JavaTM Cryptography Extension (JCE) 1.2.1
|
Known Bugs
- The JCE Code Signing CA uses Netscape CMS 4.1 to import Certificate Signing
Requests (CSRs) from users and generate code-signing certificates that the
users can utilize to sign their providers or exempt applications. The CSRs
generated by keytool are in the PKCS#10 format. A bug in Netscape CMS 4.1
causes it to be unable to import a PKCS#10 request if it is directed to
generate an object (code) signing certificate. But it can import a PKCS#10
request if it is directed to generate an SSL server certificate. This problem
is expected to be fixed in Netscape CMS 4.2.
Workaround: The JCE Code Signing CA will issue SSL server certificates for
code signing for now. It will be able to issue object signing certificates
once we upgrade to Netscape CMS 4.2 after it becomes generally available.
- Due to a bug in the JavaTM 2 SDK,
you must have the "SUN" provider as the
first security provider when loading a signed JAR file.
Since the JCE 1.2.1 framework and JCE providers are signed JAR
files, the "SUN" provider must be the first security
provider when using JCE 1.2.1.
Please note: This is the default. That is, in the
JavaTM 2 SDK, the
"SUN" provider is automatically configured as a static provider with
preference order 1 in the security properties file.
- Due to a bug in the JavaTM 2 SDK,
sometimes you may get a NullPointerException
from java.util.jar.JarVerifier.processEntry() if a JCE 1.2.1 provider
(which is signed) is registered both statically and dynamically and
a security manager is installed on the command line.
There are two possible workarounds:
- Register a JCE 1.2.1 provider statically or dynamically, but do
not register it both statically and dynamically. If you register
a provider just one way or the other there is
no problem installing a security manager on the command line.
- Install the security manager in your code instead of installing
it on the command line. Then it doesn't matter how you
register a JCE 1.2.1 provider.
- Due to a bug in the JavaTM 2 SDK,
if JCE 1.2.1 has been installed as an
"installed" extension, then the SealedObject class can only unseal objects that
are either a part of the Java 2 SDK or part of an installed extension. It
cannot unseal other objects.
Workaround: Have both the JCE 1.2.1 framework and JCE providers
on the class path instead of having them be installed extensions.
The jurisdiction policy files must be in the same directory
as that which contains the JCE 1.2.1 framework JAR file. Also make sure
that sufficient permissions are granted to the JCE 1.2.1
framework and JCE providers.
|
|