Skip to content

Commit 096ace2

Browse files
dmatejdmatej
committed
Switching from JKS and JCEKS to PKCS12
Signed-off-by: David Matějček <[email protected]>
1 parent 14633b7 commit 096ace2

File tree

126 files changed

+582
-726
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

126 files changed

+582
-726
lines changed

‎appserver/admin/admin-core/src/test/resources/UpgradeTest.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -201,8 +201,8 @@
201201
<jvm-options>-Djava.security.policy=${com.sun.aas.instanceRoot}/config/server.policy</jvm-options>
202202
<jvm-options>-Djava.security.auth.login.config=${com.sun.aas.instanceRoot}/config/login.conf</jvm-options>
203203
<jvm-options>-Xmx512m</jvm-options>
204-
<jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks</jvm-options>
205-
<jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks</jvm-options>
204+
<jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.p12</jvm-options>
205+
<jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.p12</jvm-options>
206206
<jvm-options>-Djava.ext.dirs=${com.sun.aas.javaRoot}/lib/ext${path.separator}${com.sun.aas.javaRoot}/jre/lib/ext${path.separator}${com.sun.aas.instanceRoot}/lib/ext${path.separator}${com.sun.aas.derbyRoot}/lib</jvm-options>
207207
<jvm-options>-Djdbc.drivers=org.apache.derby.jdbc.ClientDriver</jvm-options>
208208
<jvm-options>-Dcom.sun.enterprise.config.config_environment_factory_class=com.sun.enterprise.config.serverbeans.AppserverConfigEnvironmentFactory</jvm-options>

‎appserver/admin/backup/src/main/java/com/sun/enterprise/backup/RestoreManager.java‎

Lines changed: 32 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
/*
2+
* Copyright (c) 2025 Contributors to the Eclipse Foundation.
23
* Copyright (c) 1997, 2018 Oracle and/or its affiliates. All rights reserved.
34
*
45
* This program and the accompanying materials are made available under the
@@ -13,7 +14,6 @@
1314
*
1415
* SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
1516
*/
16-
1717
package com.sun.enterprise.backup;
1818

1919
import com.sun.enterprise.backup.util.BackupUtils;
@@ -23,6 +23,8 @@
2323
import java.io.File;
2424
import java.io.IOException;
2525

26+
import static com.sun.enterprise.util.SystemPropertyConstants.MASTER_PASSWORD_FILENAME;
27+
2628
/**
2729
*
2830
* @author Byron Nevins
@@ -48,8 +50,9 @@ public String restore() throws BackupException {
4850

4951
// If we are restoring the whole domain then we need to preserve
5052
// the backups directory.
51-
if (!isConfigBackup)
53+
if (!isConfigBackup) {
5254
copyBackups();
55+
}
5356
atomicSwap(request.domainDir, request.domainName, isConfigBackup);
5457
setPermissions();
5558
String mesg = readAndDeletePropsFile(isConfigBackup);
@@ -69,10 +72,11 @@ public String restore() throws BackupException {
6972
void init() throws BackupException {
7073
super.init();
7174

72-
if(request.backupFile == null)
75+
if(request.backupFile == null) {
7376
initWithNoSpecifiedBackupFile();
74-
else
77+
} else {
7578
initWithSpecifiedBackupFile();
79+
}
7680

7781
tempRestoreDir = new File(request.domainsDir, request.domainName +
7882
"_" + System.currentTimeMillis());
@@ -81,9 +85,10 @@ void init() throws BackupException {
8185
//////////////////////////////////////////////////////////////////////////
8286

8387
private void initWithSpecifiedBackupFile() throws BackupException {
84-
if(request.backupFile.length() <= 0)
88+
if(request.backupFile.length() <= 0) {
8589
throw new BackupException("backup-res.CorruptBackupFile",
8690
request.backupFile);
91+
}
8792

8893
if (request.domainName == null) {
8994

@@ -98,18 +103,21 @@ private void initWithSpecifiedBackupFile() throws BackupException {
98103
request.domainDir = new File(request.domainsDir, request.domainName);
99104
}
100105

