<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I don’t see your testcase in the webrev can you add it in and re-generate.<div class="">Thanks.</div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 11 Nov 2015, at 12:08, Langer, Christoph <<a href="mailto:christoph.langer@sap.com" class="">christoph.langer@sap.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi Vincent,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">so this is the final version which should be pushed:<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="http://cr.openjdk.java.net/~clanger/webrevs/8139436.2/" style="color: purple; text-decoration: underline;" class="">http://cr.openjdk.java.net/~clanger/webrevs/8139436.2/</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I removed an unnecessary blank in a method call and updated the copyright information. I also ran another build and verified with my test case.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Thanks in advance for taking care.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Christoph<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Vincent Ryan [<a href="mailto:vincent.x.ryan@oracle.com" style="color: purple; text-decoration: underline;" class="">mailto:vincent.x.ryan@oracle.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Mittwoch, 11. November 2015 08:46<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Mike StJohns <<a href="mailto:mstjohns@comcast.net" style="color: purple; text-decoration: underline;" class="">mstjohns@comcast.net</a>>; Langer, Christoph <<a href="mailto:christoph.langer@sap.com" style="color: purple; text-decoration: underline;" class="">christoph.langer@sap.com</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:security-dev@openjdk.java.net" style="color: purple; text-decoration: underline;" class="">security-dev@openjdk.java.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: RFR 8139436: sun.security.mscapi.KeyStore might load incomplete data<o:p class=""></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Explicitly referencing the Sun JCE provider makes the jdk.crypto.mscapi module depend on the java.base module.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">And that’s OK.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I can sponsor this changeset.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On 10 Nov 2015, at 22:39, Mike StJohns <<a href="mailto:mstjohns@comcast.net" style="color: purple; text-decoration: underline;" class="">mstjohns@comcast.net</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">On 11/10/2015 4:12 PM, Langer, Christoph wrote:<o:p class=""></o:p></span></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; orphans: auto; text-align: start; widows: auto; -webkit-text-stroke-width: 0px; word-spacing: 0px;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi folks,</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">is there any feedback/review for this change?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div></blockquote><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">I missed the 4 Nov message when it came past. No further objections. But still unclear if modularization will permit this.</span><br class=""><br class=""><span style="background-color: white; background-position: initial initial; background-repeat: initial initial;" class="">Mike</span><br class=""><br style="orphans: auto; text-align: start; widows: auto; -webkit-text-stroke-width: 0px; word-spacing: 0px;" class=""><br class=""></span><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Thanks</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Christoph</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Langer, Christoph<span class="apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Mittwoch, 4. November 2015 12:11<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>'Michael StJohns'<span class="apple-converted-space"> </span><a href="mailto:mstjohns@comcast.net" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class=""><mstjohns@comcast.net></span></a><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span><a href="mailto:security-dev@openjdk.java.net" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">security-dev@openjdk.java.net</span></a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>RE: RFR 8139436: sun.security.mscapi.KeyStore might load incomplete data</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi Mike,</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">eventually I’ve made a new webrev implementing your suggestion for a simpler patch:</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="http://cr.openjdk.java.net/~clanger/webrevs/8139436.1/" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">http://cr.openjdk.java.net/~clanger/webrevs/8139436.1/</span></a></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">@All: Is that a valid fix for this issue? Would anyone mind to review/sponsor this?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Christoph</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Michael StJohns [<a href="mailto:mstjohns@comcast.net" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">mailto:mstjohns@comcast.net</span></a>]<span class="apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Donnerstag, 15. Oktober 2015 02:09<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>Langer, Christoph <<a href="mailto:christoph.langer@sap.com" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">christoph.langer@sap.com</span></a>><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span><a href="mailto:security-dev@openjdk.java.net" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">security-dev@openjdk.java.net</span></a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>Re: RFR 8139436: sun.security.mscapi.KeyStore might load incomplete data</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Sorry for the top post, I'm wring this on an iPad on a plane.<o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">It's perfectly acceptable for a provider to prefer its version of stuff over even something early in the provider list. Usually, that has more to do with key material ( for example pkcs11 instantiations), but there's no reason why it shouldn't apply to certificates. <o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Mike<o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">Sent from my iPad<o:p class=""></o:p></span></div></div></div><div class=""><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white; background-position: initial initial; background-repeat: initial initial;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">On Oct 14, 2015, at 18:35, Langer, Christoph <<a href="mailto:christoph.langer@sap.com" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">christoph.langer@sap.com</span></a>> wrote:<o:p class=""></o:p></span></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi Mike,</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">thanks for your comments on this.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I agree that the change is quite critical and my approach might not be good. However, as for your suggestion to specify the sun provider for the certificate factory, I’d say this is not quite right, too. Because, if you have loaded a different provider on top of the providers list, you’ll intend to use its facilities by default. Maybe the idea would be to use the sun provider as fallback in case of an exception?