Re: (tomcat) branch main updated: Regenerate TLS certificates, keys etc

On 12/08/2026 21:32, Mark Thomas wrote:
> On 12/08/2026 20:35, Rémy Maucherat wrote:
>> On Wed, Aug 12, 2026 at 9:17 PM <[email protected]> wrote:
>>>
>>> This is an automated email from the ASF dual-hosted git repository.
>>>
>>> markt-asf pushed a commit to branch main
>>> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>>>
>>>
>>> The following commit(s) were added to refs/heads/main by this push:
>>>       new 5c989cdb5a Regenerate TLS certificates, keys etc
>>> 5c989cdb5a is described below
>>>
>>> commit 5c989cdb5a8abdb23002760c868db02612f7ca64
>>> Author: Mark Thomas <[email protected]>
>>> AuthorDate: Wed Aug 12 20:16:45 2026 +0100
>>>
>>>      Regenerate TLS certificates, keys etc
>>>
>>>      I've been working on the script that generates these. Committing an
>>>      updated set to confirm that the tests still all past.
>>> ---
>>>   test/org/apache/tomcat/util/net/ca-cert.pem        |  58 ++++----
>>>   test/org/apache/tomcat/util/net/ca.jks             | Bin 1793 -> 
>>> 1793 bytes
>>>   test/org/apache/tomcat/util/net/index.db           |  14 +-
>>>   .../tomcat/util/net/localhost-crl-rsa-cert.pem     | 150 ++++++++++ 
>>> +----------
>>>   .../tomcat/util/net/localhost-crl-rsa-key.pem      |  52 +++----
>>>   .../apache/tomcat/util/net/localhost-crl-rsa.jks   | Bin 2737 -> 
>>> 2771 bytes
>>>   .../apache/tomcat/util/net/localhost-ec-cert.pem   | 119 +++++++ 
>>> +--------
>>>   .../apache/tomcat/util/net/localhost-ec-key.pem    |  13 +-
>>>   test/org/apache/tomcat/util/net/localhost-ec.jks   | Bin 1424 -> 
>>> 1459 bytes
>>>   .../apache/tomcat/util/net/localhost-rsa-cert.pem  | 150 ++++++++++ 
>>> +----------
>>>   .../apache/tomcat/util/net/localhost-rsa-copy1.jks | Bin 2735 -> 
>>> 2771 bytes
>>>   .../apache/tomcat/util/net/localhost-rsa-key.pem   |  52 +++----
>>>   test/org/apache/tomcat/util/net/localhost-rsa.jks  | Bin 4480 -> 
>>> 4516 bytes
>>>   .../tomcat/util/net/ocsp-responder-rsa-cert.pem    | 146 +++++++++ 
>>> +----------
>>>   .../tomcat/util/net/ocsp-responder-rsa-key.pem     |  52 +++----
>>>   test/org/apache/tomcat/util/net/user1.jks          | Bin 4460 -> 
>>> 4496 bytes
>>>   test/org/apache/tomcat/util/net/user2-crl.jks      | Bin 2715 -> 
>>> 2752 bytes
>>>   test/org/apache/tomcat/util/net/user3-crl-long.jks | Bin 3035 -> 
>>> 3036 bytes
>>>   18 files changed, 404 insertions(+), 402 deletions(-)
>>
>> 12-Aug-2026 21:34:26.231 SEVERE
>> [https-opensslffm-nio-127.0.0.1-auto-10-exec-3]
>> org.apache.tomcat.util.net.openssl.panama.OpenSSLEngine.processOCSP
>> Error parsing OCSP URLs
>> java.lang.IllegalArgumentException: Invalid length [33] bytes reported
>> when the input data length is [68] bytes
>> at 
>> org.apache.tomcat.util.buf.Asn1Parser.parseFullLength(Asn1Parser.java:149)
>> at 
>> org.apache.tomcat.util.net.openssl.panama.OpenSSLEngine.parseOCSPURLs(OpenSSLEngine.java:1284)
>>
>> So the OCSP URLs might not be correct anymore.
> 
> I was sure I ran the 12.0.x tests before committing these changes. I 
> must have missed something.
> 
> The issue is the new certs included 2 OCSP responder URLs rather than 1 
> and that broke the parsing. I just need to check of the 2 URLs is 
> expected or if I left in an unwanted local change. I should have this 
> fixed one way or the other in the next 15 mins.

The switch to multiple responder URLs was deliberate (March this year). 
However the certs weren't updated to take account of that (my fault) so 
the tests didn't pick up that Tomcat's parser only accepts a single cert.

I've fixed the parser locally. I am just running the unit tests to 
confirm the fix then I'll commit and back-port.

Mark