JavaTM Cryptography Extension (JCE) 1.2.1

Known Bugs

1. The JCE Code Signing CA uses Netscape CMS 4.1 to import Certificate Signing Requests (CSRs) from users and generate code-signing certificates that the users can utilize to sign their providers or exempt applications. The CSRs generated by keytool are in the PKCS#10 format. A bug in Netscape CMS 4.1 causes it to be unable to import a PKCS#10 request if it is directed to generate an object (code) signing certificate. But it can import a PKCS#10 request if it is directed to generate an SSL server certificate. This problem is expected to be fixed in Netscape CMS 4.2.

   Workaround: The JCE Code Signing CA will issue SSL server certificates for code signing for now. It will be able to issue object signing certificates once we upgrade to Netscape CMS 4.2 after it becomes generally available.

2. Due to a bug in the JavaTM 2 SDK, you must have the "SUN" provider as the first security provider when loading a signed JAR file.

   Since the JCE 1.2.1 framework and JCE providers are signed JAR files, the "SUN" provider must be the first security provider when using JCE 1.2.1.

   Please note: This is the default. That is, in the JavaTM 2 SDK, the "SUN" provider is automatically configured as a static provider with preference order 1 in the security properties file.

3. Due to a bug in the JavaTM 2 SDK, sometimes you may get a NullPointerException from java.util.jar.JarVerifier.processEntry() if a JCE 1.2.1 provider (which is signed) is registered both statically and dynamically and a security manager is installed on the command line.

   There are two possible workarounds:

   1. Register a JCE 1.2.1 provider statically or dynamically, but do not register it both statically and dynamically. If you register a provider just one way or the other there is no problem installing a security manager on the command line.

   2. Install the security manager in your code instead of installing it on the command line. Then it doesn't matter how you register a JCE 1.2.1 provider.

4. Due to a bug in the JavaTM 2 SDK, if JCE 1.2.1 has been installed as an "installed" extension, then the SealedObject class can only unseal objects that are either a part of the Java 2 SDK or part of an installed extension. It cannot unseal other objects.

   Workaround: Have both the JCE 1.2.1 framework and JCE providers on the class path instead of having them be installed extensions. The jurisdiction policy files must be in the same directory as that which contains the JCE 1.2.1 framework JAR file. Also make sure that sufficient permissions are granted to the JCE 1.2.1 framework and JCE providers.