Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8328638

Fallback option for POST-only OCSP requests

    XMLWordPrintable

Details

    Backports

      Description

        JDK-8179503 made OCSP client unconditionally use GET requests for small requests. This is explicitly allowed by RFC 5019 and RFC 6960. However, we have seen OCSP responders that -- despite RFC requirements -- are not working well with GET requests.

        There are other reports about this, strongly worded as implementation bugs (e.g. JDK-8287716, https://github.com/openjdk/jdk/commit/f5ee356540d7aa4a7663c0d5d74f5fdb0726b426#r74891389), but this is not an implementation bug per se. Rather, it a surprising behavior that is problematic for real world cases. As the example, some JDK 17 upgrades are currently blocked by this interaction of JDK 17 clients with misbehaving OCSP responders.

        So, to simplify migration, and to match the spirit of Postel's Law, it would be convenient to conditionalize JDK-8179503 with a flag, allowing users to fall back to old behavior to get over the compatibility bump while responders are being fixed up.

        Attachments

          Issue Links

            backported by

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8338800 Fallback option for POST-only OCSP requests

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Open

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8329683 Fallback option for POST-only OCSP requests

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8329685 Fallback option for POST-only OCSP requests

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8329798 Fallback option for POST-only OCSP requests

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved
            csr for

            CSR - null JDK-8328810 Fallback option for POST-only OCSP requests

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Closed
            duplicates

            Enhancement - null JDK-8287716 Wrong implementation RFC 2560 in OCSP.java

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved
            relates to

            Enhancement - null JDK-8329213 Better validation for com.sun.security.ocsp.useget option

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Bug - A problem which impairs or prevents the functions of the product. JDK-8328830 eMudhra emSign CAInterop tests fail

            • P3 - Major loss of function.
            • Resolved

            Enhancement - null JDK-8179503 Java should support GET OCSP calls

            • P3 - Major loss of function.
            • Resolved
            links to

            Commit Commit openjdk/jdk17u-dev/533fac61

            Commit Commit openjdk/jdk21u-dev/fbc5871c

            Commit Commit openjdk/jdk22u/8d7d8a49

            Commit Commit openjdk/jdk/614db2ea

            Review Review openjdk/jdk17u-dev/2338

            Review Review openjdk/jdk21u-dev/413

            Review Review openjdk/jdk22u/121

            Review Review openjdk/jdk/18408

            Activity

              People

                shade Aleksey Shipilev
                shade Aleksey Shipilev
                Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: