On Fri, 21 Jan 2022 03:34:24 GMT, Hai-May Chao <hc...@openjdk.org> wrote:
>> `keytool` currently uses a simpler scheme in `DisabledAlgorithmConstraints`
>> class when performing algorithm constraints checks. This change is to
>> enhance `keytool` to make use of the new methods
>> `DisabledAlgorithmConstraints.permits` with `CertPathConstraintsParameters`
>> and `checkKey` parameters. For the keyusage in the EE certificate of a
>> certificate chains, set the variant accordingly when calling
>> `CertPathConstraintsParameters` constructor.
>
> Hai-May Chao has updated the pull request incrementally with one additional
> commit since the last revision:
>
> Update with review comments
src/java.base/share/classes/sun/security/tools/keytool/Main.java line 4908:
> 4906: if (eMessage.contains("denyAfter constraint check
> failed") &&
> 4907: e.getReason() ==
> BasicReason.ALGORITHM_CONSTRAINED) {
> 4908: String separator = "java.security: ";
Did you consider extracting the date from the security property? Ex:
`Security.getProperty("jdk.certpath.disabledAlgorithms")`? I think that would
be a better solution instead of parsing the exception message, which might
change in the future.
-------------
PR: https://git.openjdk.java.net/jdk/pull/7039
