From nobody Mon Feb 6 19:29:09 2023 X-Original-To: java@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4P9bsy27RLz3n5bF for ; Mon, 6 Feb 2023 19:29:10 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4P9bsy15Mbz3nZj for ; Mon, 6 Feb 2023 19:29:10 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675711750; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jE3Ve7Nk9Ro4wkqnI63JADkW/kWEZ2hgB33LuLcTdys=; b=L30UK1YnhsVacN5YEFAwSMfj85Tww54fq11/bHlEoTIcdhDoTUJPpLBWwCaW/eIYgrjn8S qX+fDMmfLNAzKfVDpQLTbmKz126hkxvALP/XKuAu+vdDoz8d34iYRr/YLJM7kN0kzTXat6 HqfcolbtFe/rbF3AYkrPSW1i+ubEl/h9JFUxLShGIWb45ylKLFoaebF/goVjCg6OCOghnz n2cfhrMu4e/LhVJLx5lcvWrT6ZSVyTkGHVvWCkuLksR4xFeplI0wJ9/oGa/ZcjJyfR36Ai Ln+9TGu6lhbwaHaCyk8r4mY0wO2ChD45F4M1oNx9XddstDxYUbaxnTV3tHte+Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1675711750; a=rsa-sha256; cv=none; b=mvXFUkjTzMTSGIkcsaNL8QLeAFrpFhkAL6oYLfOAOt1yjXVQ8MKeUpaD/lcf+0gowDtB+l FoTsDtvz3B/vgAdXnmfKmLZiQugXLmqKJuPg/qMuk01xzaW+tkKNqQrTBNdRR7z2Wm8QRb 4aqHk/OgpY9vxX7wDN/5D9ZfYSK0HfYRlT5iv/SiRdzB2yDSIc1hW77bqOYyR6DisQAtVt aaOhL3gtWYFO+Mw8868gz5p/EQsgK+Yo8AlJSyP5g7V5ULggjkSl6DsITtxG7wtscnDgNk 7IjA4sAc+LTAguBcx9pWRu25STexi23LGYJV98to0/Da+KnLKm8GS5cVVhnUAg== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4P9bsy0945zmwM for ; Mon, 6 Feb 2023 19:29:10 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 316JT9PI088511 for ; Mon, 6 Feb 2023 19:29:09 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 316JT9jQ088510 for java@FreeBSD.org; Mon, 6 Feb 2023 19:29:09 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: java@FreeBSD.org Subject: [Bug 229329] java/openjdk8: allow user to trust extra local certificates Date: Mon, 06 Feb 2023 19:29:09 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: michael.osipov@siemens.com X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: java@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? X-Bugzilla-Changed-Fields: cc attachments.created Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Porting Java to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-java List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-java@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D229329 Michael Osipov changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |michael.osipov@siemens.com --- Comment #10 from Michael Osipov --- Created attachment 239958 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D239958&action= =3Dedit Git-formatted patch Here is a patch against main which basically adds an option to use a custom cacerts from LOCALBASE. This is the easiest approach to solve this problem = now until openssl can directly creata Java-compatible PKCS#12 truststores: https://github.com/openssl/openssl/issues/6684 Works in production and poudriere. Can provide a patch for 11 and 17+ as we= ll, of course. Simple port used at work: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D PORTNAME=3D nss-siemens-cacerts-java PORTVERSION=3D 20221107 CATEGORIES=3D security DISTFILES=3D MAINTAINER=3D michael.osipov@siemens.com COMMENT=3D Collection of CA certificates trusted by NSS and Siemens = for Java NO_ARCH=3D yes NO_BUILD=3D yes NO_TEST=3D yes WRKSRC=3D ${FILESDIR} SSLDIR=3D ${PREFIX}/etc/ssl PLIST_SUB=3D SSLDIR=3D${SSLDIR} do-install: @${MKDIR} ${STAGEDIR}${SSLDIR} @${INSTALL_DATA} ${WRKSRC}/cacerts.jks ${STAGEDIR}${SSLDIR}/cacerts .include =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D cacerts.jks is generated with a custom Java application. --=20 You are receiving this mail because: You are the assignee for the bug.=