src/java.base/share/classes/sun/security/tools/keytool/Main.java

rev 51972 : 8215694: keytool cannot generate RSASSA-PSS certificates
Reviewed-by: xuelei
rev 51973 : 8215694 resolve

*** 1,7 ****
  /*
!  * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   *
   * This code is free software; you can redistribute it and/or modify it
   * under the terms of the GNU General Public License version 2 only, as
   * published by the Free Software Foundation.  Oracle designates this
--- 1,7 ----
  /*
!  * Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
   * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   *
   * This code is free software; you can redistribute it and/or modify it
   * under the terms of the GNU General Public License version 2 only, as
   * published by the Free Software Foundation.  Oracle designates this
*** 47,57 ****
  import java.security.cert.CRL;
  import java.security.cert.X509Certificate;
  import java.security.cert.CertificateException;
  import java.security.cert.URICertStoreParameters;
  
! 
  import java.text.Collator;
  import java.text.MessageFormat;
  import java.util.*;
  import java.util.jar.JarEntry;
  import java.util.jar.JarFile;
--- 47,57 ----
  import java.security.cert.CRL;
  import java.security.cert.X509Certificate;
  import java.security.cert.CertificateException;
  import java.security.cert.URICertStoreParameters;
  
! import java.security.spec.AlgorithmParameterSpec;
  import java.text.Collator;
  import java.text.MessageFormat;
  import java.util.*;
  import java.util.jar.JarEntry;
  import java.util.jar.JarFile;
*** 1407,1424 ****
          }
          Signature signature = Signature.getInstance(sigAlgName);
          signature.initSign(privateKey);
  
          X509CertInfo info = new X509CertInfo();
          info.set(X509CertInfo.VALIDITY, interval);
          info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(
                      new java.util.Random().nextInt() & 0x7fffffff));
          info.set(X509CertInfo.VERSION,
                      new CertificateVersion(CertificateVersion.V3));
          info.set(X509CertInfo.ALGORITHM_ID,
!                     new CertificateAlgorithmId(
!                         AlgorithmId.get(sigAlgName)));
          info.set(X509CertInfo.ISSUER, issuer);
  
          BufferedReader reader = new BufferedReader(new InputStreamReader(in));
          boolean canRead = false;
          StringBuffer sb = new StringBuffer();
--- 1407,1426 ----
          }
          Signature signature = Signature.getInstance(sigAlgName);
          signature.initSign(privateKey);
  
          X509CertInfo info = new X509CertInfo();
+         AlgorithmParameterSpec params = AlgorithmId
+                 .getDefaultAlgorithmParameterSpec(sigAlgName, privateKey);
+         AlgorithmId algID = AlgorithmId.getWithParameterSpec(sigAlgName, params);
          info.set(X509CertInfo.VALIDITY, interval);
          info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(
                      new java.util.Random().nextInt() & 0x7fffffff));
          info.set(X509CertInfo.VERSION,
                      new CertificateVersion(CertificateVersion.V3));
          info.set(X509CertInfo.ALGORITHM_ID,
!                     new CertificateAlgorithmId(algID));
          info.set(X509CertInfo.ISSUER, issuer);
  
          BufferedReader reader = new BufferedReader(new InputStreamReader(in));
          boolean canRead = false;
          StringBuffer sb = new StringBuffer();
*** 1458,1468 ****
                  v3ext,
                  req.getSubjectPublicKeyInfo(),
                  signerCert.getPublicKey());
          info.set(X509CertInfo.EXTENSIONS, ext);
          X509CertImpl cert = new X509CertImpl(info);
!         cert.sign(privateKey, sigAlgName);
          dumpCert(cert, out);
          for (Certificate ca: keyStore.getCertificateChain(alias)) {
              if (ca instanceof X509Certificate) {
                  X509Certificate xca = (X509Certificate)ca;
                  if (!KeyStoreUtil.isSelfSigned(xca)) {
--- 1460,1470 ----
                  v3ext,
                  req.getSubjectPublicKeyInfo(),
                  signerCert.getPublicKey());
          info.set(X509CertInfo.EXTENSIONS, ext);
          X509CertImpl cert = new X509CertImpl(info);
!         cert.sign(privateKey, params, sigAlgName, null);
          dumpCert(cert, out);
          for (Certificate ca: keyStore.getCertificateChain(alias)) {
              if (ca instanceof X509Certificate) {
                  X509Certificate xca = (X509Certificate)ca;
                  if (!KeyStoreUtil.isSelfSigned(xca)) {
*** 1561,1570 ****
--- 1563,1578 ----
              sigAlgName = getCompatibleSigAlgName(privKey);
          }
  
          Signature signature = Signature.getInstance(sigAlgName);
          signature.initSign(privKey);
+         AlgorithmParameterSpec params = AlgorithmId
+                 .getDefaultAlgorithmParameterSpec(sigAlgName, privKey);
+         if (params != null) {
+             signature.setParameter(params);
+         }
+ 
          X500Name subject = dname == null?
                  new X500Name(((X509Certificate)cert).getSubjectDN().toString()):
                  new X500Name(dname);
  
          // Sign the request and base-64 encode it
*** 2864,2874 ****
          // The inner and outer signature algorithms have to match.
          // The way we achieve that is really ugly, but there seems to be no
          // other solution: We first sign the cert, then retrieve the
          // outer sigalg and use it to set the inner sigalg
          X509CertImpl newCert = new X509CertImpl(certInfo);
!         newCert.sign(privKey, sigAlgName);
          AlgorithmId sigAlgid = (AlgorithmId)newCert.get(X509CertImpl.SIG_ALG);
          certInfo.set(CertificateAlgorithmId.NAME + "." +
                       CertificateAlgorithmId.ALGORITHM, sigAlgid);
  
          certInfo.set(X509CertInfo.VERSION,
--- 2872,2884 ----
          // The inner and outer signature algorithms have to match.
          // The way we achieve that is really ugly, but there seems to be no
          // other solution: We first sign the cert, then retrieve the
          // outer sigalg and use it to set the inner sigalg
          X509CertImpl newCert = new X509CertImpl(certInfo);
!         AlgorithmParameterSpec params = AlgorithmId
!                 .getDefaultAlgorithmParameterSpec(sigAlgName, privKey);
!         newCert.sign(privKey, params, sigAlgName, null);
          AlgorithmId sigAlgid = (AlgorithmId)newCert.get(X509CertImpl.SIG_ALG);
          certInfo.set(CertificateAlgorithmId.NAME + "." +
                       CertificateAlgorithmId.ALGORITHM, sigAlgid);
  
          certInfo.set(X509CertInfo.VERSION,
*** 2881,2891 ****
                  oldCert.getPublicKey(),
                  null);
          certInfo.set(X509CertInfo.EXTENSIONS, ext);
          // Sign the new certificate
          newCert = new X509CertImpl(certInfo);
!         newCert.sign(privKey, sigAlgName);
  
          // Store the new certificate as a single-element certificate chain
          keyStore.setKeyEntry(alias, privKey,
                               (keyPass != null) ? keyPass : storePass,
                               new Certificate[] { newCert } );
--- 2891,2901 ----
                  oldCert.getPublicKey(),
                  null);
          certInfo.set(X509CertInfo.EXTENSIONS, ext);
          // Sign the new certificate
          newCert = new X509CertImpl(certInfo);
!         newCert.sign(privKey, params, sigAlgName, null);
  
          // Store the new certificate as a single-element certificate chain
          keyStore.setKeyEntry(alias, privKey,
                               (keyPass != null) ? keyPass : storePass,
                               new Certificate[] { newCert } );