JDK-6948803 : CertPath validation regression caused by SHA1 replacement root and MD2 disable feature
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 6u19
  • Priority: P2
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2010-04-30
  • Updated: 2012-09-14
  • Resolved: 2010-05-25
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7 Other
6u21 b05Fixed 7Fixed OpenJDK6Fixed
Related Reports
Relates :  
JDK-7017668 - TEST_BUG: sun/security/validator/CertReplace.java failure
Relates :  
JDK-6904162 - Add new VeriSign root CA certificates to JRE and remove some old/unused ones
Relates :  
JDK-2194455 - regression: PKIXValidator fails when multiple trust anchors have same dn
Description
In 6u19, several VeriSign MD2/MD5 root certificates were replaced with stronger SHA1 versions (same key, stronger signature). Some customers using certificates issued from the VeriSign PCA 3 root have been reporting problems that cause their existing certificate chains to be rejected by the JRE because the certificate chain still includes the weaker MD2 root and we disabled MD2 support in 6u17.

The problem is that our certpath validation implementation adds the SHA1 root to the beginning of the chain but does not replace the existing MD2 root. So the chain includes both roots, first the SHA1, then the MD2 and then the rest of the chain. The chain is rejected because the MD2 root is treated as an intermediate CA cert. 

It seems our implementation should instead replace the MD2 root with the stronger SHA1 root before validating the chain.
Comments
EVALUATION Fixed. A cert with the same issuer and public key as a trusted anchor is removed from the chain.
18-05-2010
SUGGESTED FIX We should enhance the sun.security.validator.PKIXValidator class to check for and replace root certs with the same issuer DN and public key.
30-04-2010
WORK AROUND Their are a few ways to workaround the issue. For TLS, the server's certificate chain can be reconfigured so that either the MD2 root certificate is not included in the chain (including the root cert is optional in TLS), or it should be replaced with the SHA1 root certificate. For code signing, you can re-sign the jar and include a chain with the SHA1 root instead of the MD2 root, or a chain without the root cert.
30-04-2010