IOE causes failure in com.sun.deploy.security.RevocationChecker.checkOCSP from 7u25 and up

[Sean Mullan]

Hi,

I will need some more information in order to debug this, preferably the 
certificate chain - is that something you can email to me?

Otherwise, you can enable the certpath debugging you mention below in 
the Java Contol Panel. Go to the Java tab, and add it to the Runtime 
Parameters of the JRE that you are using. Then email me the log file if 
possible.

-Djava.security.debug=certpath

Thanks,
Sean

On 08/05/2013 11:33 AM, Matthew Hall wrote:
> We have a customer that is seeing the following exception in JDK7u25 after
> revocation checking was enabled by default:
>
> java.security.cert.CertificateException:
> java.security.cert.CertPathValidatorException: java.io.IOException:
> DerInputStream.getLength(): lengthTag=127, too big.
>      at com.sun.deploy.security.RevocationChecker.checkOCSP(Unknown Source)
>      at com.sun.deploy.security.RevocationChecker.check(Unknown Source)
>      at com.sun.deploy.security.TrustDecider.checkRevocationStatus(Unknown Source)
>      at com.sun.deploy.security.TrustDecider.getValidationState(Unknown Source)
>      at com.sun.deploy.security.TrustDecider.validateChain(Unknown Source)
> Caused by: java.security.cert.CertPathValidatorException: java.io.IOException:
> DerInputStream.getLength(): lengthTag=127, too big.
>      at sun.security.provider.certpath.OCSP.check(Unknown Source)
>      at sun.security.provider.certpath.OCSP.check(Unknown Source)
>      at sun.security.provider.certpath.OCSP.check(Unknown Source)
>      ... 35 more
> Caused by: java.io.IOException: DerInputStream.getLength(): lengthTag=127, too big.
>      at sun.security.util.DerInputStream.getLength(Unknown Source)
>      at sun.security.util.DerValue.init(Unknown Source)
>      at sun.security.util.DerValue.<init>(Unknown Source)
>      at sun.security.provider.certpath.OCSPResponse.<init>(Unknown Source)
>      ... 38 more
>
> However this com.sun.deploy.* code doesn't seem to be part of OpenJDK or
> IcedTea, so it's not possible for the community to recompile it with symbols,
> debug it, and find the cause.
>
> I did notice, in the code for sun.security.provider.certpath.OCSP.check which
> is available, I could see a way to get some logs from part of this code:
>
> private static final Debug debug = Debug.getInstance("certpath");
>
> But I haven't had a chance to try that at the customer who found the issue.
>
> I suspect that the code reacts poorly if it sees unexpected characters in
> blocked OCSP sockets, but I can't tell without being able to read checkOCSP to
> see what it's really doing in there. Can anyone take a look?
>
> Thanks,
> Matthew.
>