[LOG4J2-3578] TlsSyslogAppenderTest fails because of expired certificate

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.18.0
• Fix Version/s: 2.19.0
• Component/s: Tests
• Assignee: Ralph Goers
• Reporter: Wolff Bock von Wuelfingen
• Created: 18/Aug/22 21:53
• Updated: 06/Sep/22 17:45
• Resolved: 22/Aug/22 18:00

Description

Running the Test by itself reveals the following cause for sendLargeLegacyBsdMessageOverTls(), sendLegacyBsdMessagesOverTls(), }}{{sendStructuredMessageOverTls(), sendStructuredMessagesOverTls()  failing:

Caused by: java.security.cert.CertPathValidatorException: validity check failed
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:220)
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140)
    at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79)
    at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292)
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:381)
    ... 75 more
Caused by: java.security.cert.CertificateExpiredException: NotAfter: Fri Aug 05 17:00:53 CEST 2022
    at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:277)
    at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:677)
    at sun.security.provider.certpath.BasicChecker.verifyValidity(BasicChecker.java:190)
    at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144)
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
    ... 80 more 

Looking at the certificate confirms this:

 

  Validity: [From: Wed Aug 07 17:00:53 CEST 2013,
               To: Fri Aug 05 17:00:53 CEST 2022] 

By overriding the checked Date inside at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:677) with the debugger i can make all tests pass under Windows.

I think the certificate at fault is one of those in resources/org/apache/logging/log4j/core/net/ssl

I'm unfortunately not versed enough to make a new certificate with a new expiration date.