101-
if(!FileUtils.safeIsDirectory(request.domainDir))
102-
if (!request.domainDir.mkdirs())
106+
if(!FileUtils.safeIsDirectory(request.domainDir)) {
107+
if (!request.domainDir.mkdirs()) {
103108
throw new BackupException("backup-res.CantCreateDomainDir",
104109
request.domainDir);
110+
}
111+
}
105112

106113
backupDir = new File(request.domainDir, Constants.BACKUP_DIR);
107114

108115
// It's NOT an error to not exist. The domain may not exist
109116
// currently and, besides, they are specifying the backup-file
110117
// from anywhere potentially...
111-
if(!FileUtils.safeIsDirectory(backupDir))
118+
if(!FileUtils.safeIsDirectory(backupDir)) {
112119
backupDir = null;
120+
}
113121

114122
//throw new BackupException("NOT YET IMPLEMENTED");
115123

@@ -121,15 +129,17 @@ private void initWithNoSpecifiedBackupFile() throws BackupException {
121129
// if they did NOT specify a backupFile, then we *must* have a
122130
// pre-existing backups directory in a pre-existing domain directory.
123131

124-
if(!FileUtils.safeIsDirectory(request.domainDir))
132+
if(!FileUtils.safeIsDirectory(request.domainDir)) {
125133
throw new BackupException("backup-res.NoDomainDir",
126134
request.domainDir);
135+
}
127136

128137
backupDir = getBackupDirectory(request);
129138

130139
// It's an error to not exist...
131-
if(!FileUtils.safeIsDirectory(backupDir))
140+
if(!FileUtils.safeIsDirectory(backupDir)) {
132141
throw new BackupException("backup-res.NoBackupDir", backupDir);
142+
}
133143

134144
BackupFilenameManager bfmgr = new BackupFilenameManager(backupDir,
135145
request.domainName);
@@ -184,8 +194,9 @@ private void copyBackups() throws IOException {
184194
* If an existing backup directory does not exist then there
185195
* is nothing to copy.
186196
*/
187-
if(!FileUtils.safeIsDirectory(domainBackupDir))
197+
if(!FileUtils.safeIsDirectory(domainBackupDir)) {
188198
return;
199+
}
189200

190201
File tempRestoreDirBackups = new File(tempRestoreDir,
191202
Constants.BACKUP_DIR);
@@ -235,16 +246,18 @@ private void atomicSwap(File domainDir, String domainName,
235246
if (configOnly) {
236247
if(!tempRestoreDir.renameTo(configDir)) {
237248
FileUtils.whack(tempRestoreDir);
238-
if (!oldDir.renameTo(configDir))
249+
if (!oldDir.renameTo(configDir)) {
239250
throw new BackupException("backup-res.CantRevertOldDomain",
240251
configDir);
252+
}
241253
throw new BackupException("backup-res.CantRenameRestoredDomain");
242254
}
243255
} else if(!tempRestoreDir.renameTo(domainDir)) {
244256
FileUtils.whack(tempRestoreDir);
245-
if (!oldDir.renameTo(domainDir))
257+
if (!oldDir.renameTo(domainDir)) {
246258
throw new BackupException("backup-res.CantRevertOldDomain",
247259
domainDir);
260+
}
248261
throw new BackupException("backup-res.CantRenameRestoredDomain");
249262
}
250263

@@ -261,11 +274,12 @@ private String readAndDeletePropsFile(boolean isConfigBackup) {
261274

262275
// If this is a config only restore the prop file will be in
263276
// the config directory.
264-
if (isConfigBackup)
277+
if (isConfigBackup) {
265278
propsFile = new File (request.domainDir, Constants.CONFIG_DIR +
266279
"/" + Constants.PROPS_FILENAME);
267-
else
280+
} else {
268281
propsFile = new File(request.domainDir, Constants.PROPS_FILENAME);
282+
}
269283

