Java 8 无法在 FIPS 中加载其 cacerts。异常 "no such provider: SunEC"

Question

我的服务器使用的是 java 7，并且在 FIPS 模式下运行良好。现在我们正在升级到 jre8，在启动期间加载 cacerts 时出现以下异常。

java.lang.RuntimeException: java.security.NoSuchProviderException: no such provider: SunEC
   at sun.security.util.ECUtil.getKeyFactory(ECUtil.java:96)
   at sun.security.util.ECUtil.decodeX509ECPublicKey(ECUtil.java:102)
   at sun.security.pkcs11.P11ECKeyFactory.engineGeneratePublic(P11ECKeyFactory.java:170)
   at java.security.KeyFactory.generatePublic(KeyFactory.java:334)
   at sun.security.x509.X509Key.buildX509Key(X509Key.java:223)
   at sun.security.x509.X509Key.parse(X509Key.java:170)
   at sun.security.x509.CertificateX509Key.<init>(CertificateX509Key.java:75)
   at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:667)
   at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:167)
   at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1806)
   at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
   at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:99)
   at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
   at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:747)
   at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
   at java.security.KeyStore.load(KeyStore.java:1433)
   at org.apache.commons.ssl.KeyStoreBuilder.tryJKS(KeyStoreBuilder.java:476)
   at org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:383)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:212)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:170)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:175)
   at org.apache.commons.ssl.TrustMaterial.<clinit>(TrustMaterial.java:88)
   at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:317)
Caused by: java.security.NoSuchProviderException: no such provider: SunEC
        at sun.security.jca.GetInstance.getService(GetInstance.java:83)
        at sun.security.jca.GetInstance.getInstance(GetInstance.java:206)
        at java.security.KeyFactory.getInstance(KeyFactory.java:211)
        at sun.security.util.ECUtil.getKeyFactory(ECUtil.java:94)

我所做的唯一修改是将 TLSv1.2 添加到 jdk.tls.disabledAlgorithms=SSLv3,TLSv1.2，因为 NSS 不支持 TLSv1.2。

我能够在 jre7u72 构建中加载相同的内容，我看到 sunpkcs11.jar 在 java 8 中被修改。这不应该是 cacerts 问题，因为我将 java7 cacerts 复制到 java8，但问题仍然存在。

有没有人见过这个问题？它应该是一个 java 错误吗？

=== 编辑 ===

打开了 java 8 错误。我编写了一个针对 jre7 成功运行但在 jre8 上失败的工具。

 import java.io.ByteArrayInputStream;
    import java.io.ByteArrayOutputStream;
    import java.io.FileInputStream;
    import java.io.IOException;
    import java.security.KeyStore;
    import java.security.Provider;
    import java.security.Security;
    import java.util.ArrayList;
    import java.util.Enumeration;
    import java.util.List;
    import java.util.Map;
    import java.util.Properties;
    import java.util.logging.Level;
    import java.util.logging.Logger;

    import sun.security.provider.Sun;
    import sun.security.rsa.SunRsaSign;

/**
 * Before running the tool run the following in your Linux box.
 * 
    1. export LD_LIBRARY_PATH=/usr/lib64
    2. mkdir /tmp/fips/nssdb
    3. modutil -create -dbdir /tmp/fips/nssdb/
    4. modutil -fips true -dbdir /tmp/fips/nssdb
    5. modutil -changepw "NSS FIPS 140-2 Certificate DB" -dbdir /tmp/fips/nssdb
      (Give a strong password like password1!)

