adoptium / adoptium/adoptium-support

Not all key types are passed to alias selection in SSL Client

Open
#200 27 comments 0 reactions 0 assignees View on GitHub
bug jbs:needs-backport-to-11 jbs:needs-backport-to-17 jbs:needs-backport-to-8 keep
Dominant language
No language data
Stars
59
Forks
13
PR merge metrics
No merged PRs in 30d

Description

**Platform: adoptopenjdk-8-hotspot (8u272-b10-3)**

**Architecture: linux amd64**

We are creating a HTTPS connection to a server using client authentication. While connecting, the client explicitly chooses to present one specific entry in the client keystore by overriding X509KeyManager's chooseClientAlias method. However, in openjdk 8u272-b10-3, only the key type "EC" is presented when the chooseClientAlias method is called from the SSL code, whereas in openjdk 8u265-b01-3, the three key types "RSA", "DSA" and "EC" were presented. Because the used key is a RSA key, the client cannot authenticate any more in openjdk 8u272-b10-3.

Attached are a test case to reproduce the problem, together with the keystores and truststores used (nothing special about them apart from the keystore containing the alias "localhost"). The relevant line in the output is key types : [...], which prints the key types passed from the JDK SSL code to the custom key manager.

Desired behavior is to get called with the three key types "RSA", "DSA" and "EC" again.
[SslAliasChoosing.zip](https://github.com/AdoptOpenJDK/openjdk-build/files/5443974/SslAliasChoosing.zip)

**Output when running the test in 8u272-b10-3**
testSSL start
key types : [EC]
aliases for keyType EC are null
valid aliases : []
testSSL stop

**Output when running the test in 8u265-b01-3**
testSSL start
key types : [RSA, DSA, EC]
aliases for keyType RSA are [localhost]
aliases for keyType DSA are null
aliases for keyType EC are null
valid aliases : [localhost]
[
[
Version: V3
Subject: CN=localhost, O=Seitenbau GmbH, L=Konstanz, ST=BW, C=DE
....
]
handler was called
Test successful
testSSL stop

Contributor guide

Open the contributing guide

Research direction

Start with the attached SslAliasChoosing.zip test case and compare its output on OpenJDK 8u272-b10-3 and 8u265-b01-3. Trace the SSL client alias-selection path into X509KeyManager.chooseClientAlias, focusing on why only EC is passed. Done means the RSA, DSA, and EC key types are passed again and the RSA alias localhost authenticates successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.