270284
if (request.verbose == true || request.terse != true) {
271285
if (isConfigBackup) {
@@ -282,8 +296,9 @@ private String readAndDeletePropsFile(boolean isConfigBackup) {
282296
mesg += "\n" + status.read(propsFile, false);
283297
}
284298

285-
if (!propsFile.delete())
299+
if (!propsFile.delete()) {
286300
propsFile.deleteOnExit();
301+
}
287302

288303
return mesg;
289304
}
@@ -296,7 +311,7 @@ private void setPermissions() {
296311
File bin = new File(request.domainDir, "bin");
297312
File config = new File(request.domainDir, "config");
298313
File webtmp = new File(request.domainDir, "generated/tmp");
299-
File masterPassword = new File(request.domainDir, "master-password");
314+
File masterPassword = new File(request.domainDir, MASTER_PASSWORD_FILENAME);
300315

301316
// note that makeExecutable(File f) will make all the files under f
302317
// executable if f happens to be a directory.

‎appserver/admin/template/src/main/resources/config/domain.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -170,8 +170,8 @@
170170
<jvm-options>-Djava.security.auth.login.config=${com.sun.aas.instanceRoot}/config/login.conf</jvm-options>
171171
<jvm-options>-Dcom.sun.enterprise.security.httpsOutboundKeyAlias=s1as</jvm-options>
172172
<jvm-options>-Xmx512m</jvm-options>
173-
<jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks</jvm-options>
174-
<jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks</jvm-options>
173+
<jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.p12</jvm-options>
174+
<jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.p12</jvm-options>
175175
<jvm-options>-Djdbc.drivers=org.apache.derby.jdbc.ClientDriver</jvm-options>
176176
<jvm-options>-DANTLR_USE_DIRECT_CLASS_LOADING=true</jvm-options>
177177
<jvm-options>-Dcom.sun.enterprise.config.config_environment_factory_class=com.sun.enterprise.config.serverbeans.AppserverConfigEnvironmentFactory</jvm-options>
@@ -371,8 +371,8 @@
371371
<jvm-options>-Djava.security.policy=${com.sun.aas.instanceRoot}/config/server.policy</jvm-options>
372372
<jvm-options>-Djava.security.auth.login.config=${com.sun.aas.instanceRoot}/config/login.conf</jvm-options>
373373
<jvm-options>-Dcom.sun.enterprise.security.httpsOutboundKeyAlias=s1as</jvm-options>
374-
<jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks</jvm-options>
375-
<jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks</jvm-options>
374+
<jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.p12</jvm-options>
375+
<jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.p12</jvm-options>
376376
<jvm-options>-Djdbc.drivers=org.apache.derby.jdbc.ClientDriver</jvm-options>
377377
<jvm-options>-DANTLR_USE_DIRECT_CLASS_LOADING=true</jvm-options>
378378
<jvm-options>-Dcom.sun.enterprise.config.config_environment_factory_class=com.sun.enterprise.config.serverbeans.AppserverConfigEnvironmentFactory</jvm-options>

‎appserver/admingui/common/src/main/help/en/help/ref-jmxconnectorssledit.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ <h4><a id="sthref237" name="sthref237"></a><a id="sthref238" name="sthref238"></
4646
</dd>
4747
<dt>Key Store</dt>
4848
<dd>
49-
<p>The name of the keystore file (for example, <code>keystore.jks</code>).</p>
49+
<p>The name of the keystore file (for example, <code>keystore.p12</code>).</p>
5050
</dd>
5151
<dt>Trust Algorithm</dt>
5252
<dd>
@@ -58,7 +58,7 @@ <h4><a id="sthref237" name="sthref237"></a><a id="sthref238" name="sthref238"></
5858
</dd>
5959
<dt>Trust Store</dt>
6060
<dd>
61-
<p>The name of the truststore file (for example, <code>cacerts.jks</code>).</p>
61+
<p>The name of the truststore file (for example, <code>cacerts.p12</code>).</p>
6262
</dd>
6363
<dt>Cipher Suites</dt>
6464
<dd>

