Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-05 Thread Sean Mullan
On Mon, 27 Jan 2025 22:43:32 GMT, Tim Jacomb wrote: >> ## The change >> >> Without this change intermediate certificates that don't have explicit trust >> settings are ignored not added to the truststore. >> >> >> >> ## Reproducer >> >> See https://github.com/timja/openjdk-intermediate-ca-r

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-02 Thread Sean Mullan
On Tue, 1 Apr 2025 16:13:55 GMT, Tim Jacomb wrote: > > I am dubious that this is the right thing to do. There is a distinct > > difference between a certificate that is trusted and one that requires > > additional validation to determine if it is trusted. Blindly trusting > > self-signed certi

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-02 Thread Tim Jacomb
On Tue, 1 Apr 2025 19:23:27 GMT, Sean Mullan wrote: > We need to be really careful here. With this fix we are deciding at runtime > that these intermediate certificates should be treated as > `KeyStore.TrustedCertificateEntry` objects just because they validated ok, > and without any interacti

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-01 Thread Sean Mullan
On Mon, 27 Jan 2025 22:43:32 GMT, Tim Jacomb wrote: >> ## The change >> >> Without this change intermediate certificates that don't have explicit trust >> settings are ignored not added to the truststore. >> >> >> >> ## Reproducer >> >> See https://github.com/timja/openjdk-intermediate-ca-r

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-01 Thread Bernd
On Mon, 27 Jan 2025 22:43:32 GMT, Tim Jacomb wrote: >> ## The change >> >> Without this change intermediate certificates that don't have explicit trust >> settings are ignored not added to the truststore. >> >> >> >> ## Reproducer >> >> See https://github.com/timja/openjdk-intermediate-ca-r

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-01 Thread Alexey Bakhtin
On Tue, 1 Apr 2025 17:29:57 GMT, Sean Mullan wrote: > > > I am dubious that this is the right thing to do. There is a distinct > > > difference between a certificate that is trusted and one that requires > > > additional validation to determine if it is trusted. Blindly trusting > > > self-sig

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-04-01 Thread Tim Jacomb
On Tue, 1 Apr 2025 15:25:45 GMT, Sean Mullan wrote: > I am dubious that this is the right thing to do. There is a distinct > difference between a certificate that is trusted and one that requires > additional validation to determine if it is trusted. Blindly trusting > self-signed certificates

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-02-06 Thread Tim Jacomb
On Mon, 27 Jan 2025 22:43:32 GMT, Tim Jacomb wrote: >> ## The change >> >> Without this change intermediate certificates that don't have explicit trust >> settings are ignored not added to the truststore. >> >> >> >> ## Reproducer >> >> See https://github.com/timja/openjdk-intermediate-ca-r

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-01-27 Thread Alexey Bakhtin
On Mon, 27 Jan 2025 22:43:32 GMT, Tim Jacomb wrote: >> ## The change >> >> Without this change intermediate certificates that don't have explicit trust >> settings are ignored not added to the truststore. >> >> >> >> ## Reproducer >> >> See https://github.com/timja/openjdk-intermediate-ca-r

Re: RFR: 8347067: Load certificates without explicit trust settings in KeyChainStore [v5]

2025-01-27 Thread Tim Jacomb
> ## The change > > Without this change intermediate certificates that don't have explicit trust > settings are ignored not added to the truststore. > > > > ## Reproducer > > See https://github.com/timja/openjdk-intermediate-ca-reproducer > > Without this change the reproducer fails, and wit