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The other suggestion to check for certChain.length in KeyStore.getCertificate and return null would be an improvement compared to throwing an ArrayIndexOutOfBoundsException – however, it would still be difficult to find the root cause why a certificate could not be loaded.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">What do you think?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">@all: Are there other opinions?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Thanks and best regards</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Christoph</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">security-dev [<a href="mailto:security-dev-bounces@openjdk.java.net" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">mailto:security-dev-bounces@openjdk.java.net</span></a>]<span class="apple-converted-space"> </span><b class="">On Behalf Of<span class="apple-converted-space"> </span></b>Mike StJohns<br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Mittwoch, 14. Oktober 2015 02:17<br class=""><b class="">To:</b><span class="apple-converted-space"> </span><a href="mailto:security-dev@openjdk.java.net" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">security-dev@openjdk.java.net</span></a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>Re: RFR 8139436: sun.security.mscapi.KeyStore might load incomplete data</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi -<span class="apple-converted-space"> </span><br class=""><br class="">I took a look and this probably isn't the correct way to fix this.<span class="apple-converted-space"> </span><br class=""><br class="">A simpler change might be to specify the sun provider when requesting the certificate factory. I hesitate to say that definitively as modularization guidance may restrict that approach?<br class=""><br class="">The belt and suspenders approach is to catch the bad certificate exception and return null. That appears to be the correct contract for KeyStore.getCertificate(String alias). (e.g. "if (certChain.length == 0) return null;")<br class=""><br class="">Mike<br class=""><br class=""><br class="">On 10/12/2015 5:04 PM, Langer, Christoph wrote:<o:p class=""></o:p></span></div></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi,<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">please review a change proposal regarding an issue in the Microsoft Security API (mscapi).</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Bug:<span class="apple-converted-space"> </span><a href="https://bugs.openjdk.java.net/browse/JDK-8139436" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">https://bugs.openjdk.java.net/browse/JDK-8139436</span></a></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Webrev:<span class="apple-converted-space"> </span><a href="http://cr.openjdk.java.net/~clanger/webrevs/8139436.0/" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">http://cr.openjdk.java.net/~clanger/webrevs/8139436.0/</span></a></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">I stumbled over the issue when using an old IAIK security provider. It would throw java.security.cert.CertificateException upon parsing ECC based certificates when generating Certificate objects. The way it is right now, such exceptions are silently caught and the Windows Keystore is created with incomplete data. Upon accessing such ECC certificates from the Keystore object, e.g. when iterating over it, you’ll get exceptions like:</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 0</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore.engineGetCertificate(KeyStore.java:313)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore$ROOT.engineGetCertificate(KeyStore.java:60)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at java.security.KeyStore.getCertificate(KeyStore.java:1095)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">At that point it is not obvious what the real root cause for that is.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">With my change, loading of the keystore would already throw like this:</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">java.io.IOException: java.security.KeyStoreException: Exception occurred generating certificate object for alias DigiCert Assured ID Root G3</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore.engineLoad(KeyStore.java:780)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore$ROOT.engineLoad(KeyStore.java:60)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at java.security.KeyStore.load(KeyStore.java:1459)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at WindowsCertificateReaderTest.main(WindowsCertificateReaderTest.java:18)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Caused by: java.security.KeyStoreException: Exception occurred generating certificate object for alias DigiCert Assured ID Root G3</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore.loadKeysOrCertificateChains(Native Method)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore.engineLoad(KeyStore.java:777)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>... 3 more</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Caused by: java.security.cert.CertificateException: Error parsing certificates! iaik.asn1.DerInputException: Next ASN.1 object is no OBJECT IDENTIFIER!</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at iaik.x509.CertificateFactory.engineGenerateCertificates(Unknown Source)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at java.security.cert.CertificateFactory.generateCertificates(CertificateFactory.java:462)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>at sun.security.mscapi.KeyStore.generateCertificate(KeyStore.java:869)</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <span class="apple-converted-space"> </span>... 5 more</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">This is more obvious when it comes to analyzing such an issue.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Also, I added a property “sun.security.mscapi.ignoreFailingCertificates” which, when set to true, will cause skipping of certificates that failed with Exception. That might be a nice workaround option if one is not particularly interested in a failing certificate.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">You can reproduce all this with the test coding in the OpenJDK Bug, the IAIK provider 3.15 which is downloadable here:<a href="http://jcewww.iaik.tu-graz.ac.at/sic/Download" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">http://jcewww.iaik.tu-graz.ac.at/sic/Download</span></a><span class="apple-converted-space"> </span>(educational/research version, needs registration) and ECC certificates in the Windows Root certificate store.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Would you think this change is reasonable and worthwile?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks & Best regards</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-color: white;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Christoph</span></div></div></blockquote></div></blockquote></blockquote></div></blockquote></div></div></div></blockquote></div><br class=""></div></body></html>