‎appserver/admingui/common/src/main/help/en/help/task-jmxconnectorssledit.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ <h5>Before You Begin</h5>
5555
<p>In the certificate, the name format is <i>tokenname</i><code>:</code><i>nickname</i>. Including the <i>tokenname</i><code>:</code> part of the name in this attribute is optional.</p>
5656
</li>
5757
<li>
58-
<p>In the Key Store field, type the name of the keystore file (for example, <code>keystore.jks</code>).</p>
58+
<p>In the Key Store field, type the name of the keystore file (for example, <code>keystore.p12</code>).</p>
5959
</li>
6060
<li>
6161
<p>In the Trust Algorithm field, type the name of the trust management algorithm (for example, PKIX) to use for certification path validation.</p>
@@ -65,7 +65,7 @@ <h5>Before You Begin</h5>
6565
<p>This field is used only if the Trust Algorithm field is set to PKIX. A value of 0 implies that the path can only contain a single certificate. A value of -1 implies that the path length is unconstrained (there is no maximum). Setting a value less than -1 causes an exception to be thrown.</p>
6666
</li>
6767
<li>
68-
<p>In the Trust Store field, type the name of the truststore file (for example, <code>cacerts.jks</code>).</p>
68+
<p>In the Trust Store field, type the name of the truststore file (for example, <code>cacerts.p12</code>).</p>
6969
</li>
7070
<li>
7171
<p>In the Cipher Suites area, specify the cipher suites to be used.</p>

‎appserver/admingui/corba/src/main/help/en/help/ref-editiiopssl.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ <h4><a id="sthref27" name="sthref27"></a><a id="sthref28" name="sthref28"></a>SS
4545
</dd>
4646
<dt>Key Store</dt>
4747
<dd>
48-
<p>The name of the keystore file (for example, <code>keystore.jks</code>).</p>
48+
<p>The name of the keystore file (for example, <code>keystore.p12</code>).</p>
4949
</dd>
5050
<dt>Trust Algorithm</dt>
5151
<dd>
@@ -57,7 +57,7 @@ <h4><a id="sthref27" name="sthref27"></a><a id="sthref28" name="sthref28"></a>SS
5757
</dd>
5858
<dt>Trust Store</dt>
5959
<dd>
60-
<p>The name of the truststore file (for example, <code>cacerts.jks</code>).</p>
60+
<p>The name of the truststore file (for example, <code>cacerts.p12</code>).</p>
6161
</dd>
6262
<dt>Cipher Suites</dt>
6363
<dd>

‎appserver/admingui/corba/src/main/help/en/help/task-editiiopssl.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ <h4><a id="sthref9" name="sthref9"></a><a id="sthref10" name="sthref10"></a>To E
5656
<p>In the certificate, the name format is <i>tokenname</i><code>:</code><i>nickname</i>. Including the <i>tokenname</i><code>:</code> part of the name in this attribute is optional.</p>
5757
</li>
5858
<li>
59-
<p>In the Key Store field, type the name of the keystore file (for example, <code>keystore.jks</code>).</p>
59+
<p>In the Key Store field, type the name of the keystore file (for example, <code>keystore.p12</code>).</p>
6060
</li>
6161
<li>
6262
<p>In the Trust Algorithm field, type the name of the trust management algorithm (for example, PKIX) to use for certification path validation.</p>
@@ -66,7 +66,7 @@ <h4><a id="sthref9" name="sthref9"></a><a id="sthref10" name="sthref10"></a>To E
6666
<p>This field is used only if the Trust Algorithm field is set to PKIX. A value of 0 implies that the path can only contain a single certificate. A value of -1 implies that the path length is unconstrained (there is no maximum). Setting a value less than -1 causes an exception to be thrown.</p>
6767
</li>
6868
<li>
69-
<p>In the Trust Store field, type the name of the truststore file (for example, <code>cacerts.jks</code>).</p>
69+
<p>In the Trust Store field, type the name of the truststore file (for example, <code>cacerts.p12</code>).</p>
7070
</li>
7171
<li>
7272
<p>In the Cipher Suites area, specify the cipher suites to be used.</p>

