<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi Sean,</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thank you for taking a look on my request for the <b>Suggestion to Improve Debug Messaging on CertPath. </b></div>
<div style="text-align: left; text-indent: 0px; margin-top: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I hadn’t received the follow-up email earlier, even though I had subscribed to the mailing list. There was an issue with the subscription, but it's now resolved and completed successfully. That’s how I came across your response. Apologies for the delay in getting
back to you.</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
To reply for your question below,</div>
<pre class="elementToProof"><div style="text-align: left; text-indent: 0px; white-space: pre-wrap; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><b> >> If the certificate contains the same public key, subject and SAN, why does validation fail?</b></div><pre class="elementToProof"><div style="text-align: left; text-indent: 0px; white-space: pre-wrap; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">If two certificate shares the same subject, public key, and SANs but with <b>different serail number</b> the actual certificate will be ignored. During the cert path validation process code detects two certificates as duplicates and the code first match it finds is the certificate created by the application not the actual certificate used by the customer. Because here server expects matching certificate and valid trust store and it received default certificate which is created by application causing the TLS certificate validation to fail.</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">The certpath debug trace shows that it found a "duplicate", but it doesn't state that it's going to ignore it, and doesn't provide any information on which certificates are actually</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">involved.</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><pre class="elementToProof"><div style="text-align: left; text-indent: 0px; white-space: pre-wrap; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">Suggestion/Can be Improved as below in :</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><u><a class="OWAAutoLink" id="OWA5a6e41a0-9a16-99d0-38bc-3a9e8fd218f4" href="https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java#L583">https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java#L583</a></u></div><div style="text-align: left; text-indent: 0px; white-space: pre-wrap; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
</div><div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><b>debug.println("Certificate with repeated subject, public key, and subjectAltNames will be ignored" + cert);</b></div><div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"> </div><div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"> Or</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><div style="text-align: left; text-indent: 0px; white-space: pre-wrap; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><b>debug.println("Certificate with repeated subject, public key, and subjectAltNames detected: " + cert);</b></div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><div style="text-align: left; text-indent: 0px; white-space: normal; margin-top: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">While this may not be a common customer scenario, but the enhancement is simple to implement and would significantly improve the clarity of debugging in certificate-related issues.</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">Please let me know your thoughts.</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">Thanks,</div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">Pooja</div><div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"> </div></pre><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div><pre class="elementToProof"><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><i><br></i></div></pre><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><br></div></pre><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><b><br></b></div><div style="text-align: left; text-indent: 0px; white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof"><b><br></b></div></pre>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<b><br>
</b></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
</body>
</html>