jdk_security3_0 FAILED sun/security/ssl/X509TrustManagerImpl/Entrust/Distrust.java ValidatorException: No trusted certificate #21027
Comments
JasonFengJ9
added this to the Release 0.49 (Java 8, 11, 17, 21, 23) January refresh milestone
|
@jasonkatonica pls take a look. |
|
This test is failing on this line of the test since the expected exception thrown does not indicate that an untrusted certificate was encountered, instead in Semeru it returns "no trusted certificate found" at all ( no root certificate found ). The test makes use of the I downloaded the just released Temurin build and compared the cacerts file contents as follows: Resulting in this file: And Resulting in this file: Comparing these files the Semeru build is missing the certificate used by the failing test :
( Notice the matching serial between the comment in pem and the listing of the cacerts file ) In total there are 3 missing certificates in the cacerts file within Semeru with the following aliases ( the first alias being the one used by these tests ): @AdamBrousseau I believe the expectation here at this point in time is that the cacerts file should match the contents of the Temurin cacerts file? Perhaps the Semeru build pipeline does not exactly replicate the logic for how temurin is building its cacerts file? |
|
I compared what we have in our branch of temurin-build vs what Adopt has and the content is the same. https://raw.githubusercontent.com/ibmruntimes/temurin-build/refs/heads/ibm/security/certdata.txt I checked the java -version from the orginal link. Built using Which is the current HEAD commit in our repo, containing the last change to cacerts.txt. Perhaps the build is processing that file for Temurin different than Semeru. Will have to dig into it. |
|
"Entrust Root Certification Authority - G4" is in ibmruntimes/temurin-build@52d7516 with the same fingerprints as the cert in Temurin. If it's in the file, not sure why it's not in Semeru. The other two missing certs are not there. |
|
I see this certs build arg (bolded) being passed to the adopt build script.
But it seems to be obsolete I compared the build log from a temurin nightly to our build that produced the sdk above. Seems only the bash set x setting is different. The rest of the cert process lines are identical up until (and including) |
|
Probably this? |
|
Does this sdk produce same or different list? |
I was able to list the contents of the cacerts file on linux x86 platform even though the build is a linux aarch64 build. The contents listed seem to match what we have with the RC1 Semeru build ( Ignoring the creation dates for each trusted cert entry in the file ). temurin-2025-01-20-17-13-jdk8u442-b05.txt This seems to be different then the Temurin GA build I downloaded earlier at https://adoptium.net/temurin/releases/?version=8 for linux x86. |
|
Also occurred at openjdk11_j9_extended.openjdk_aarch64_linux |
|
Adopt is now using release branches for their infra code. As a result, they've built with an older level of cacerts |
|
openjdk17_j9_extended.openjdk_aarch64_linux |
|
@jasonkatonica do you think we should be using the older level of cacerts to match Adoptium, or continue taking the latest? |
Failure link
From internal Test_openjdk8_j9_extended.openjdk_aarch64_linux_testList_0 (rtj-ubu24aarch64-svl-test-e58xx-1)
Rerun in Grinder - Change TARGET to run only the failed test targets
Optional info
Failure output (captured from console output)
5x internal Grinder - all failed
5x internal Grinder w/ RI - 4/5 passed, the failure is different -
PKCS11Exception: CKR_USER_TYPE_INVALID.Across platforms:
openjdk8_j9_extended.openjdk_ppc64_aix
openjdk8_j9_extended.openjdk_ppc64le_linux
The text was updated successfully, but these errors were encountered: