Skip to content

Commit c328f95

Browse files
blperez01seanjmullan
blperez01
authored and
seanjmullan
committedDec 14, 2023
8296787: Unify debug printing format of X.509 cert serial numbers
Reviewed-by: mullan, coffeys
·
jdk-25+17jdk-23-ga
1 parent fde5b16 commit c328f95

18 files changed

+62
-46
lines changed
 

‎src/java.base/share/classes/java/security/cert/X509CertSelector.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -1929,10 +1929,10 @@ public boolean match(Certificate cert) {
19291929
}
19301930

19311931
if (debug != null) {
1932-
debug.println("X509CertSelector.match(SN: "
1933-
+ (xcert.getSerialNumber()).toString(16) + "\n Issuer: "
1934-
+ xcert.getIssuerX500Principal() + "\n Subject: " + xcert.getSubjectX500Principal()
1935-
+ ")");
1932+
debug.println("X509CertSelector.match(Serial number: "
1933+
+ Debug.toString(xcert.getSerialNumber())
1934+
+ "\n Issuer: " + xcert.getIssuerX500Principal() + "\n Subject: "
1935+
+ xcert.getSubjectX500Principal() + ")");
19361936
}
19371937

19381938
/* match on X509Certificate */

‎src/java.base/share/classes/sun/security/jca/JCAUtil.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -33,6 +33,7 @@
3333
import jdk.internal.event.EventHelper;
3434
import jdk.internal.event.X509CertificateEvent;
3535
import sun.security.util.KeyUtil;
36+
import sun.security.util.Debug;
3637

3738
/**
3839
* Collection of static utility methods used by the security framework.
@@ -104,7 +105,7 @@ public static void tryCommitCertEvent(Certificate cert) {
104105
(cert instanceof X509Certificate x509)) {
105106
PublicKey pKey = x509.getPublicKey();
106107
String algId = x509.getSigAlgName();
107-
String serNum = x509.getSerialNumber().toString(16);
108+
String serNum = Debug.toString(x509.getSerialNumber());
108109
String subject = x509.getSubjectX500Principal().toString();
109110
String issuer = x509.getIssuerX500Principal().toString();
110111
String keyType = pKey.getAlgorithm();

‎src/java.base/share/classes/sun/security/pkcs/SignerInfo.java

+4-3
Original file line numberDiff line numberDiff line change
@@ -708,14 +708,15 @@ private void verifyTimestamp(TimestampToken token)
708708
md.digest(encryptedDigest))) {
709709

710710
throw new SignatureException("Signature timestamp (#" +
711-
token.getSerialNumber() + ") generated on " + token.getDate() +
712-
" is inapplicable");
711+
Debug.toString(token.getSerialNumber()) +
712+
") generated on " + token.getDate() + " is inapplicable");
713713
}
714714

715715
if (debug != null) {
716716
debug.println();
717717
debug.println("Detected signature timestamp (#" +
718-
token.getSerialNumber() + ") generated on " + token.getDate());
718+
Debug.toString(token.getSerialNumber()) +
719+
") generated on " + token.getDate());
719720
debug.println();
720721
}
721722
}

‎src/java.base/share/classes/sun/security/provider/certpath/BasicChecker.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -244,7 +244,7 @@ private void updateState(X509Certificate currCert)
244244
debug.println("BasicChecker.updateState issuer: " +
245245
currCert.getIssuerX500Principal().toString() + "; subject: " +
246246
currCert.getSubjectX500Principal() + "; serial#: " +
247-
currCert.getSerialNumber().toString());
247+
Debug.toString(currCert.getSerialNumber()));
248248
}
249249
if (PKIX.isDSAPublicKeyWithoutParams(cKey)) {
250250
// cKey needs to inherit DSA parameters from prev key

‎src/java.base/share/classes/sun/security/provider/certpath/Builder.java

+1-2
Original file line numberDiff line numberDiff line change
@@ -429,8 +429,7 @@ boolean addMatchingCerts(X509CertSelector selector,
429429
if (debug != null) {
430430
debug.println("Builder.addMatchingCerts: " +
431431
"adding target cert" +
432-
"\n SN: " + Debug.toHexString(
433-
targetCert.getSerialNumber()) +
432+
"\n SN: " + Debug.toString(targetCert.getSerialNumber()) +
434433
"\n Subject: " + targetCert.getSubjectX500Principal() +
435434
"\n Issuer: " + targetCert.getIssuerX500Principal());
436435
}

