Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8072736

Revocation check fails if CRLDP contains ldap URI with no server name

XMLWordPrintable

      Submitter is having issues (Certificate revocation check fails) making an SSL call when issuer certicate has CDP with ldap:///CN...(i.e.) null ldap server name:

      i.e. the issuer certificate has an CDP with ldap:///CN...
      Subject: CN=xxx.yyy.net, OU=XXX, OU=TTT, O=OOO, L=LLL, C=US
      ...
        Issuer: CN=CDP Root CA, DC=ddd, DC=net
      ...
      [5]: ObjectId: 2.5.29.31 Criticality=false
      CRLDistributionPoints [
        [DistributionPoint:
           [URIName:
      http://certserverxx.corpxx.net/PKIRoot//CorpInternal Root CA.crl, URIName: ldap:///CN=AAA Root CA,CN=AAA,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,
      DC=nsroot,
      DC=net?certificateRevocationList?base?objectClass=cRLDistributionPoint]
      ]]

      Java is interpreting the null ldap server name as localhost and that fails because the client doesn't have an ldap server running.

            robm Robert Mckenna
            shadowbug Shadow Bug
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: