Java 8 无法在 FIPS 中加载其证书。例外"no such provider: SunEC"

Question

我的服务器使用的是java7，在FIPS模式下运行良好。现在我们正在升级到jre8，在加载cacerts的启动过程中出现以下异常。

java.lang.RuntimeException: java.security.NoSuchProviderException: no such provider: SunEC
   at sun.security.util.ECUtil.getKeyFactory(ECUtil.java:96)
   at sun.security.util.ECUtil.decodeX509ECPublicKey(ECUtil.java:102)
   at sun.security.pkcs11.P11ECKeyFactory.engineGeneratePublic(P11ECKeyFactory.java:170)
   at java.security.KeyFactory.generatePublic(KeyFactory.java:334)
   at sun.security.x509.X509Key.buildX509Key(X509Key.java:223)
   at sun.security.x509.X509Key.parse(X509Key.java:170)
   at sun.security.x509.CertificateX509Key.<init>(CertificateX509Key.java:75)
   at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:667)
   at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:167)
   at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1806)
   at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
   at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:99)
   at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
   at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:747)
   at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
   at java.security.KeyStore.load(KeyStore.java:1433)
   at org.apache.commons.ssl.KeyStoreBuilder.tryJKS(KeyStoreBuilder.java:476)
   at org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:383)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:212)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:170)
   at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:175)
   at org.apache.commons.ssl.TrustMaterial.<clinit>(TrustMaterial.java:88)
   at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:317)
Caused by: java.security.NoSuchProviderException: no such provider: SunEC
        at sun.security.jca.GetInstance.getService(GetInstance.java:83)
        at sun.security.jca.GetInstance.getInstance(GetInstance.java:206)
        at java.security.KeyFactory.getInstance(KeyFactory.java:211)
        at sun.security.util.ECUtil.getKeyFactory(ECUtil.java:94)

我所做的唯一修改是将TLSv1.2添加到jdk.tls.disabledAgorithms=SSLv3，TLSv1.2中，因为NSS不支持TLSv1.2。

我能够在jre7u72构建中加载相同的内容，并且我看到sunpkcs11.jar在java8中进行了修改。这不应该是一个cacerts问题，因为我将java7的cacerts复制到了java8，但问题仍然存在。

以前有人看过这个问题吗？应该是java错误吗？

===编辑===

打开了一个java 8错误。我写了一个工具，成功地运行了jre7，但失败了jre8。

 import java.io.ByteArrayInputStream;
    import java.io.ByteArrayOutputStream;
    import java.io.FileInputStream;
    import java.io.IOException;
    import java.security.KeyStore;
    import java.security.Provider;
    import java.security.Security;
    import java.util.ArrayList;
    import java.util.Enumeration;
    import java.util.List;
    import java.util.Map;
    import java.util.Properties;
    import java.util.logging.Level;
    import java.util.logging.Logger;
    import sun.security.provider.Sun;
    import sun.security.rsa.SunRsaSign;
/**
 * Before running the tool run the following in your Linux box.
 * 
    1. export LD_LIBRARY_PATH=/usr/lib64
    2. mkdir /tmp/fips/nssdb
    3. modutil -create -dbdir /tmp/fips/nssdb/
    4. modutil -fips true -dbdir /tmp/fips/nssdb
    5. modutil -changepw "NSS FIPS 140-2 Certificate DB" -dbdir /tmp/fips/nssdb
      (Give a strong password like password1!)
 * @author [e-mail]
 *
 */
    public class TestKeyStoreFIPS {
        public static final String NSS_LIB_DIR_PROP = "nss.lib";
        public static final String NSS_DB_DIR_PROP = "nss.db";
        public static final String SUN_JSSE = "SunJSSE";
        public static List<String> disabledAlgs = new ArrayList<String>();
        private static final Logger logger = Logger.getLogger(TestKeyStoreFIPS.class.getName());
        /**
         * @param args
         */
        public static void main(String[] args) throws Exception{
            if(args.length != 2){
                System.out.println("Usage eg: java -Dnss.lib=/usr/lib64 -Dnss.db=/tmp/fips/nssdb  -Djavax.net.ssl.keyStorePassword=password1! TestKeyStoreFIPS /tmp/jre8/lib/security/cacerts changeit");
                System.exit(1);
            }
            enablePkcs11Jsse(System.getProperty(NSS_LIB_DIR_PROP), System.getProperty(NSS_DB_DIR_PROP));
            testFips();
            String file = args[0];
            char[] keystorePassword = args[1].toCharArray();
            FileInputStream keystoreStream = new FileInputStream(file);
            KeyStore keyStore = KeyStore.getInstance("JKS");
            keyStore.load(keystoreStream, keystorePassword);
            Enumeration<String> aliases = keyStore.aliases();
            while(aliases.hasMoreElements()){
                String alias = aliases.nextElement();
                System.out.println(alias + " : " + keyStore.getCertificate(alias).getType());
            }
        }
        private static void testFips(){
            String keyPass = System.getProperty("javax.net.ssl.keyStorePassword");      
            KeyStore store;
            try {
                store = KeyStore.getInstance("PKCS11");
                if (keyPass != null) {
                    store.load(null, keyPass.toCharArray());
                } else {
                    store.load(null, null);
                }
                System.out.println("FIPS test success");
            } catch (Throwable e) {
                e.printStackTrace();
                store = null;
                System.out.println("FIPS test failed");
            }                       
        }