‎src/java.base/share/classes/sun/security/provider/certpath/CertId.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ public CertId(X500Principal issuerName, PublicKey issuerKey,
108108
encoder.encodeBuffer(issuerNameHash));
109109
System.out.println("issuerKeyHash is " +
110110
encoder.encodeBuffer(issuerKeyHash));
111-
System.out.println("SerialNumber is " + serialNumber.getNumber());
111+
System.out.println("SerialNumber is " + Debug.toString(serialNumber.getNumber()));
112112
}
113113
}
114114

‎src/java.base/share/classes/sun/security/provider/certpath/DistributionPointFetcher.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -314,7 +314,7 @@ static boolean verifyCRL(X509CertImpl certImpl, DistributionPoint point,
314314
if (debug != null) {
315315
debug.println("DistributionPointFetcher.verifyCRL: " +
316316
"checking revocation status for" +
317-
"\n SN: " + Debug.toHexString(certImpl.getSerialNumber()) +
317+
"\n SN: " + Debug.toString(certImpl.getSerialNumber()) +
318318
"\n Subject: " + certImpl.getSubjectX500Principal() +
319319
"\n Issuer: " + certImpl.getIssuerX500Principal());
320320
}

‎src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ private void getMatchingCACerts(ForwardState currentState,
279279
debug.println("ForwardBuilder.getMatchingCACerts: " +
280280
"found matching trust anchor." +
281281
"\n SN: " +
282-
Debug.toHexString(trustedCert.getSerialNumber()) +
282+
Debug.toString(trustedCert.getSerialNumber()) +
283283
"\n Subject: " +
284284
trustedCert.getSubjectX500Principal() +
285285
"\n Issuer: " +
@@ -678,7 +678,7 @@ void verifyCert(X509Certificate cert, State currentState,
678678
{
679679
if (debug != null) {
680680
debug.println("ForwardBuilder.verifyCert(SN: "
681-
+ Debug.toHexString(cert.getSerialNumber())
681+
+ Debug.toString(cert.getSerialNumber())
682682
+ "\n Issuer: " + cert.getIssuerX500Principal() + ")"
683683
+ "\n Subject: " + cert.getSubjectX500Principal() + ")");
684684
}

‎src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -405,7 +405,8 @@ void verify(List<CertId> certIds, IssuerInfo issuerInfo,
405405
}
406406
if (debug != null) {
407407
debug.println("Status of certificate (with serial number " +
408-
certId.getSerialNumber() + ") is: " + sr.getCertStatus());
408+
Debug.toString(certId.getSerialNumber()) +
409+
") is: " + sr.getCertStatus());
409410
}
410411
}
411412

‎src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2012, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2012, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -351,7 +351,7 @@ private void check(X509Certificate xcert,
351351
{
352352
if (debug != null) {
353353
debug.println("RevocationChecker.check: checking cert" +
354-
"\n SN: " + Debug.toHexString(xcert.getSerialNumber()) +
354+
"\n SN: " + Debug.toString(xcert.getSerialNumber()) +
355355
"\n Subject: " + xcert.getSubjectX500Principal() +
356356
"\n Issuer: " + xcert.getIssuerX500Principal());
357357
}
@@ -642,7 +642,7 @@ private void checkApprovedCRLs(X509Certificate cert,
642642
debug.println("RevocationChecker.checkApprovedCRLs() " +
643643
"starting the final sweep...");
644644
debug.println("RevocationChecker.checkApprovedCRLs()" +
645-
" cert SN: " + sn.toString());
645+
" cert SN: " + Debug.toString(sn));
646646
}
647647

