<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr" data-ogsc="" style="">
<div></div>
<div>
<div>Hello,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">It is a bit unfortunate but the JCE Codesigning Roots are not part of the cacerts file. They are hardcoded in the Oracle JDK and not present in OpenJDK as far as I understand it.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">It is documented here, that those CAs are not available for general deployments:</div>
<div dir="ltr"><a href="https://www.oracle.com/java/technologies/javase/getcodesigningcertificate.html">https://www.oracle.com/java/technologies/javase/getcodesigningcertificate.html</a><br>
</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Gruss</div>
<div dir="ltr">Bernd</div>
<div class="ms-outlook-ios-signature" id="ms-outlook-mobile-signature">
<div style="direction: ltr">-- </div>
<div style="direction: ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> security-dev <security-dev-retn@openjdk.java.net> im Auftrag von Raj Arora <raj.arora.sw.eng@gmail.com><br>
<b>Gesendet:</b> Wednesday, December 2, 2020 8:29:28 PM<br>
<b>An:</b> security-dev@openjdk.java.net <security-dev@openjdk.java.net><br>
<b>Betreff:</b> jar signing and verification</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hi<br>
<br>
In attempting to validate jar signing I am seeing warnings as such displaying Invalid certificate chain<br>
<br>
-----------------------<br>
>jarsigner -verify -certs bcprov-jdk15on-1.66.jar<br>
<br>
s 606774 Sat Jul 04 15:48:42 EDT 2020 META-INF/MANIFEST.MF<br>
<br>
>>> Signer<br>
X.509, CN=Legion of the Bouncy Castle Inc., OU=Java Software Code Signing, O=Sun Microsystems Inc<br>
[certificate expired on 4/25/20 3:00 AM]<br>
X.509, CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Sun Microsystems Inc, L=Palo Alto, ST=CA, C=US<br>
[certificate expired on 4/25/20 3:00 AM]<br>
[Invalid certificate chain: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]<br>
<br>
>>> Signer<br>
X.509, CN=Legion of the Bouncy Castle Inc., OU=Java Software Code Signing, O=Oracle Corporation<br>
[certificate is valid from 3/10/17 8:07 PM to 3/10/22 8:07 PM]<br>
X.509, CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Oracle Corporation<br>
[certificate is valid from 7/6/16 7:48 PM to 12/30/30 7:00 PM]<br>
[Invalid certificate chain: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]<br>
<br>
-----------------------<br>
jarsigner -keystore ...\jre\lib\security\cacerts -verify -verbose -certs bcprov-jdk15on-1.66.jar >out.txt<br>
<br>
<br>
s 606774 Sat Jul 04 15:48:42 EDT 2020 META-INF/MANIFEST.MF<br>
<br>
X.509, CN=Legion of the Bouncy Castle Inc., OU=Java Software Code Signing, O=Sun Microsystems Inc<br>
[certificate expired on 4/25/20 3:00 AM]<br>
X.509, CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Sun Microsystems Inc, L=Palo Alto, ST=CA, C=US<br>
[certificate expired on 4/25/20 3:00 AM]<br>
[CertPath not validated: Path does not chain with any of the trust anchors]<br>
<br>
[entry was signed on 7/4/20 1:48 AM]<br>
X.509, CN=Legion of the Bouncy Castle Inc., OU=Java Software Code Signing, O=Oracle Corporation<br>
[certificate is valid from 3/10/17 8:07 PM to 3/10/22 8:07 PM]<br>
X.509, CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Oracle Corporation<br>
[certificate is valid from 7/6/16 7:48 PM to 12/30/30 7:00 PM]<br>
[CertPath not validated: Path does not chain with any of the trust anchors]<br>
<br>
-----------------------<br>
<br>
<br>
<br>
Why do we get warnings of "Invalid certificate chain"?<br>
<br>
(I do not believe it's related to the expired warning as I see newer jars exhibiting the same outcome without an expired notice)<br>
<br>
Is the jar incorrectly signed or is the required chain simply not found in cacerts and if so why is it not there. I do see that at the end of the listing it says "jar verified"<br>
<br>
The samples in<br>
<a href="https://docs.oracle.com/en/java/javase/15/docs/specs/man/jarsigner.html#errors-and-warnings">https://docs.oracle.com/en/java/javase/15/docs/specs/man/jarsigner.html#errors-and-warnings</a><br>
seem to show a fully validated chain.<br>
<br>
thanks<br>
Raj</div>
</div>
</body>
</html>