[jdk11u] RFR: 8359170: Add 2 TLS and 2 CS Sectigo roots

Antonio Vieiro duke at openjdk.org
Thu Jun 12 17:13:27 UTC 2025


Not a clean backport of [JDK-8359170](https://bugs.openjdk.org/browse/JDK-8359170) from 17. This is a late `CPU25_07-critical-approved` enhancement request to include root certificates that are already widely used.

The backport is not clean since 17 uses switch expressions in `CAInterop.java`, which are not available in 11, but it's clean otherwise.

Tested on Linux/x86_86 with `tier1` tests, and additionally:


==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:test/jdk:jdk_security                        1356  1356     0     0   
==============================
TEST SUCCESS



==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:./test/jdk/sun/security/lib/cacerts/VerifyCACerts.java
                                                         1     1     0     0   
==============================
TEST SUCCESS


(Manual test for just test id=sectigotlsrootr46 and test id=sectigotlsroote46)


==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:test/jdk/security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java
                                                         2     2     0     0   
==============================
TEST SUCCESS


(Manual test)


==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:./test/jdk/security/infra/java/security/cert/CertPathValidator/certification/SectigoCSRootCAs.java
                                                         1     1     0     0   
==============================
TEST SUCCESS

-------------

Commit messages:
 - Backport 42a0772283bad618d450378b3d0b513a26ed1156

Changes: https://git.openjdk.org/jdk11u/pull/103/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk11u&pr=103&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8359170
  Stats: 479 lines in 7 files changed: 475 ins; 0 del; 4 mod
  Patch: https://git.openjdk.org/jdk11u/pull/103.diff
  Fetch: git fetch https://git.openjdk.org/jdk11u.git pull/103/head:pull/103

PR: https://git.openjdk.org/jdk11u/pull/103


More information about the jdk-updates-dev mailing list