Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-5011359

Webstart does not trust correctly signed 3rd party JCE provider

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P3
    • Resolution: Duplicate
    • Affects Version/s: 1.4.2_03
    • Fix Version/s: None
    • Component/s: deploy
    • Labels:
    • Subcomponent:
    • CPU:
      x86
    • OS:
      windows_xp

      Description

      java version "1.4.2_02"
      Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_02-b03) Java HotSpot(TM) Client VM
      (build 1.4.2_02-b03, mixed mode)

      ADDITIONAL OS VERSION INFORMATION :
      Windows XP SP1

      EXTRA RELEVANT SYSTEM CONFIGURATION :
      Require 3rd Party JCE provider impementation. Can supply one if required.

      A DESCRIPTION OF THE PROBLEM :
      Problem: Java Webstart does not trust the sun jce code signing ca certificate used to sign 3rd party jce
      provider impelmentations and there is no way to work around this.

      CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Sun Microsystems Inc, L=Palo Alto,
      ST=CA, C=US

      I accept that this certificate is not for use in general for object signing however the JCE in 1.4.2
      requires that the 3rd party provider be signed a certificate issued off this CA.

      In the case of the java plugin it is possible to double sign the provider jar with a object signing
      certificate issued by a trusted root ca. Webstart does not permit a 2nd signature on the provider jar
      file.

      Using the file "as is" results in the security warning

      "Failed to verify the authenticity of this certificate. No assertions can be made about the origin or
      validity of the code.

      It is highly recommended not to install and run this code"
      Which is not something that customers of our provider what their end users to see.

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      using the JNLP extension mechanism to include a seperate jnlp file e.g.
        <security>
            <all-permissions/>
          </security>
          <resources>
              <j2se version="1.4+"/>
              <jar href="testApp.jar"/>
              <extension name="KeyToolsProJava" href="KeyToolsPro.jnlp"/>
          </resources>

      the appropriate section of the KeyToolsPro.jnlp looks like:

          <security>
              <all-permissions/>
          </security>
          <resources>
              <jar href="KeyToolsPro_jce1-2-1_signed.jar"/>
          </resources>

      KeyToolsPro_jce1-2-1_signed.jar is a JCE provider implementation and is signed by

      CN=Betrusted, OU=Java Software Code Signing, O=Sun Microsystems Inc.
       CertReq number: <347>

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
        To get a similar dialog to the default "X was signed by a cert issued by a known CA continue if you
      feel thats ok"
      ACTUAL -
      Security warning dialog:

      Do you want to install and run: KeyTools Pro Java Signed and distributed by: Betrusted

      "Failed to verify the authenticity of this certificate. No assertions can be made about the origin or
      validity of the code.

      It is highly recommended not to install and run this code"


      REPRODUCIBILITY :
      This bug can be reproduced always.

      CUSTOMER SUBMITTED WORKAROUND :
      Like other JCE providers it looks like we have to provider our own JCE framework implementation and
      bypass the Sun one.

      Essentially this means duplicating the javax.crypto and java.security packages in a seperate namespace
      making code 100% incompatible with your JCE.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              ngthomas Thomas Ng (Inactive)
              Reporter:
              cahorton Catherine Horton
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Imported:
                Indexed: