Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8146354

keytool no longer supports RFC1123 compliant names in Subject Alternative Names

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P4
    • Resolution: Duplicate
    • Affects Version/s: 7, 8, 9
    • Fix Version/s: None
    • Component/s: security-libs
    • Labels:

      Description

      FULL PRODUCT VERSION :
      123host:~ # java -version
      java version "1.8.0_66"
      Java(TM) SE Runtime Environment (build 1.8.0_66-b17)
      Java HotSpot(TM) 64-Bit Server VM (build 25.66-b17, mixed mode)

      ADDITIONAL OS VERSION INFORMATION :
      123host:~ # uname -a
      Linux 123host.123domain.com 2.6.32-504.30.3.el6.x86_64 #1 SMP Thu Jul 9 15:20:47 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux
      123host:~ # cat /etc/redhat-release
      Red Hat Enterprise Linux Server release 6.6 (Santiago)

      A DESCRIPTION OF THE PROBLEM :
      When generating a Java keystore with keytool, if you include a domain component that starts with a number in the subject alternative name, keytool exits with "DNSName components must begin with a letter."


      Section 4.2.1.6 of RFC 5280:

         When the subjectAltName extension contains a domain name system
         label, the domain name MUST be stored in the dNSName (an IA5String).
         The name MUST be in the "preferred name syntax", as specified by
         Section 3.5 of [RFC1034] and as modified by Section 2.1 of
         [RFC1123].


      Section 2.1 of RFC 1123:
         The syntax of a legal Internet host name was specified in RFC-952
         [DNS:4]. One aspect of host name syntax is hereby changed: the
         restriction on the first character is relaxed to allow either a
         letter or a digit. Host software MUST support this more liberal
         syntax.



      Error output:

      /usr/java/default/bin/keytool -genkeypair -alias WebUI -keyalg RSA -sigalg SHA1withRSA -keypass host -validity 3650 -dname 'CN=123host.123domain.com, ou=WebUI, o=123host.123domain.com' -ext SAN=dns:123host.123domain.com,ip:192.0.2.10,dns:localhost,ip:127.0.0.1 -storepass thepassword -keystore /opt/tomcat/Security/keystore

      keytool error: java.lang.RuntimeException: java.io.IOException: DNSName components must begin with a letter

      ADDITIONAL REGRESSION INFORMATION:
      123host:~ # java -version
      java version "1.8.0_66"
      Java(TM) SE Runtime Environment (build 1.8.0_66-b17)
      Java HotSpot(TM) 64-Bit Server VM (build 25.66-b17, mixed mode)

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      Try to create a keystore with a Subject Alternative Name starting with a number

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      Keystore gets created successfully; keytool exits status 0
      ACTUAL -
      Keytool returns a non-zero exit status and an error message

      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      keytool error: java.lang.RuntimeException: java.io.IOException: DNSName components must begin with a letter

      REPRODUCIBILITY :
      This bug can be reproduced always.

      CUSTOMER SUBMITTED WORKAROUND :
      Do not include a domain component that starts with a number in the subject alternative name of the certificate

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              webbuggrp Webbug Group
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: