<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
<div class="moz-cite-prefix">On 1/17/20 8:09 AM, Baesken, Matthias
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:AM6PR02MB42000FFB0F5F197B8010DF2C93310@AM6PR02MB4200.eurprd02.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-fareast-language:DE;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello, I wonder if you
have some input regarding the following issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I noticed a couple of
instabilities (in jdk13 and higher) in the test
security/infra/java/security/cert/CertPathValidator/certification/LuxTrustCA.java
.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The test sometimes
fails when validating the “validity interval” of OCSP
responses :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Example output is like :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">certpath: OCSP response
validity interval is from Wed Dec 04
<b>01:05:27 CET 2019</b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">certpath: Checking
validity of OCSP response on: Wed Dec 04
<b>01:39:15 CET 2019</b> <b><--------- default
interval is system time “on” machine +/- 15 minutes ,
this is seen as valid by OpenJDK</b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">java.lang.RuntimeException:
TEST FAILED: couldn't determine EE certificate status
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
ValidatePathWithParams.validate(ValidatePathWithParams.java:177)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
LuxTrustCA.main(LuxTrustCA.java:186)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
Method)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
java.base/java.lang.reflect.Method.invoke(Method.java:564)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at
java.base/java.lang.Thread.run(Thread.java:832)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">stdout contains :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Received exception:
java.security.cert.CertPathValidatorException:
<b><span style="color:red">Response is unreliable: its
validity interval is out-of-date<o:p></o:p></span></b></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So our <b> system time
“on” machine ( 01:39:15 CET 2019</b>
<b> +/- 15 minutes ) </b>does not contain the time
from OCSP response<b> ( 01:05:27 CET 2019) .</b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Reason is unclear , of
course the time on the test machine could be wrong but
we see the issue on multiple machines and when looking
into the system times of the machines they look fine .<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Maybe the time info
from the OCSP response is wrong , at least it looks
like this is the issue here .<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Have you seen similar
issues (also in other tests dealing with OCSP response
validity checks) ?</span></p>
</div>
</blockquote>
<p>Yes, I can confirm we have seen this at least once before. There
is a bug filed for it, but it is currently marked Confidential
because it has some internal information in it.</p>
<p>Can you send me the whole log file or at least more of it which
shows the info below?<br>
</p>
<blockquote type="cite"
cite="mid:AM6PR02MB42000FFB0F5F197B8010DF2C93310@AM6PR02MB4200.eurprd02.prod.outlook.com">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Do you think that
increasing the acceptance interval e.g. by setting it
to -Dcom.sun.security.ocsp.clockSkew=9000000 in
security/infra/java/security/cert/CertPathValidator/certification/LuxTrustCA.java
would be okay ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">( I’d like to add a
little bit more tracing too so that in case of such errors
it is easier to understand the issue )</span></p>
</div>
</blockquote>
<p>No that would be too much skew. If there is an issue with the
time on the OCSP Responder, that is a more serious issue which
this property might mask. <br>
</p>
<p>I just ran this test myself locally. I noticed that one of the
OCSP Responders appears to be returning pre-produced
OCSPResponses:</p>
<p>certpath: connecting to OCSP service at:
<a class="moz-txt-link-freetext" href="http://qca.ocsp.luxtrust.lu">http://qca.ocsp.luxtrust.lu</a><br>
certpath: OCSP response status: SUCCESSFUL<br>
certpath: OCSP response type: basic<br>
certpath: Responder ID: byKey:
AFC136FF2B78DC9F78E0100F2ABC24DDBD6F12B6<br>
certpath: OCSP response produced at: Thu Jan 23 15:23:08 EST 2020<br>
certpath: OCSP number of SingleResponses: 1<br>
certpath: thisUpdate: Thu Jan 23 15:18:13 EST 2020</p>
<p>However, there is no nextUpdate field set, which means there
should be always newer information available. So while the 5
minute delay may not be a huge issue, the fact that they are
returning cached responses, looks like a problem to me.<br>
</p>
<p>This could be the underlying problem, in that they are not
generating fresh OCSPResponses. I will contact LuxTrust and see if
we can get some information from them.</p>
<p>Thanks,</p>
<p>Sean<br>
</p>
</body>
</html>