 * @author atulsm@gmail.com
 *
 */
    public class TestKeyStoreFIPS {

        public static final String NSS_LIB_DIR_PROP = "nss.lib";
        public static final String NSS_DB_DIR_PROP = "nss.db";
        public static final String SUN_JSSE = "SunJSSE";
        public static List<String> disabledAlgs = new ArrayList<String>();

        private static final Logger logger = Logger.getLogger(TestKeyStoreFIPS.class.getName());

        /**
         * @param args
         */
        public static void main(String[] args) throws Exception{
            if(args.length != 2){
                System.out.println("Usage eg: java -Dnss.lib=/usr/lib64 -Dnss.db=/tmp/fips/nssdb  -Djavax.net.ssl.keyStorePassword=password1! TestKeyStoreFIPS /tmp/jre8/lib/security/cacerts changeit");
                System.exit(1);
            }

            enablePkcs11Jsse(System.getProperty(NSS_LIB_DIR_PROP), System.getProperty(NSS_DB_DIR_PROP));
            testFips();

            String file = args[0];
            char[] keystorePassword = args[1].toCharArray();
            FileInputStream keystoreStream = new FileInputStream(file);

            KeyStore keyStore = KeyStore.getInstance("JKS");
            keyStore.load(keystoreStream, keystorePassword);

            Enumeration<String> aliases = keyStore.aliases();

            while(aliases.hasMoreElements()){
                String alias = aliases.nextElement();
                System.out.println(alias + " : " + keyStore.getCertificate(alias).getType());

            }

        }

        private static void testFips(){
            String keyPass = System.getProperty("javax.net.ssl.keyStorePassword");      
            KeyStore store;

            try {
                store = KeyStore.getInstance("PKCS11");
                if (keyPass != null) {
                    store.load(null, keyPass.toCharArray());
                } else {
                    store.load(null, null);
                }
                System.out.println("FIPS test success");
            } catch (Throwable e) {
                e.printStackTrace();
                store = null;
                System.out.println("FIPS test failed");
            }                       
        }


        public static void enablePkcs11Jsse( String libDir, String dbDir) throws Exception {
            removeAllProviders();

            Provider nss = getNSSFIPSProvider( libDir, dbDir);
            removeDisabledAlgos(nss);       
            Security.insertProviderAt(nss, 1);

            Provider sunJsse = new com.sun.net.ssl.internal.ssl.Provider(nss);
            removeDisabledAlgos(sunJsse);
            Security.insertProviderAt(sunJsse,2);

            Sun sun = new Sun();
            removeDisabledAlgos(sun);       
            Security.insertProviderAt(sun,3);

            SunRsaSign sunrsa = new SunRsaSign();
            removeDisabledAlgos(sunrsa);
            Security.insertProviderAt(sunrsa,4);
        }   


       private static Provider getNSSFIPSProvider( String libDir, String dbDir) throws Exception {

           if(libDir == null || dbDir == null) {
               throw new Exception(NSS_LIB_DIR_PROP + " or " + NSS_DB_DIR_PROP + " not set.");
           }

           Properties props = new Properties();
           props.put("name", "NSSfips");
           props.put("nssLibraryDirectory", libDir);
           props.put("nssSecmodDirectory", dbDir);
           props.put("nssModule", "fips");
           props.put("nssDbMode", "readWrite");

           return createProvider(props);
       }

       private static Provider createProvider(Properties props) throws IOException {
           ByteArrayOutputStream out = new ByteArrayOutputStream();
           props.store(out, null);
           ByteArrayInputStream in = new ByteArrayInputStream(out.toByteArray());

           Provider ret = new sun.security.pkcs11.SunPKCS11(in);
           if (logger.isLoggable(Level.FINE)) {
               // Log all of the registered services
               for (Map.Entry<Object, Object> entry : ret.entrySet()) {
                   logger.log(Level.FINE, "{0} = {1}", new Object[]{entry.getKey(), entry.getValue()});
               }
           }
           return ret;
       }

       private static void removeAllProviders(){    
        Provider[] providers = Security.getProviders();
        for(Provider prov : providers){
            Security.removeProvider(prov.getName());
        }
       }

        private static void removeDisabledAlgos(Provider provider){     
            for(String alg : disabledAlgs){
                if(provider.getProperty(alg) != null){
                    logger.info("Removing algorithm " + alg + " from provider " + provider);
                    provider.remove(alg);
                }
            }
        }   

    }

Answer 1

虽然我探索了其他选项，但一种有效的方法是将我的一个信任库复制为 jre/lib/security/jssecacerts。我看到代码优先于 jssecacerts 而不是 cacerts 并且它现在工作正常。