        public static void enablePkcs11Jsse( String libDir, String dbDir) throws Exception {
            removeAllProviders();
            Provider nss = getNSSFIPSProvider( libDir, dbDir);
            removeDisabledAlgos(nss);       
            Security.insertProviderAt(nss, 1);
            Provider sunJsse = new com.sun.net.ssl.internal.ssl.Provider(nss);
            removeDisabledAlgos(sunJsse);
            Security.insertProviderAt(sunJsse,2);
            Sun sun = new Sun();
            removeDisabledAlgos(sun);       
            Security.insertProviderAt(sun,3);
            SunRsaSign sunrsa = new SunRsaSign();
            removeDisabledAlgos(sunrsa);
            Security.insertProviderAt(sunrsa,4);
        }   

       private static Provider getNSSFIPSProvider( String libDir, String dbDir) throws Exception {
           if(libDir == null || dbDir == null) {
               throw new Exception(NSS_LIB_DIR_PROP + " or " + NSS_DB_DIR_PROP + " not set.");
           }
           Properties props = new Properties();
           props.put("name", "NSSfips");
           props.put("nssLibraryDirectory", libDir);
           props.put("nssSecmodDirectory", dbDir);
           props.put("nssModule", "fips");
           props.put("nssDbMode", "readWrite");
           return createProvider(props);
       }
       private static Provider createProvider(Properties props) throws IOException {
           ByteArrayOutputStream out = new ByteArrayOutputStream();
           props.store(out, null);
           ByteArrayInputStream in = new ByteArrayInputStream(out.toByteArray());
           Provider ret = new sun.security.pkcs11.SunPKCS11(in);
           if (logger.isLoggable(Level.FINE)) {
               // Log all of the registered services
               for (Map.Entry<Object, Object> entry : ret.entrySet()) {
                   logger.log(Level.FINE, "{0} = {1}", new Object[]{entry.getKey(), entry.getValue()});
               }
           }
           return ret;
       }
       private static void removeAllProviders(){    
        Provider[] providers = Security.getProviders();
        for(Provider prov : providers){
            Security.removeProvider(prov.getName());
        }
       }
        private static void removeDisabledAlgos(Provider provider){     
            for(String alg : disabledAlgs){
                if(provider.getProperty(alg) != null){
                    logger.info("Removing algorithm " + alg + " from provider " + provider);
                    provider.remove(alg);
                }
            }
        }   
    }

Answer 1

当我探索其他选项时，一种行之有效的方法是将我的一个信任库复制为jre/lib/security/jssecacerts。我看到代码优先于jssecacerts而不是cacerts，目前运行良好。