<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 2 Mar 2015, at 17:26, Seán Coffey <<a href="mailto:sean.coffey@oracle.com">sean.coffey@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Jason,<br><br>thanks for taking this on. Your changes look fine to be and should help the debugging experience. Some extra comments from me. Here's some standard output that one sees (early in connection) from a standard TLS connection attempt with verbose certpath logging :<br><br><blockquote type="cite">certpath: PKIXCertPathValidator.engineValidate()...<br>certpath: AdaptableX509CertSelector.match: subject key IDs don't match<br>certpath: NO - don't try this trustedCert<br></blockquote><br>Can we print the subject key IDs for reference ? I'm conscious of line wastage in log files. Bunching the IDs in with the "don't try this trustedCert line" would work perhaps.<br><br>Shortly after that, one reads :<br><br><blockquote type="cite">certpath: Executing PKIX certification path validation algorithm.<br>certpath: Checking cert1 ...<br>certpath: Set of critical extensions:<br>certpath: 2.5.29.15<br>certpath: 2.5.29.19<br></blockquote>Could we improve the PKIXMasterCertPathValidator.validate printing in this case ? Let's print the Subject and/or ID of "cert1"<br>I'm not sure why we print the critical extension list here. Could we append them after "Set of critical extensions:" to avoid extra lines ?<br><br>Shortly after that, we have this in output :<br><br><blockquote type="cite">certpath: ---checking basic constraints...<br>certpath: i = 1<br>certpath: maxPathLength = 2<br>certpath: after processing, maxPathLength = 0<br>certpath: basic constraints verified.<br>certpath: ---checking name constraints...<br>certpath: prevNC = null<br>certpath: newNC = null<br>certpath: mergedNC = null<br>certpath: name constraints verified.<br>certpath: -checker4 validation succeeded<br></blockquote><br>just a tidy up thought, could some of the lines above be concatenated ?<br>E.g. : ConstraintsChecker.java<br><br>227 debug.println("---checking " + msg + "...");<br>228 debug.println("i = " + i);<br>229 debug.println("maxPathLength = " + maxPathLength);<br><br>Maybe some room for concatenation here also :<br>certpath: ---checking timestamp:Mon Mar 02 16:34:47 GMT 2015...<br>certpath: timestamp verified.<br><br>Finally - another reason for why I logged the enhancement request in the first place..<br><br>Take this output :<br><br><blockquote type="cite">*** ServerHelloDone<br>[read] MD5 and SHA1 hashes: len = 4<br>0000: 0E 00 00 00 ....<br>*** Certificate chain<br>***<br></blockquote><br>The final "***" here indicates that the truststore is empty. It's not very obvious to the novice user!<br>I believe the output corresponds to :<br>jdk/src/java.base/share/classes/sun/security/ssl/HandshakeMessage.java#498<br><br>We need to at least print "Empty cert chain" where applicable. This belongs in jsse code but it would be great if this can be improved as part of this fix.<br></blockquote><div><br></div><div><br></div><div>Jason, I have a patch prepared for this that never got pushed. You could include it in your changeset.</div><div><br></div><div><br></div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">diff --git a/src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java b/src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">--- a/src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+++ b/src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">@@ -1,5 +1,5 @@</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> /*</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">- * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ * Copyright (c) 1996, 2014, Oracle and/or its affiliates. All rights reserved.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> *</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> * This code is free software; you can redistribute it and/or modify it</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">@@ -750,6 +750,11 @@</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> } else {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> warningSE(Alerts.alert_no_certificate);</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> }</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ if (debug != null && Debug.isOn("handshake")) {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ System.out.println(</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ "Warning: no suitable certificate found - " +</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ "continuing without client authentication");</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ }</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> }</div><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"> <br class="webkit-block-placeholder"></p><div><br></div><div><br></div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">diff --git a/src/java.base/share/classes/sun/security/ssl/HandshakeMessage.java b/src/java.base/share/classes/sun/security/ssl/HandshakeMessage.java</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">--- a/src/java.base/share/classes/sun/security/ssl/HandshakeMessage.java</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+++ b/src/java.base/share/classes/sun/security/ssl/HandshakeMessage.java</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">@@ -1,5 +1,5 @@</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> /*</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">- * Copyright (c) 1996, 2012, Oracle and/or its affiliates. All rights reserved.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ * Copyright (c) 1996, 2014, Oracle and/or its affiliates. All rights reserved.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> *</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> * This code is free software; you can redistribute it and/or modify it</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">@@ -490,11 +490,14 @@</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> void print(PrintStream s) throws IOException {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> s.println("*** Certificate chain");</div><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"> <br class="webkit-block-placeholder"></p><div style="margin: 0px; font-size: 11px; font-family: Menlo;">- if (debug != null && Debug.isOn("verbose")) {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">- for (int i = 0; i < chain.length; i++)</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ if (chain.length == 0) {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ s.println("<Empty>");</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ } else if (debug != null && Debug.isOn("verbose")) {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ for (int i = 0; i < chain.length; i++) {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> s.println("chain [" + i + "] = " + chain[i]);</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">- s.println("***");</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ }</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> }</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">+ s.println("***");</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> }</div><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"> <br class="webkit-block-placeholder"></p><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> X509Certificate[] getCertificateChain() {</div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div><br></div><div><br></div><br><blockquote type="cite"><br>regards,<br>Sean.<br><br>On 13/02/15 00:05, Jason Uh wrote:<br><blockquote type="cite">Please review this change, which augments some of the debug statements for java.security.debug=certpath.<br><br>webrev: <a href="http://cr.openjdk.java.net/~juh/8054037/00/">http://cr.openjdk.java.net/~juh/8054037/00/</a><br>bug: <a href="https://bugs.openjdk.java.net/browse/JDK-8054037">https://bugs.openjdk.java.net/browse/JDK-8054037</a><br><br>Thanks,<br>Jason<br></blockquote><br></blockquote></div><br></body></html>