[jdk17u-dev] RFR: 8350498: Remove two Camerfirma root CA certificates

[Goetz Lindenmaier]

On Thu, 8 May 2025 07:45:49 GMT, Matthias Baesken <mbaesken at openjdk.org> wrote:

>> I backport this for parity with 17.0.18-oracle.
>> 
>> I had to adapt location and the test, as it is always the case with changes to the certs.
>
> test/jdk/sun/security/lib/cacerts/VerifyCACerts.java line 55:
> 
>> 53:     // shasum -a 256 cacerts | sed -e 's/../&:/g' | tr '[:lower:]' '[:upper:]' | cut -c1-95
>> 54:     private static final String CHECKSUM
>> 55:             = "07:21:E0:F8:EA:55:CC:93:24:2E:74:07:4B:6B:CE:F3:81:C3:BB:47:5B:85:A2:F1:9E:44:CD:C0:99:55:D7:5F";
> 
> Strange that the CHECKSUM is different in 17u-dev before and after the change , compared to e.g. 21 and head ; but the number of certs (111 -> 109) seems to be the same.
> Is there some other backport coming/missing ?

Hi Matthias, this is always the case with changes to the certificates in 17. See also previous changes
https://github.com/openjdk/jdk17u-dev/commit/4e67796c3fcbffa706be8fabb56d00f9128edac1
or others in this list: https://github.com/openjdk/jdk17u-dev/commits/4e67796c3fcbffa706be8fabb56d00f9128edac1/test/jdk/sun/security/lib/cacerts/VerifyCACerts.java
I think this is caused by the different location and build functionality used in 17.

-------------

PR Review Comment: https://git.openjdk.org/jdk17u-dev/pull/3557#discussion_r2079165024