Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

8341059: Change Entrust TLS distrust date to November 12, 2024 #2922

Closed
wants to merge 1 commit into from
Closed

8341059: Change Entrust TLS distrust date to November 12, 2024 #2922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/java.base/share/classes/sun/security/validator/CADistrustPolicy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ void checkDistrust(String variant, X509Certificate[] chain)

/**
* Distrust TLS Server certificates anchored by an Entrust root CA and
* issued after October 31, 2024. If enabled, this policy is currently
* issued after November 11, 2024. If enabled, this policy is currently
* enforced by the PKIX and SunX509 TrustManager implementations
* of the SunJSSE provider implementation.
*/
Expand Down
8 changes: 4 additions & 4 deletions src/java.base/share/classes/sun/security/validator/EntrustTLSPolicy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,8 +88,8 @@ final class EntrustTLSPolicy {

// Any TLS Server certificate that is anchored by one of the Entrust
// roots above and is issued after this date will be distrusted.
private static final LocalDate OCTOBER_31_2024 =
LocalDate.of(2024, Month.OCTOBER, 31);
private static final LocalDate NOVEMBER_11_2024 =
LocalDate.of(2024, Month.NOVEMBER, 11);

/**
* This method assumes the eeCert is a TLS Server Cert and chains back to
Expand All @@ -111,8 +111,8 @@ static void checkDistrust(X509Certificate[] chain)
Date notBefore = chain[0].getNotBefore();
LocalDate ldNotBefore = LocalDate.ofInstant(notBefore.toInstant(),
ZoneOffset.UTC);
// reject if certificate is issued after October 31, 2024
checkNotBefore(ldNotBefore, OCTOBER_31_2024, anchor);
// reject if certificate is issued after November 11, 2024
checkNotBefore(ldNotBefore, NOVEMBER_11_2024, anchor);
}
}

Expand Down
2 changes: 1 addition & 1 deletion src/java.base/share/conf/security/java.security
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1282,7 +1282,7 @@ jdk.sasl.disabledMechanisms=
# Distrust after December 31, 2019.
#
# ENTRUST_TLS : Distrust TLS Server certificates anchored by
# an Entrust root CA and issued after October 31, 2024.
# an Entrust root CA and issued after November 11, 2024.
#
# Leading and trailing whitespace surrounding each value are ignored.
# Unknown values are ignored. If the property is commented out or set to the
Expand Down
12 changes: 6 additions & 6 deletions test/jdk/sun/security/ssl/X509TrustManagerImpl/Entrust/Distrust.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@

/**
* @test
* @bug 8337664
* @bug 8337664 8341059
* @summary Check that TLS Server certificates chaining back to distrusted
* Entrust roots are invalid
* @library /test/lib
Expand All @@ -59,14 +59,14 @@ public class Distrust {
"affirmtrustpremiumca", "affirmtrustpremiumeccca" };

// A date that is after the restrictions take effect
private static final Date NOVEMBER_1_2024 =
Date.from(LocalDate.of(2024, 11, 1)
private static final Date NOVEMBER_12_2024 =
Date.from(LocalDate.of(2024, 11, 12)
.atStartOfDay(ZoneOffset.UTC)
.toInstant());

// A date that is a second before the restrictions take effect
private static final Date BEFORE_NOVEMBER_1_2024 =
Date.from(LocalDate.of(2024, 11, 1)
private static final Date BEFORE_NOVEMBER_12_2024 =
Date.from(LocalDate.of(2024, 11, 12)
.atStartOfDay(ZoneOffset.UTC)
.minusSeconds(1)
.toInstant());
Expand All @@ -84,7 +84,7 @@ public static void main(String[] args) throws Exception {
Security.setProperty("jdk.security.caDistrustPolicies", "");
}

Date notBefore = before ? BEFORE_NOVEMBER_1_2024 : NOVEMBER_1_2024;
Date notBefore = before ? BEFORE_NOVEMBER_12_2024 : NOVEMBER_12_2024;

X509TrustManager pkixTM = getTMF("PKIX", null);
X509TrustManager sunX509TM = getTMF("SunX509", null);
Expand Down