.getResponseCode());
  System.out.println("It worked!");
  }
  }
  EOF

  
  5. Compile it
  $ javac HttpsTester.java

  
  6. Call it
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java HttpsTester
  Response code: 200
  It worked!

  
  7. Call it again, this time set the store password
  $ /usr/lib/jvm/java-11-openjdk-amd64/bin/java \
    -Djavax.net.ssl.trustStorePassword=changeit HttpsTester
  Response code: 200
  It worked!

  
  [Regression Potential]
  * If a user has manually set his own JKCS12 cacerts and didn't update
  /etc/default/cacerts to set "cacerts_updates=no" (from the default
  of "cacerts_updates=yes") then his custom cacerts will be converted and overwritten. Still, a copy from the previous cacert is kept at
  /etc/ssl/certs/java/cacerts.dpkg-old.

  [Other Info]
  The cacerts keystore fix is related to 2 bugs:
  1) bug #1739631, fixed by ca-certificates-java-20180413, which changed the default keystore type generated by ca-certificates-java to JKS
  2) bug #1771363, fixed by ca-certificates-java-20180516, which migrated
  cacerts keystore previously generated in PKCS12 to the correct JKS keystore type.

  
  [References]
  [1] The default keystore is defined by the keystore.type in the
  /etc/java-XX-openjdk/security/java.security file.
  http://hg.openjdk.java.net/jdk-updates/jdk9u/jdk/annotate/46bd35a597eb/src/java.base/share/conf/security/java.security#l186

  [2] JEP 229: Create PKCS12 Keystores by Default
  http://openjdk.java.net/jeps/229

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/1770553/+subscriptions

References

  Thread Previous • Date Previous • • Thread Next