‎appserver/admingui/core/src/main/resources/org/glassfish/admingui/core/Strings.properties‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1102,13 +1102,13 @@ ssl.selectedOtherCiphersLabel=Selected 40 bit and 56 bit Cipher Suites:
11021102
ssl.availableEccCiphersLabel=Available ECC Cipher Suites:
11031103
ssl.selectedEccCiphersLabel=Selected ECC Cipher Suites:
11041104
ssl.keyStore=Key Store:
1105-
ssl.keyStoreHelp=Name of the keystore file (for example, keystore.jks)
1105+
ssl.keyStoreHelp=Name of the keystore file (for example, keystore.p12)
11061106
ssl.TrustAlgorithm=Trust Algorithm:
11071107
ssl.TrustAlgorithmHelp=Name of the trust management algorithm (for example, PKIX) to use for certification path validation
11081108
ssl.trustMaxCert=Max Certificate Length:
11091109
ssl.trustMaxCertHelp=Maximum number of non-self-issued intermediate certificates that can exist in a certification path (valid only if Trust Algorithm is PKIX)
11101110
ssl.trustStore=Trust Store:
1111-
ssl.trustStoreHelp=Name of the truststore file (for example, cacerts.jks)
1111+
ssl.trustStoreHelp=Name of the truststore file (for example, cacerts.p12)
11121112

11131113

11141114

‎appserver/admingui/web/src/main/help/en/help/ref-protocolssledit.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ <h4><a id="sthref148" name="sthref148"></a><a id="sthref149" name="sthref149"></
5555
</dd>
5656
<dt>Key Store</dt>
5757
<dd>
58-
<p>The name of the keystore file (for example, <code>keystore.jks</code>).</p>
58+
<p>The name of the keystore file (for example, <code>keystore.p12</code>).</p>
5959
</dd>
6060
<dt>Trust Algorithm</dt>
6161
<dd>
@@ -67,7 +67,7 @@ <h4><a id="sthref148" name="sthref148"></a><a id="sthref149" name="sthref149"></
6767
</dd>
6868
<dt>Trust Store</dt>
6969
<dd>
70-
<p>The name of the truststore file (for example, <code>cacerts.jks</code>).</p>
70+
<p>The name of the truststore file (for example, <code>cacerts.p12</code>).</p>
7171
</dd>
7272
<dt>Cipher Suites</dt>
7373
<dd>

‎appserver/admingui/web/src/main/help/en/help/task-httplistenerssl.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ <h5>Before You Begin</h5>
5858
<p>In the certificate, the name format is <i>tokenname</i><code>:</code><i>nickname</i>. Including the <i>tokenname</i><code>:</code> part of the name in this attribute is optional.</p>
5959
</li>
6060
<li>
61-
<p>In the Key Store field, type the name of the keystore file (for example, <code>keystore.jks</code>).</p>
61+
<p>In the Key Store field, type the name of the keystore file (for example, <code>keystore.p12</code>).</p>
6262
</li>
6363
<li>
6464
<p>In the Trust Algorithm field, type the name of the trust management algorithm (for example, PKIX) to use for certification path validation.</p>
@@ -68,7 +68,7 @@ <h5>Before You Begin</h5>
6868
<p>This field is used only if the Trust Algorithm field is set to PKIX. A value of 0 implies that the path can only contain a single certificate. A value of -1 implies that the path length is unconstrained (there is no maximum). Setting a value less than -1 causes an exception to be thrown.</p>
6969
</li>
7070
<li>
71-
<p>In the Trust Store field, type the name of the truststore file (for example, <code>cacerts.jks</code>).</p>
71+
<p>In the Trust Store field, type the name of the truststore file (for example, <code>cacerts.p12</code>).</p>
7272
</li>
7373
<li>
7474
<p>In the Cipher Suites area, specify the cipher suites to be used.</p>

0 commit comments

Comments
 (0)