648648
CRLReason reasonCode = CRLReason.UNSPECIFIED;

‎src/java.base/share/classes/sun/security/provider/certpath/Vertex.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -149,7 +149,7 @@ public String certToString() {
149149
sb.append("Subject: ").append
150150
(x509Cert.getSubjectX500Principal()).append("\n");
151151
sb.append("SerialNum: ").append
152-
(x509Cert.getSerialNumber().toString(16)).append("\n");
152+
(Debug.toString(x509Cert.getSerialNumber())).append("\n");
153153
sb.append("Expires: ").append
154154
(x509Cert.getNotAfter().toString()).append("\n");
155155
boolean[] iUID = x509Cert.getIssuerUniqueID();

‎src/java.base/share/classes/sun/security/ssl/SSLLogger.java

+4-5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -43,6 +43,7 @@
4343

4444
import sun.security.action.GetPropertyAction;
4545
import sun.security.util.HexDumpEncoder;
46+
import sun.security.util.Debug;
4647
import sun.security.x509.*;
4748

4849
import static java.nio.charset.StandardCharsets.UTF_8;
@@ -485,8 +486,7 @@ private static String formatCertificate(Certificate certificate) {
485486
if (certExts == null) {
486487
Object[] certFields = {
487488
x509.getVersion(),
488-
Utilities.toHexString(
489-
x509.getSerialNumber().toByteArray()),
489+
Debug.toString(x509.getSerialNumber()),
490490
x509.getSigAlgName(),
491491
x509.getIssuerX500Principal().toString(),
492492
dateTimeFormat.format(x509.getNotBefore().toInstant()),
@@ -510,8 +510,7 @@ private static String formatCertificate(Certificate certificate) {
510510
}
511511
Object[] certFields = {
512512
x509.getVersion(),
513-
Utilities.toHexString(
514-
x509.getSerialNumber().toByteArray()),
513+
Debug.toString(x509.getSerialNumber()),
515514
x509.getSigAlgName(),
516515
x509.getIssuerX500Principal().toString(),
517516
dateTimeFormat.format(x509.getNotBefore().toInstant()),

‎src/java.base/share/classes/sun/security/ssl/StatusResponseManager.java

+8-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -41,6 +41,7 @@
4141
import sun.security.provider.certpath.ResponderId;
4242
import sun.security.ssl.X509Authentication.X509Possession;
4343
import sun.security.util.Cache;
44+
import sun.security.util.Debug;
4445
import sun.security.x509.PKIXExtensions;
4546
import sun.security.x509.SerialNumber;
4647
import static sun.security.ssl.CertStatusExtension.*;
@@ -324,8 +325,8 @@ private ResponseCacheEntry getFromCache(CertId cid,
324325

325326
if (SSLLogger.isOn && SSLLogger.isOn("respmgr")) {
326327
SSLLogger.fine(
327-
"Check cache for SN" + cid.getSerialNumber() + ": " +
328-
(respEntry != null ? "HIT" : "MISS"));
328+
"Check cache for SN" + Debug.toString(cid.getSerialNumber())
329+
+ ": " + (respEntry != null ? "HIT" : "MISS"));
329330
}
330331
return respEntry;
331332
}
@@ -391,7 +392,7 @@ class StatusInfo {
391392
public String toString() {
392393
return "StatusInfo:" + "\n\tCert: " +
393394
this.cert.getSubjectX500Principal() +
394-
"\n\tSerial: " + this.cert.getSerialNumber() +
395+
"\n\tSerial: " + Debug.toString(this.cert.getSerialNumber()) +
395396
"\n\tResponder: " + this.responder +
396397
"\n\tResponse data: " +
397398
(this.responseData != null ?
@@ -437,7 +438,7 @@ static class ResponseCacheEntry {
437438
} else {
438439
throw new IOException(
439440
"Unable to find SingleResponse for SN " +
440-
cid.getSerialNumber());
441+
Debug.toString(cid.getSerialNumber()));
441442
}
442443
} else {
443444
nextUpdate = null;
@@ -488,7 +489,7 @@ public StatusInfo call() {
488489
if (SSLLogger.isOn && SSLLogger.isOn("respmgr")) {
489490
SSLLogger.fine(
490491
"Starting fetch for SN " +
491-
statInfo.cid.getSerialNumber());
492+
Debug.toString(statInfo.cid.getSerialNumber()));
492493
}
493494
try {
494495
ResponseCacheEntry cacheEntry;
@@ -573,7 +574,7 @@ private void addToCache(CertId certId, ResponseCacheEntry entry) {
573574
if (SSLLogger.isOn && SSLLogger.isOn("respmgr")) {
574575
SSLLogger.fine(
575576
"Added response for SN " +
576-
certId.getSerialNumber() +
577+
Debug.toString(certId.getSerialNumber()) +
577578
" to cache");
578579
}
579580
}

