<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Hello Tim,</div><div><br></div><div>It looks like the use case you described can be easily achieved by wrapping all certificates from the KeychainStore-ROOT and KeychainStore stores into one custom Trust Store. As far as I know, all certificates should be in one or another Keychain store.</div><div><br></div><div>Also, please look at my comments for the patch for intermediate certs: https://github.com/openjdk/jdk/pull/22911#issuecomment-2569957562</div><div><br></div><div>Thank you</div><div>Alexey</div><div><br></div><div><br><blockquote type="cite"><div>On 3 Jan 2025, at 03:29, Tim Jacomb <timjacomb1@gmail.com> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div>
<table border="0" cellspacing="0" cellpadding="0" width="100%" style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; cellpadding: 0 !important; border: 0 !important; cellspacing: 0 !important; display: table !important; width: 100% !important; table-layout: fixed !important; border-collapse: seperate !important; float: none !important; border-spacing: 0px 0px !important; " align="left">
<tbody style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; display: block !important; ">
<tr style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; ">
<td valign="middle" width="1px" bgcolor="#A6A6A6" cellpadding="7px 2px 7px 2px" style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; padding: 7px 2px 7px 2px !important; background-color: #A6A6A6 !important; valign: middle !important; width: 0px !important; ">
</td>
<td valign="middle" width="100%" bgcolor="#EAEAEA" cellpadding="7px 5px 7px 15px" style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; width: 100% !important; background-color: #EAEAEA !important; padding: 7px 5px 7px 15px !important; font-family: wf_segoe-ui_normal, Segoe UI, Segoe WP, Tahoma, Arial, sans-serif !important; font-size: 12px !important; font-weight: normal !important; color: #212121 !important; text-align: left !important; word-wrap: break-word !important; ">
<div style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; ">
Some people who received this message don't often get email from timjacomb1@gmail.com.
<a href="https://aka.ms/LearnAboutSenderIdentification" style="background: revert !important;color: revert !important;content-visibility: revert !important;direction: revert !important;display: revert !important;font-size: revert !important;opacity: revert !important;rotate: revert !important;scale: revert !important;visibility: revert !important;">
Learn why this is important</a> </div>
</td>
<td valign="middle" align="left" width="75px" bgcolor="#EAEAEA" cellpadding="7px 5px 7px 5px" style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; width: 75px !important; background-color: #EAEAEA !important; padding: 7px 5px 7px 5px !important; font-family: wf_segoe-ui_normal, Segoe UI, Segoe WP, Tahoma, Arial, sans-serif !important; font-size: 12px !important; font-weight: normal !important; color: #212121 !important; text-align: left !important; word-wrap: break-word !important; align: left !important; ">
</td>
</tr>
</tbody>
</table>
<div><!-- Yellow caution banner -->
<table border="0" cellspacing="0" cellpadding="0" align="left" width="100%">
<tbody>
<tr>
<!-- Remove the next line if you don't want the Yellow bar on the left side -->
<td style="background:#ffb900;padding:5pt 2pt 5pt 2pt"></td>
<td width="100%" cellpadding="7px 6px 7px 15px" style="background:#fff8e5;padding:5pt 4pt 5pt 11pt;word-wrap:break-word">
<div style="color:#222222;"><span style="color:#222; font-weight:bold;">Caution:</span> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
</div>
</td>
</tr>
</tbody>
</table>
<br>
<div>
<div dir="ltr">Hi
<div><br>
</div>
<div>Following on from:</div>
<div><a href="https://bugs.openjdk.org/browse/JDK-8320362">https://bugs.openjdk.org/browse/JDK-8320362</a></div>
<div><br>
</div>
<div>It's now possible to get system roots on macOS devices in the truststore: KeychainStore-ROOT.</div>
<div>That's quite useful.</div>
<div><br>
</div>
<div>Unfortunately it doesn't cover everything though.</div>
<div>In practice there's two issues I've found in trying to use it:</div>
<div><br>
</div>
<div>1. It is missing custom CA certificates, (which would have been included if Apple APIs - SecTrustCopyCustomAnchorCertificates were used, see discussion at
<a href="https://github.com/openjdk/jdk/pull/16722#issuecomment-1948542783">https://github.com/openjdk/jdk/pull/16722#issuecomment-1948542783</a>)</div>
<div>2. It is missing intermediate certificates which are required for custom CA certificates, (these are not included with SecTrustCopyCustomAnchorCertificates although the root CAs above are).</div>
<div><br>
</div>
<div>The architecture at my company that is using ZScaler MiTM proxy is:</div>
<div>Root CA -> Intermediate 1 -> Intermediate 2 -> Leaf</div>
<div><br>
</div>
<div>Where:</div>
<div>
<ul>
<li>All certs are in admin domain kSecTrustSettingsDomainAdmin</li><li>Root CA is marked as always trust</li><li>Intermediate 1 and 2 are Unspecified</li></ul>
<div>Not all certificates get re-signed by Zscaler, some URLs are bypassed.</div>
<div>So I need to be able to trust both custom CAs and the predefined roots.</div>
<div><br>
</div>
<div>I was thinking of creating a new truststore: KeychainStore-ALL.</div>
<div>I think it could just reuse all the existing code, and work pretty seamlessly, (I have a separate patch for intermediate certs not working correctly -
<a href="https://github.com/openjdk/jdk/pull/22911">https://github.com/openjdk/jdk/pull/22911</a>).</div>
<div><br>
</div>
<div>It could be improved at the expense of more code to use the Apple APIs directly (SecTrustCopyCustomAnchorCertificates) and not read the keychain file.</div>
<div><br>
</div>
<div>What do you think?</div>
<div><br>
</div>
<div>Thanks</div>
<div>Tim</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div><br></body></html>