<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-fareast-language:DE;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello, I wonder if you have some input regarding the following issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I noticed a couple of instabilities (in jdk13 and higher) in the test security/infra/java/security/cert/CertPathValidator/certification/LuxTrustCA.java .<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The test sometimes fails when validating the “validity interval” of OCSP responses :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Example output is like :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">certpath: OCSP response validity interval is from Wed Dec 04
<b>01:05:27 CET 2019</b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">certpath: Checking validity of OCSP response on: Wed Dec 04
<b>01:39:15 CET 2019</b> <b><--------- default interval is system time “on” machine +/- 15 minutes , this is seen as valid by OpenJDK</b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">java.lang.RuntimeException: TEST FAILED: couldn't determine EE certificate status
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at ValidatePathWithParams.validate(ValidatePathWithParams.java:177)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at LuxTrustCA.main(LuxTrustCA.java:186)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.base/java.lang.reflect.Method.invoke(Method.java:564)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.base/java.lang.Thread.run(Thread.java:832)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">stdout contains :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Received exception: java.security.cert.CertPathValidatorException:
<b><span style="color:red">Response is unreliable: its validity interval is out-of-date<o:p></o:p></span></b></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So our <b> system time “on” machine ( 01:39:15 CET 2019</b>
<b> +/- 15 minutes ) </b>does not contain the time from OCSP response<b> ( 01:05:27 CET 2019) .</b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Reason is unclear , of course the time on the test machine could be wrong but we see the issue on multiple machines and when looking into the system times of the machines they look fine .<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Maybe the time info from the OCSP response is wrong , at least it looks like this is the issue here .<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Have you seen similar issues (also in other tests dealing with OCSP response validity checks) ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Do you think that increasing the acceptance interval e.g. by setting it to -Dcom.sun.security.ocsp.clockSkew=9000000 in security/infra/java/security/cert/CertPathValidator/certification/LuxTrustCA.java
would be okay ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">( I’d like to add a little bit more tracing too so that in case of such errors it is easier to understand the issue )<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Best regards, Matthias<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>