[AMQ-7142] Inserting Bouncy Castle Provider Early in Java Security Provider Chain Breaks KeyStore Loading

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 5.15.2
• Fix Version/s: 5.16.0, 5.15.12
• Component/s: Camel

Environment

OpenJDK 11 (AdoptOpenJDK).

Mac OS

• Assignee: Colm O hEigeartaigh
• Reporter: Nathan Hook
• Created: 28/Jan/19 18:07
• Updated: 27/Jan/20 12:43
• Resolved: 27/Jan/20 12:43

Description

The insertion of the Bouncy Castle Provider in the org.apache.activemq.broker.BrokerService class is causing issues with our app that expecting one of the default SunJCE Ciphers to be called, but a Bouncy Castle Cipher is returned instead.

This causes our Spring Security SAML keystores to not be loaded correctly because the Bouncy Castle Cipher thinks that the keystore was tampered with.

 

I believe that the source of the problem is this line in the BrokerService class:

Security.insertProviderAt(bouncycastle, Integer.getInteger("org.apache.activemq.broker.BouncyCastlePosition", 2));

Looking at the Java 11 source code there are 6 providers installed by the java.security.Security class in the initializeStatic method:

private static void initializeStatic() {
 props.put("security.provider.1", "sun.security.provider.Sun");
 props.put("security.provider.2", "sun.security.rsa.SunRsaSign");
 props.put("security.provider.3", "com.sun.net.ssl.internal.ssl.Provider");
 props.put("security.provider.4", "com.sun.crypto.provider.SunJCE");
 props.put("security.provider.5", "sun.security.jgss.SunProvider");
 props.put("security.provider.6", "com.sun.security.sasl.Provider");
}

 

If possible it would be great if the org.apache.activemq.broker.BrokerService class would call 

addProvider instead of insertProviderAt.

 

Thank you for your time.

Issue Links

• links to: GitHub Pull Request #431