JDK-8231338 : sun/security/pkcs11/Secmod/AddTrustedCert.java failed on Ubuntu 18.04.2 LTS
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.crypto:pkcs11
  • Affected Version: 14
  • Priority: P4
  • Status: Closed
  • Resolution: Duplicate
  • OS: linux
  • CPU: x86
  • Submitted: 2019-09-23
  • Updated: 2019-10-12
  • Resolved: 2019-10-12
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 14
14Resolved
Related Reports
Duplicate :  
JDK-8232153 - sun/security/pkcs11/Secmod/AddTrustedCert.java failed with Linux built-in NSS libs
Relates :  
JDK-8180837 - SunPKCS11-NSS tests failing with CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID
Description
Running test 'jtreg:test/jdk/sun/security/pkcs11/Secmod/AddTrustedCert.java'
--------------------------------------------------
TEST: sun/security/pkcs11/Secmod/AddTrustedCert.java
TEST JDK: /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk

ACTION: build -- Passed. Build successful
REASON: Named class compiled on demand
TIME:   0.723 seconds
messages:
command: build AddTrustedCert
reason: Named class compiled on demand
Test directory:
  compile: AddTrustedCert
elapsed time (seconds): 0.723

ACTION: compile -- Passed. Compilation successful
REASON: .class file out of date or does not exist
TIME:   0.721 seconds
messages:
command: compile /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod/AddTrustedCert.java
reason: .class file out of date or does not exist
Additional options from @modules: --add-modules jdk.crypto.cryptoki
Mode: agentvm
Agent id: 0
elapsed time (seconds): 0.721
configuration:
Boot Layer (javac runtime environment)
  class path: /home/fool/workspace/jtreg/build/images/jtreg/lib/javatest.jar 
              /home/fool/workspace/jtreg/build/images/jtreg/lib/jtreg.jar 
  patch:      java.base /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/patches/java.base

javac compilation environment
  add modules: jdk.crypto.cryptoki
  source path: /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod
               /home/fool/workspace/jdk-dev/test/lib
               /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11
  class path:  /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod
               /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d
               /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib
               /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11

rerun:
cd /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/scratch/0 && \
DISPLAY=:0 \
GNOME_DESKTOP_SESSION_ID=this-is-deprecated \
HOME=/home/fool \
JDK8_HOME=/opt/jdk-13 \
LANG=en_US.UTF-8 \
PATH=/bin:/usr/bin \
TEST_IMAGE_DIR=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test \
TEST_IMAGE_GRAAL_DIR=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test/hotspot/jtreg/graal \
XMODIFIERS=@im=fcitx \
    /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk/bin/javac \
        -J-Xmx512m \
        -J-XX:MaxRAMPercentage=6 \
        -J-ea \
        -J-esa \
        -J-Djava.library.path=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test/jdk/jtreg/native \
        -J-Dtest.class.path.prefix=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11 \
        -J-Dtest.src=/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod \
        -J-Dtest.src.path=/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/test/lib:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11 \
        -J-Dtest.classes=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d \
        -J-Dtest.class.path=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11 \
        -J-Dtest.vm.opts='-Xmx512m -XX:MaxRAMPercentage=6 -ea -esa' \
        -J-Dtest.tool.vm.opts='-J-Xmx512m -J-XX:MaxRAMPercentage=6 -J-ea -J-esa' \
        -J-Dtest.compiler.opts= \
        -J-Dtest.java.opts= \
        -J-Dtest.jdk=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk \
        -J-Dcompile.jdk=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk \
        -J-Dtest.timeout.factor=4.0 \
        -J-Dtest.root=/home/fool/workspace/jdk-dev/test/jdk \
        -J-Dtest.modules=jdk.crypto.cryptoki \
        -J-Dtest.nativepath=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test/jdk/jtreg/native \
        --add-modules jdk.crypto.cryptoki \
        -d /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d \
        -sourcepath /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/test/lib:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11 \
        -classpath /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11 /home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod/AddTrustedCert.java
direct:
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.

