Skip to content

Commit 15d3b60

Browse files
GoeLinGoeLin
committed
8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs
Backport-of: 7d49c52272b54070a13b02708dd7ce5f8e375a06
1 parent 5155c93 commit 15d3b60

13 files changed

+1103
-2
lines changed

‎src/java.base/share/classes/sun/security/validator/CADistrustPolicy.java‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -53,6 +53,22 @@ void checkDistrust(String variant, X509Certificate[] chain)
5353
}
5454
SymantecTLSPolicy.checkDistrust(chain);
5555
}
56+
},
57+
58+
/**
59+
* Distrust TLS Server certificates anchored by an Entrust root CA and
60+
* issued after October 31, 2024. If enabled, this policy is currently
61+
* enforced by the PKIX and SunX509 TrustManager implementations
62+
* of the SunJSSE provider implementation.
63+
*/
64+
ENTRUST_TLS {
65+
void checkDistrust(String variant, X509Certificate[] chain)
66+
throws ValidatorException {
67+
if (!variant.equals(Validator.VAR_TLS_SERVER)) {
68+
return;
69+
}
70+
EntrustTLSPolicy.checkDistrust(chain);
71+
}
5672
};
5773

5874
/**

‎src/java.base/share/classes/sun/security/validator/EntrustTLSPolicy.java‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
/*
2+
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
package sun.security.validator;
26+
27+
import java.security.cert.X509Certificate;
28+
import java.time.LocalDate;
29+
import java.time.Month;
30+
import java.time.ZoneOffset;
31+
import java.util.Date;
32+
import java.util.Map;
33+
import java.util.Set;
34+
35+
import sun.security.util.Debug;
36+
import sun.security.x509.X509CertImpl;
37+
38+
/**
39+
* This class checks if Entrust issued TLS Server certificates should be
40+
* restricted.
41+
*/
42+
final class EntrustTLSPolicy {
43+
44+
private static final Debug debug = Debug.getInstance("certpath");
45+
46+
// SHA-256 certificate fingerprints of distrusted roots
47+
private static final Set<String> FINGERPRINTS = Set.of(
48+
// cacerts alias: entrustevca
49+
// DN: CN=Entrust Root Certification Authority,
50+
// OU=(c) 2006 Entrust, Inc.,
51+
// OU=www.entrust.net/CPS is incorporated by reference,
52+
// O=Entrust, Inc., C=US
53+
"73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C",
54+
// cacerts alias: entrustrootcaec1
55+
// DN: CN=Entrust Root Certification Authority - EC1,
56+
// OU=(c) 2012 Entrust, Inc. - for authorized use only,
57+
// OU=See www.entrust.net/legal-terms, O=Entrust, Inc., C=US
58+
"02ED0EB28C14DA45165C566791700D6451D7FB56F0B2AB1D3B8EB070E56EDFF5",
59+
// cacerts alias: entrustrootcag2
60+
// DN: CN=Entrust Root Certification Authority - G2,
61+
// OU=(c) 2009 Entrust, Inc. - for authorized use only,
62+
// OU=See www.entrust.net/legal-terms, O=Entrust, Inc., C=US
63+
"43DF5774B03E7FEF5FE40D931A7BEDF1BB2E6B42738C4E6D3841103D3AA7F339",
64+
// cacerts alias: entrustrootcag4
65+
// DN: CN=Entrust Root Certification Authority - G4
66+
// OU=(c) 2015 Entrust, Inc. - for authorized use only,
67+
// OU=See www.entrust.net/legal-terms, O=Entrust, Inc., C=US,
68+
"DB3517D1F6732A2D5AB97C533EC70779EE3270A62FB4AC4238372460E6F01E88",
69+
// cacerts alias: entrust2048ca
70+
// DN: CN=Entrust.net Certification Authority (2048),
71+
// OU=(c) 1999 Entrust.net Limited,
72+
// OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),
73+
// O=Entrust.net
74+
"6DC47172E01CBCB0BF62580D895FE2B8AC9AD4F873801E0C10B9C837D21EB177",
75+
// cacerts alias: affirmtrustcommercialca
76+
// DN: CN=AffirmTrust Commercial, O=AffirmTrust, C=US
