Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8208689

keytool importcert fails with CertificateParsingException if unknown certificate algorithms should be imported

XMLWordPrintable

    • Icon: CSR CSR
    • Resolution: Approved
    • Icon: P4 P4
    • 12
    • security-libs
    • None
    • behavioral
    • minimal
    • Hide
      The command will only try out the user-specific provider if the builtin providers in JDK cannot parse the certificate, so if the command succeeded before this fix it will still succeed with the exact same output. If it failed before now there is a chance it could succeed.
      Show
      The command will only try out the user-specific provider if the builtin providers in JDK cannot parse the certificate, so if the command succeeded before this fix it will still succeed with the exact same output. If it failed before now there is a chance it could succeed.
    • add/remove/modify command line option

      Summary

      The "keytool -printcert" command will use the security provider specified by the "-providername" option to parse a certificate if it cannot be parsed by the builtin providers of JDK.

      Problem

      Sometimes a user wants to inspect the content of a certificate that is using an algorithm not supported by JDK's builtin providers. We should allow the user to choose another provider if available.

      Solution

      Let "keytool -printcert" recognize the "-providername" option. Other provider-related options ("-addprovider", "-providerclass", and "-providerpath") will also be supported so the user can load providers dynamically from a jar or a module. These options are already supported by other keytool commands.

      Specification

      The difference of "keytool -help -printcert" will be

      keytool -printcert [OPTION]...

       Prints the content of a certificate
      
       Options:
      
        -rfc                        output in RFC style
        -file <file>                input file name
        -sslserver <server[:port]>  SSL server host and port
        -jarfile <file>             signed jar file
      + -providername <name>        provider name
      + -addprovider <name>         add security provider by name (e.g. SunPKCS11)
      +   [-providerarg <arg>]        configure argument for -addprovider
      + -providerclass <class>      add security provider by fully-qualified class name
      +   [-providerarg <arg>]        configure argument for -providerclass
      + -providerpath <list>        provider classpath
        -v                          verbose output
      
       Use "keytool -?, -h, or --help" for this help message

            weijun Weijun Wang
            webbuggrp Webbug Group
            Jamil Nimeh, Xuelei Fan
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: