adoptium / adoptium/adoptium-support
Not all key types are passed to alias selection in SSL Client
- Dominant language
- No language data
- Stars
- 59
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
**Platform: adoptopenjdk-8-hotspot (8u272-b10-3)**
**Architecture: linux amd64**
We are creating a HTTPS connection to a server using client authentication. While connecting, the client explicitly chooses to present one specific entry in the client keystore by overriding X509KeyManager's chooseClientAlias method. However, in openjdk 8u272-b10-3, only the key type "EC" is presented when the chooseClientAlias method is called from the SSL code, whereas in openjdk 8u265-b01-3, the three key types "RSA", "DSA" and "EC" were presented. Because the used key is a RSA key, the client cannot authenticate any more in openjdk 8u272-b10-3.
Attached are a test case to reproduce the problem, together with the keystores and truststores used (nothing special about them apart from the keystore containing the alias "localhost"). The relevant line in the output is key types : [...], which prints the key types passed from the JDK SSL code to the custom key manager.
Desired behavior is to get called with the three key types "RSA", "DSA" and "EC" again.
[SslAliasChoosing.zip](https://github.com/AdoptOpenJDK/openjdk-build/files/5443974/SslAliasChoosing.zip)
**Output when running the test in 8u272-b10-3**
testSSL start
key types : [EC]
aliases for keyType EC are null
valid aliases : []
testSSL stop
**Output when running the test in 8u265-b01-3**
testSSL start
key types : [RSA, DSA, EC]
aliases for keyType RSA are [localhost]
aliases for keyType DSA are null
aliases for keyType EC are null
valid aliases : [localhost]
[
[
Version: V3
Subject: CN=localhost, O=Seitenbau GmbH, L=Konstanz, ST=BW, C=DE
....
]
handler was called
Test successful
testSSL stop
Contributor guide
Research direction
Start with the attached SslAliasChoosing.zip test case and compare its output on OpenJDK 8u272-b10-3 and 8u265-b01-3. Trace the SSL client alias-selection path into X509KeyManager.chooseClientAlias, focusing on why only EC is passed. Done means the RSA, DSA, and EC key types are passed again and the RSA alias localhost authenticates successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100