77+
"0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7",
78+
// cacerts alias: affirmtrustnetworkingca
79+
// DN: CN=AffirmTrust Networking, O=AffirmTrust, C=US
80+
"0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B",
81+
// cacerts alias: affirmtrustpremiumca
82+
// DN: CN=AffirmTrust Premium, O=AffirmTrust, C=US
83+
"70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A",
84+
// cacerts alias: affirmtrustpremiumeccca
85+
// DN: CN=AffirmTrust Premium ECC, O=AffirmTrust, C=US
86+
"BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423"
87+
);
88+
89+
// Any TLS Server certificate that is anchored by one of the Entrust
90+
// roots above and is issued after this date will be distrusted.
91+
private static final LocalDate OCTOBER_31_2024 =
92+
LocalDate.of(2024, Month.OCTOBER, 31);
93+
94+
/**
95+
* This method assumes the eeCert is a TLS Server Cert and chains back to
96+
* the anchor.
97+
*
98+
* @param chain the end-entity's certificate chain. The end entity cert
99+
* is at index 0, the trust anchor at index n-1.
100+
* @throws ValidatorException if the certificate is distrusted
101+
*/
102+
static void checkDistrust(X509Certificate[] chain)
103+
throws ValidatorException {
104+
X509Certificate anchor = chain[chain.length-1];
105+
String fp = fingerprint(anchor);
106+
if (fp == null) {
107+
throw new ValidatorException("Cannot generate fingerprint for "
108+
+ "trust anchor of TLS server certificate");
109+
}
110+
if (FINGERPRINTS.contains(fp)) {
111+
Date notBefore = chain[0].getNotBefore();
112+
LocalDate ldNotBefore = LocalDate.ofInstant(notBefore.toInstant(),
113+
ZoneOffset.UTC);
114+
// reject if certificate is issued after October 31, 2024
115+
checkNotBefore(ldNotBefore, OCTOBER_31_2024, anchor);
116+
}
117+
}
118+
119+
private static String fingerprint(X509Certificate cert) {
120+
return X509CertImpl.getFingerprint("SHA-256", cert, debug);
121+
}
122+
123+
private static void checkNotBefore(LocalDate notBeforeDate,
124+
LocalDate distrustDate, X509Certificate anchor)
125+
throws ValidatorException {
126+
if (notBeforeDate.isAfter(distrustDate)) {
127+
throw new ValidatorException
128+
("TLS Server certificate issued after " + distrustDate +
129+
" and anchored by a distrusted legacy Entrust root CA: "
130+
+ anchor.getSubjectX500Principal(),
131+
ValidatorException.T_UNTRUSTED_CERT, anchor);
132+
}
133+
}
134+
135+
private EntrustTLSPolicy() {}
136+
}

‎src/java.base/share/conf/security/java.security‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1281,6 +1281,9 @@ jdk.sasl.disabledMechanisms=
12811281
# A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED
12821282
# Distrust after December 31, 2019.
12831283
#
1284+
# ENTRUST_TLS : Distrust TLS Server certificates anchored by
1285+
# an Entrust root CA and issued after October 31, 2024.
1286+
#
12841287
# Leading and trailing whitespace surrounding each value are ignored.
12851288
# Unknown values are ignored. If the property is commented out or set to the
12861289
# empty String, no policies are enforced.
@@ -1292,7 +1295,7 @@ jdk.sasl.disabledMechanisms=
12921295
# jdk.certpath.disabledAlgorithms; those restrictions are still enforced even
12931296
# if this property is not enabled.
12941297
#
1295-
jdk.security.caDistrustPolicies=SYMANTEC_TLS
1298+
jdk.security.caDistrustPolicies=SYMANTEC_TLS,ENTRUST_TLS
12961299

12971300
#
12981301
# FilePermission path canonicalization

0 commit comments

Comments
 (0)