[jdk21u-dev] RFR: 8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs

[Antonio Vieiro]

On Thu, 6 Feb 2025 10:02:04 GMT, Antonio Vieiro <duke at openjdk.org> wrote:

> Clean backport of [JDK-8346587](https://bugs.openjdk.org/browse/JDK-8346587) to distrust TLS server certificates issued after April 15, 2025 and anchored by Camerfirma Root CAs. Low risk.
> 
> It passes tier1 tests and also all jdk/sun/security tests:
> 
> 
> ==============================
> Test summary
> ==============================
>    TEST                                              TOTAL  PASS  FAIL ERROR   
>    jtreg:test/jdk/sun/security                         795   795     0     0   
> ==============================
> TEST SUCCESS

Looks like there's an ongoing GHA availability issue (`api.github.com` is failing). I'll keep on retrying tests. 


Download action repository 'actions/github-script at v7' (SHA:60a0d83039c74a4aee543508d2ffcb1c3799cdea)
Warning: Failed to download action 'https://api.github.com/repos/actions/github-script/tarball/60a0d83039c74a4aee543508d2ffcb1c3799cdea'. Error: Response status code does not indicate success: 502 (Bad Gateway). 1490:16A03E:48BF133:92183DE:67A4889A
Warning: Back off 15.868 seconds before retry.
Warning: Failed to download action 'https://api.github.com/repos/actions/github-script/tarball/60a0d83039c74a4aee543508d2ffcb1c3799cdea'. Error: Response status code does not indicate success: 504 (Gateway Timeout). 
Warning: Back off 29.822 seconds before retry.
Error: Response status code does not indicate success: 503 (Service Unavailable).

-------------

PR Comment: https://git.openjdk.org/jdk21u-dev/pull/1388#issuecomment-2639416245