JDK-7190945 : pkcs11 problem loading NSS libs on Ubuntu
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 7,8
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS: generic,linux_ubuntu
  • CPU: generic
  • Submitted: 2012-08-13
  • Updated: 2015-05-28
  • Resolved: 2012-09-05
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
7u91Fixed 8 b55Fixed
Related Reports
Duplicate :  
Relates :  
The multi-arch support introduced in Ubuntu 11.04 provides new locations for 32-bit and 64-bit libraries:


Previously, the standard /usr/lib and /usr/lib64 directories were used. The SunPKCS11
provider fails to load Mozilla NSS libraries. The provider needs to be modified to load
from the new locations.

In addition, the Mozilla NSS libraries on Ubuntu are now installed into two directories instead of one. Specifically, the libsoftokn3 library is now in a 'nss' subsirectory
below the system libraries directory.

one expired certificate removed in the associated keystore.jks change : t4 $diff 7u.out 8u.out 5c5 < Your keystore contains 4 entries --- > Your keystore contains 3 entries 66,86d65 < ******************************************* < ******************************************* < < < Alias name: sect193r1server-rsa1024ca < Creation date: Feb 23, 2006 < Entry type: PrivateKeyEntry < Certificate chain length: 1 < Certificate[1]: < Owner: CN=dev.experimentalstuff.com, OU=Test Server (sect193r1server-rsa1024ca), O=Sun Microsystems Laboratories, L=Mountain View, ST=CA, C=US < Issuer: CN=dev.experimentalstuff.com, OU=Test Server (RSA 1024), O=Sun Microsystems Laboratories, L=Mountain View, ST=CA, C=US < Serial number: a0dd4f0c73b5c25f < Valid from: Tue Dec 06 21:30:45 GMT 2005 until: Thu Jan 14 21:30:45 GMT 2010 < Certificate fingerprints: < MD5: 19:1E:0C:32:94:A9:99:7E:23:B8:39:85:6D:F0:58:58 < SHA1: 36:B6:6B:C1:AA:5B:6E:CF:F7:B7:37:99:B1:58:26:69:71:1F:CE:A8 < SHA256: 47:D2:67:A2:DA:9D:65:CC:A3:7E:84:5E:94:05:FC:F4:7C:24:D5:A1:79:21:42:36:30:9D:97:26:45:95:A9:0F < Signature algorithm name: SHA1withRSA < Version: 1 <

jdk 8 changeset : http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/5e5bdfd18325

The issue have been fix in JDK-7196855

EVALUATION Fix SunPKCS11 provider to load Mozilla NSS libraries from the new system libraries directory. Handle loading libsoftokn3 from the 'nss' sudirectory.