Does JDK 8u72 break OpenSAML certificate parsing in some cases?

[Cantor, Scott]

On 2/3/16, 9:54 AM, "dev on behalf of Dan Urbano" <dev-bounces at shibboleth.net on behalf of fantasydan97 at gmail.com> wrote:



>I am currently running Shibboleth IdP V 3.1.2 at my company. I don't use the provided distribution, I build the source code for OpenSAML and the IdP using ant and my company's homegrown dependency system. I am using the 3.1.1 tag for the OpenSAML source code. Everything works fine when building with JDK8u66. However, after upgrading to JDK8u72, Opensaml-security-impl fails 12 unit tests, 2 in PKIXX509CredentialTrustEngineTest and 10 in CertPathPKIXTrustEvaluatorTest.

Java turned off MD5 and the test certs have MD5 in them, they're that old.

It's not a bug or a test failure, just a policy change in Java that appeared out of the blue in a patch release.

We're aware, but the tests include actual chains of certs so the effort to regenerate them will be substantial and we haven't done it yet.

-- Scott