‎src/java.base/share/classes/sun/security/util/Debug.java

+4
Original file line numberDiff line numberDiff line change
@@ -333,4 +333,8 @@ public static String toString(byte[] b) {
333333
return HexFormat.ofDelimiter(":").formatHex(b);
334334
}
335335

336+
public static String toString(BigInteger b) {
337+
return toString(b.toByteArray());
338+
}
339+
336340
}

‎src/java.base/share/classes/sun/security/x509/SerialNumber.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -27,6 +27,7 @@
2727
import java.io.IOException;
2828
import java.io.InputStream;
2929
import java.math.BigInteger;
30+
import java.util.HexFormat;
3031

3132
import sun.security.util.*;
3233

@@ -101,7 +102,7 @@ public SerialNumber(InputStream in) throws IOException {
101102
* Return the SerialNumber as user readable string.
102103
*/
103104
public String toString() {
104-
return "SerialNumber: [" + Debug.toHexString(serialNum) + ']';
105+
return "SerialNumber: " + Debug.toString(serialNum);
105106
}
106107

107108
/**

‎test/jdk/java/security/cert/X509CertSelectorTest.java

+11-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -60,10 +60,11 @@
6060
import sun.security.x509.PrivateKeyUsageExtension;
6161
import sun.security.x509.SubjectAlternativeNameExtension;
6262
import sun.security.x509.X500Name;
63+
import sun.security.util.Debug;
6364

6465
/*
6566
* @test
66-
* @bug 8074931
67+
* @bug 8074931 8296787
6768
* @summary This class tests the X509CertSelector. The tests check particular criteria
6869
* by setting them to a value that should match our test certificate and
6970
* ensuring that they do match, then setting them to a value that should not
@@ -191,6 +192,14 @@ private void testSerialNumber() {
191192
// good match
192193
selector.setSerialNumber(cert.getSerialNumber());
193194
checkMatch(selector, cert, true);
195+
196+
// check serial number format
197+
String serialNum = Debug.toString(selector.getSerialNumber());
198+
String expected = "38:df:82:b8";
199+
if (!serialNum.equals(expected)) {
200+
throw new RuntimeException("Serial number toString format is incorrect. Got: "
201+
+ serialNum + " Expected: " + expected);
202+
}
194203
}
195204

196205
// Tests matching on the issuer name contained in the certificate.

‎test/lib/jdk/test/lib/security/TestCertificate.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -45,7 +45,7 @@ public enum TestCertificate {
4545
// Subject: CN=SSLCertificate, O=SomeCompany
4646
// Issuer: CN=Intermediate CA Cert, O=SomeCompany
4747
// Validity: Tue Aug 30 14:37:19 PDT 2016 to Wed Aug 30 14:37:19 PDT 2017
48-
ONE("1000",
48+
ONE("10:00",
4949
"CN=SSLCertificate, O=SomeCompany",
5050
"CN=Intermediate CA Cert, O=SomeCompany",
5151
-1063259762,

‎test/lib/jdk/test/lib/security/TestTLSHandshake.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -35,8 +35,8 @@ public final class TestTLSHandshake extends SSLSocketTest {
3535
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384";
3636
public static final long CERT_ID = Integer.toUnsignedLong(-1057291798);
3737
public static final long ANCHOR_CERT_ID = Integer.toUnsignedLong(1688661792);
38-
public static final String CERT_SERIAL = "edbec8f705af2514";
39-
public static final String ANCHOR_CERT_SERIAL = "8e191778b2f331be";
38+
public static final String CERT_SERIAL = "00:ed:be:c8:f7:05:af:25:14";
39+
public static final String ANCHOR_CERT_SERIAL = "8e:19:17:78:b2:f3:31:be";
4040

4141
public String protocolVersion;
4242
public String peerHost;

0 commit comments

Comments
 (0)
Please sign in to comment.