Notes on jdk.certpath.disabledAlgorithms

[Tom Zeller]

TL;DR We (meaning Brent) should just fix the test certs.

On last Friday’s dev call, we talked about the couple of OpenSAML tests[1] that are failing after the OpenJDK update which included MD5 in jdk.certpath.disabledAlgorithms. The real fix is, as Brent said, to remove/replace the test certs with MD5 signatures. However, as a temporary solution, I looked at enabling MD5 just for the failing tests. The only way I see to enable MD5 for the tests is via the <argLine/> configuration of the maven-surefire-plugin (which is what runs the tests), specifically :

<build>
  <plugins>
    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-surefire-plugin</artifactId>
      <configuration>
        <argLine>-Djava.security.properties=${project.basedir}/java.security-overrides</argLine> 

where java.security-overrides does not disable MD5 :
 
 jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

I was not able to set jdk.certpath.disabledAlgorithms as a system property (i.e. -D), I don’t see any doc that that should work.

Also, calling Security.setProperty() in the test itself via @BeforeClass didn’t work either, I guess because those security properties were instantiated already, I don’t know.

Thing is, we already override the maven-surefire-plugin <argLine/> in the parent-v3 POM for Cobertura, and the <argLine/>s are not additive, so the Maven configuration will get messier for Java 7. Not a huge deal, but I'd rather start building with Java 8 (keeping -source and -target at 1.7 and adding -Xbootclaspath, would take a little work to make sure we get it right).

Tom

[1] https://build.shibboleth.net/jenkins/job/java-opensaml-multi/439/jdk=OpenJDK-1.7.0,label=master/