ACTION: main -- Failed. Execution failed: `main' threw exception: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY
REASON: User specified action: run main/othervm AddTrustedCert 
TIME:   0.214 seconds
messages:
command: main AddTrustedCert
reason: User specified action: run main/othervm AddTrustedCert 
Mode: othervm [/othervm specified]
Additional options from @modules: --add-modules jdk.crypto.cryptoki
elapsed time (seconds): 0.214
configuration:
Boot Layer
  add modules: jdk.crypto.cryptoki

STDOUT:
Cannot resolve artifact, please check if JIB jar is present in classpath.
nssLibDir: /usr/lib/x86_64-linux-gnu/
Cannot resolve artifact, please check if JIB jar is present in classpath.
libnss3 version = 3.35.  ECC None.
SunPKCS11-NSSKeyStore version 14
entries: 1
[mykey]
first entry = Trusted certificate entry:
[
[
  Version: V3
  Subject: EMAILADDRESS=info@opentsa.org, CN=OpenTSA Root CA, O=OpenTSA, L=Dublin, ST=Co. Dublin, C=IE
  Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

  Key:  Sun RSA public key, 2048 bits
  params: null
  modulus: 28015647916364875829141896049677220882914191436294605577513377891910662717336292436491710471594406842772073838695462019009454723293288506992417485761129126311538268002377286178684649711932051555842344360775863345218752895239460508761587090794001550599392104457188635329925564746414056111210478603450167440907565077703922928621867939042884745257219423496925695838757642236269036957557147241224660577528253185760515264362748497612078896510637739121732184250485539505699485155279825000189178169555672844007672373755234739866676449460941418806853690713277829199399068163905100762713680303566487520616527043839846563616127
  public exponent: 65537
  Validity: [From: Fri Oct 18 04:51:34 CST 2002,
               To: Tue Oct 17 04:51:34 CST 2006]
  Issuer: EMAILADDRESS=info@opentsa.org, CN=OpenTSA Root CA, O=OpenTSA, L=Dublin, ST=Co. Dublin, C=IE
  SerialNumber: [    00]

Certificate Extensions: 6
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 2D 9D F7 1D 7E 65 77 9A   F4 D9 B4 99 B1 17 3B C4  -....ew.......;.
0010: 2F C8 AD A5                                        /...
]
[EMAILADDRESS=info@opentsa.org, CN=OpenTSA Root CA, O=OpenTSA, L=Dublin, ST=Co. Dublin, C=IE]
SerialNumber: [    00]
]

[2]: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

[3]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  Key_CertSign
  Crl_Sign
]

[4]: ObjectId: 2.16.840.1.113730.1.1 Criticality=false
NetscapeCertType [
   SSL CA
   S/MIME CA
]

[5]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  RFC822Name: info@opentsa.org
]

[6]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 2D 9D F7 1D 7E 65 77 9A   F4 D9 B4 99 B1 17 3B C4  -....ew.......;.
0010: 2F C8 AD A5                                        /...
]
]

]
  Algorithm: [SHA1withRSA]
  Signature:
0000: 26 A9 2D 41 7E 71 12 DA   BB 89 AE 0C 84 E4 FC FC  &.-A.q..........
0010: 71 6B 13 1E 41 2C 85 A0   51 BA 81 90 4C 9A 2C A4  qk..A,..Q...L.,.
0020: 61 ED 7B 61 AC A4 13 C7   6C 07 E9 46 E4 F6 C3 05  a..a....l..F....
0030: 31 96 C2 42 FC 39 2D 43   37 34 24 8B EB 3E 90 FC  1..B.9-C74$..>..
0040: F5 FE 64 37 1F 8C 24 98   E6 FC 62 FC 9C 2C 05 B4  ..d7..$...b..,..
0050: 7F 59 4E 28 DA 22 64 0B   5C 35 BA 0B DE 81 53 0B  .YN(."d.\5....S.
0060: 80 9B 3A FD BE A7 ED 63   09 EE AB 52 B7 DE 96 12  ..:....c...R....
0070: 1E 58 87 DE C0 61 31 56   86 BB 93 9A DF 20 63 20  .X...a1V..... c 
0080: F6 EF F9 B8 28 1B 6E 0E   36 35 BE A2 8A D2 F9 D1  ....(.n.65......
0090: 54 04 29 18 5E 27 72 65   8B 63 22 A7 43 2A AB 39  T.).^'re.c".C*.9
00A0: AE EF CF D5 FF D1 9C 21   FB 8C 96 D5 12 D1 51 12  .......!......Q.
00B0: 15 33 DB 96 96 AA 5E 55   9D B2 C5 E8 83 22 FA 08  .3....^U....."..
00C0: EF 8C 51 80 A8 59 6B EC   80 19 F7 6E 6B C8 80 53  ..Q..Yk....nk..S
00D0: 8F 30 D8 F8 B3 83 31 ED   E3 5C CE 5C 47 D8 2F 71  .0....1..\.\G./q
00E0: C8 88 78 D0 90 B4 D6 39   64 0D 05 8A 86 C4 63 B5  ..x....9d.....c.
00F0: 9B 63 3F DF A2 E6 28 39   D0 67 27 75 4D E2 CF 1E  .c?...(9.g'uM...

]
STDERR:
java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
	at java.base/java.security.KeyStore.setCertificateEntry(KeyStore.java:1228)
	at AddTrustedCert.main(AddTrustedCert.java:106)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:564)
	at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)
	at java.base/java.lang.Thread.run(Thread.java:830)
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY
	at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(Native Method)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
	... 9 more

JavaTest Message: Test threw exception: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY
JavaTest Message: shutting down test

STATUS:Failed.`main' threw exception: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY
rerun:
cd /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/scratch/0 && \
DISPLAY=:0 \
GNOME_DESKTOP_SESSION_ID=this-is-deprecated \
HOME=/home/fool \
JDK8_HOME=/opt/jdk-13 \
LANG=en_US.UTF-8 \
PATH=/bin:/usr/bin \
TEST_IMAGE_DIR=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test \
TEST_IMAGE_GRAAL_DIR=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test/hotspot/jtreg/graal \
XMODIFIERS=@im=fcitx \
CLASSPATH=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib:/home/fool/workspace/jdk-dev/test/lib:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11:/home/fool/workspace/jtreg/build/images/jtreg/lib/javatest.jar:/home/fool/workspace/jtreg/build/images/jtreg/lib/jtreg.jar \
    /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk/bin/java \
        -Dtest.class.path.prefix=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11 \
        -Dtest.src=/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod \
        -Dtest.src.path=/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11/Secmod:/home/fool/workspace/jdk-dev/test/lib:/home/fool/workspace/jdk-dev/test/jdk/sun/security/pkcs11 \
        -Dtest.classes=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d \
        -Dtest.class.path=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11/Secmod/AddTrustedCert.d:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/test/lib:/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/classes/0/sun/security/pkcs11 \
        -Dtest.vm.opts='-Xmx512m -XX:MaxRAMPercentage=6 -ea -esa' \
        -Dtest.tool.vm.opts='-J-Xmx512m -J-XX:MaxRAMPercentage=6 -J-ea -J-esa' \
        -Dtest.compiler.opts= \
        -Dtest.java.opts= \
        -Dtest.jdk=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk \
        -Dcompile.jdk=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/jdk \
        -Dtest.timeout.factor=4.0 \
        -Dtest.root=/home/fool/workspace/jdk-dev/test/jdk \
        -Dtest.modules=jdk.crypto.cryptoki \
        -Dtest.nativepath=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test/jdk/jtreg/native \
        --add-modules jdk.crypto.cryptoki \
        -Xmx512m \
        -XX:MaxRAMPercentage=6 \
        -ea \
        -esa \
        -Djava.library.path=/home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/images/test/jdk/jtreg/native \
        com.sun.javatest.regtest.agent.MainWrapper /home/fool/workspace/jdk-dev/build/linux-x86_64-server-release/test-support/jtreg_test_jdk_sun_security_pkcs11_Secmod_AddTrustedCert_java/sun/security/pkcs11/Secmod/AddTrustedCert.d/main.0.jta

TEST RESULT: Failed. Execution failed: `main' threw exception: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY
--------------------------------------------------
Comments
Thanks John Jiang for taking a look at this issue again.
12-10-2019
JDK-8232153 would fix this issue.
12-10-2019
Reproduced this issue with NSS 3.35 libs from libnss3-dev on Ubuntu 18.04.
12-10-2019
Hi [~jjiang], After more experiments, we believe this failure was caused by the nss libs on Ubuntu18.04. And your workaround approach is good enough. We've filed JDK-8231351 to add some notes for PKCS11 tests. Could this issue be closed as won't fix? Thanks.
23-09-2019
OK. Thanks [~jjiang].
23-09-2019
In addition, NSS was upgraded frequently, and the old/new bugs are fixed/introduced frequently as well. I just recommend to use the latest NSS version. In fact, PKCS11 tests are using NSS 3.46 in our CI. As mentioned in my previous mail, the system property test.nss.lib.paths can be used to specify alternative NSS libs for PKCS11 tests. This would be a good workaround.
23-09-2019
As Martin Buchholz mentioned in JDK-8180837, this test passed with NSS 3.35 on his Debian. And this test also passed with this NSS version on my Ubuntu 15.10. Because the test passed with my NSS 3.35 build on your Ubuntu 18.10, and it also passed with your NSS 3.46 build on the same OS, so it's hard to say what's the problem, Linux, NSS build or others, on this test case. You may need to run this test with your NSS 3.35 libs on another Linux or re-build NSS 3.35 for double-checking.
23-09-2019