JDK-8333640 : security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliasonerarootcav1 fails
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 8,11,17,21,22,23,24,repo-phoenix
  • Priority: P3
  • Status: Open
  • Resolution: Unresolved
  • OS: generic
  • CPU: generic
  • Submitted: 2024-06-05
  • Updated: 2025-06-12
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other
tbdUnresolved
Related Reports
Duplicate :  
JDK-8333654 - security/cert/CertPathValidator/certification/CAInterop.java#teliasonerarootcav1 test fails intermediate root CA chain check
Relates :  
JDK-8210432 - Add additional TeliaSonera root certificate
Sub Tasks
JDK-8333724 :  
Problem list security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliasonerarootcav1 - Resolved
Description
We see for some days errors in the jtreg test security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliasonerarootcav1 .
stdout says :
=====================================================
CONFIGURATION
=====================================================
http.proxyHost :null
http.proxyPort :null
https.proxyHost :null
https.proxyPort :null
https.socksProxyHost :null
https.socksProxyPort :null
jdk.certpath.disabledAlgorithms :MD2, MD5, SHA1 jdkCA & usage TLSServer, RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224, SHA1 usage SignedJAR & denyAfter 2019-01-01
com.sun.security.enableCRLDP :false
ocsp.enable :true
=====================================================

===== Validate https://juolukka.cover.sonera.net:10443=====
Finding intermediate certificate issued by CA
Checking: CN=cps.trust.telia.com
Issuer: CN=Telia Domain Validation CA v3, O=Telia Finland Oyj, C=FI
Checking: CN=Telia Domain Validation CA v3, O=Telia Finland Oyj, C=FI
Issuer: CN=Telia Root CA v2, O=Telia Finland Oyj, C=FI
Checking: CN=Telia Root CA v2, O=Telia Finland Oyj, C=FI
Issuer: CN=TeliaSonera Root CA v1, O=TeliaSonera
Found intermediate root CA: CN=Telia Root CA v2, O=Telia Finland Oyj, C=FI
intermediate CA Issuer: CN=TeliaSonera Root CA v1, O=TeliaSonera
Verified: Intermediate CA signed by test root CA
======> SUCCESS

===== Validate https://juolukka.cover.sonera.net:10444=====
SSLHandshakeException: (certificate_revoked) PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate has been revoked, reason: UNSPECIFIED, revocation date: Sat Jun 01 04:22:03 CEST 2024, authority: CN=Telia Domain Validation CA v3 OCSP responder, O=Telia Finland Oyj, C=FI, extension OIDs: []
Certificate is revoked
Finding intermediate certificate issued by CA
Checking: CN=cps.trust.telia.com
Issuer: CN=Telia Domain Validation CA v3, O=Telia Finland Oyj, C=FI
Checking: CN=Telia Domain Validation CA v3, O=Telia Finland Oyj, C=FI
Issuer: CN=Telia Root CA v2, O=Telia Finland Oyj, C=FI

Does it have to do with the revocation date: Sat Jun 01 04:22:03 CEST 2024, ?
Comments
The issue is with the certificate chain validation. Test is not able to find a chain that validates with expected root CA "CN=TeliaSonera Root CA v1, O=TeliaSonera". We will check this with this root CA organization.
07-06-2024
+1 on excluding.
06-06-2024
Should we exclude the test for now? It causes a lot of noise in the jtreg tests.
05-06-2024