On 12/08/2026 21:32, Mark Thomas wrote:
On 12/08/2026 20:35, Rémy Maucherat wrote:
On Wed, Aug 12, 2026 at 9:17 PM <[email protected]> wrote:
This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 5c989cdb5a Regenerate TLS certificates, keys etc
5c989cdb5a is described below
commit 5c989cdb5a8abdb23002760c868db02612f7ca64
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 12 20:16:45 2026 +0100
Regenerate TLS certificates, keys etc
I've been working on the script that generates these. Committing an
updated set to confirm that the tests still all past.
---
test/org/apache/tomcat/util/net/ca-cert.pem | 58 ++++----
test/org/apache/tomcat/util/net/ca.jks | Bin 1793 ->
1793 bytes
test/org/apache/tomcat/util/net/index.db | 14 +-
.../tomcat/util/net/localhost-crl-rsa-cert.pem | 150 ++++++++++
+----------
.../tomcat/util/net/localhost-crl-rsa-key.pem | 52 +++----
.../apache/tomcat/util/net/localhost-crl-rsa.jks | Bin 2737 ->
2771 bytes
.../apache/tomcat/util/net/localhost-ec-cert.pem | 119 +++++++
+--------
.../apache/tomcat/util/net/localhost-ec-key.pem | 13 +-
test/org/apache/tomcat/util/net/localhost-ec.jks | Bin 1424 ->
1459 bytes
.../apache/tomcat/util/net/localhost-rsa-cert.pem | 150 ++++++++++
+----------
.../apache/tomcat/util/net/localhost-rsa-copy1.jks | Bin 2735 ->
2771 bytes
.../apache/tomcat/util/net/localhost-rsa-key.pem | 52 +++----
test/org/apache/tomcat/util/net/localhost-rsa.jks | Bin 4480 ->
4516 bytes
.../tomcat/util/net/ocsp-responder-rsa-cert.pem | 146 +++++++++
+----------
.../tomcat/util/net/ocsp-responder-rsa-key.pem | 52 +++----
test/org/apache/tomcat/util/net/user1.jks | Bin 4460 ->
4496 bytes
test/org/apache/tomcat/util/net/user2-crl.jks | Bin 2715 ->
2752 bytes
test/org/apache/tomcat/util/net/user3-crl-long.jks | Bin 3035 ->
3036 bytes
18 files changed, 404 insertions(+), 402 deletions(-)
12-Aug-2026 21:34:26.231 SEVERE
[https-opensslffm-nio-127.0.0.1-auto-10-exec-3]
org.apache.tomcat.util.net.openssl.panama.OpenSSLEngine.processOCSP
Error parsing OCSP URLs
java.lang.IllegalArgumentException: Invalid length [33] bytes reported
when the input data length is [68] bytes
at
org.apache.tomcat.util.buf.Asn1Parser.parseFullLength(Asn1Parser.java:149)
at
org.apache.tomcat.util.net.openssl.panama.OpenSSLEngine.parseOCSPURLs(OpenSSLEngine.java:1284)
So the OCSP URLs might not be correct anymore.
I was sure I ran the 12.0.x tests before committing these changes. I
must have missed something.
The issue is the new certs included 2 OCSP responder URLs rather than 1
and that broke the parsing. I just need to check of the 2 URLs is
expected or if I left in an unwanted local change. I should have this
fixed one way or the other in the next 15 mins.
The switch to multiple responder URLs was deliberate (March this year).
However the certs weren't updated to take account of that (my fault) so
the tests didn't pick up that Tomcat's parser only accepts a single cert.
I've fixed the parser locally. I am just running the unit tests to
confirm the fix then I'll commit and back-port.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
