Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6680432

Display only Digital Signature key usage certificate in client authentication dialog box.

    XMLWordPrintable

    Details

    • Subcomponent:
    • Introduced In Build:
      rc
    • Introduced In Version:
      5.0
    • Resolved In Build:
      b22
    • CPU:
      x86, sparc
    • OS:
      solaris_9, windows_nt, windows_xp
    • Verification:
      Verified

      Backports

        Description

        DoDIIS PKI Environment
        Each user in the DoDIIS environment has 2 PKI certificates; each certificate has th
        e same name and same DN, but has different key usages (Digital Signature vs. Key En
        cipherment). Both keys are loaded into Internet Explorer (IE). The Key Encipherme
        nt certificate is required for email encryption, and the Digital Signature certific
        ate is used for identity verification on the web.

        Internet Explorer - When IE prompts to choose the correct certificate, it will only
         allow the user to pick a certificate with a key usage of Digital Signature.

        Java - When Java prompts the user to choose the correct certificate, it will allow
        the user to select either type of certificate. Since both certificates have the sa
        me name, they appear to be the same, and the user is unable to tell the difference.
          There is absolutely no way to determine which the correct certificate is. Additi
        onally, each time the user it prompted, the order that the certificated appear in t
        he list changes, forcing the user to guess at which certificate is the one with the
         correct type.

        Problems:
        When the user is prompted to choose the correct certificate from Java, they are una
        ble to tell which certificate is the Digital Signature certificate.
        If the user selects the wrong certificate from the list, the DUKE web server will r
        eject the certificate because it\306s the wrong type.

        DUKE Workaround - The DUKE team has been manually loading the Digital Signature cer
        tificate into the Java keystore and disabling Java from looking in the IE keystore
        for each user.

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                dgu Dennis Gu (Inactive)
                Reporter:
                dgu Dennis Gu (Inactive)
                Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved:
                  Imported:
                  Indexed: