[CI] RestrictedTrustManagerTests fails

[vladimirdolzhenko]

05:21:48   1> [2561-08-23T01:21:48,454][INFO ][o.e.x.c.s.RestrictedTrustManagerTests] [testTrustsExplicitCertificateName] after test
05:21:48 FAILURE 0.02s J3 | RestrictedTrustManagerTests.testTrustsExplicitCertificateName <<< FAILURES!
05:21:48    > Throwable #1: java.lang.AssertionError: 
05:21:48    > Expected: matches pattern .* does not match the trusted names \[.*\Qnode1.cluster2.elasticsearch\E.*
05:21:48    >      but: was "PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not validate certificate: certificate expired on 20450904132213GMT+00:00"
05:21:48    > 	at __randomizedtesting.SeedInfo.seed([ABE170715C771857:FEEF70CFF99E93A2]:0)
05:21:48    > 	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
05:21:48    > 	at org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests.assertNotValid(RestrictedTrustManagerTests.java:175)
05:21:48    > 	at org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests.assertNotTrusted(RestrictedTrustManagerTests.java:166)
05:21:48    > 	at org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests.assertSingleClusterIsTrusted(RestrictedTrustManagerTests.java:148)
05:21:48    > 	at org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests.testTrustsExplicitCertificateName(RestrictedTrustManagerTests.java:99)
05:21:48    > 	at java.lang.Thread.run(Thread.java:748)
05:21:48   1> [2561-08-23T01:21:48,455][INFO ][o.e.x.c.s.RestrictedTrustManagerTests] [testThatDelegateTrustManagerIsRespected] before test
05:21:48   1> [2561-08-23T01:21:48,479][INFO ][o.e.x.c.s.RestrictedTrustManagerTests] [testThatDelegateTrustManagerIsRespected] after test
05:21:48 FAILURE 0.03s J3 | RestrictedTrustManagerTests.testThatDelegateTrustManagerIsRespected <<< FAILURES!
05:21:48    > Throwable #1: java.lang.AssertionError: Certificate CN=n6.c2 is not trusted - sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not validate certificate: certificate expired on 20450904132214GMT+00:00
05:21:48    > 	at __randomizedtesting.SeedInfo.seed([ABE170715C771857:6D94743E9D2E3D3C]:0)
05:21:48    > 	at org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests.assertTrusted(RestrictedTrustManagerTests.java:160)
05:21:48    > 	at org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests.testThatDelegateTrustManagerIsRespected(RestrictedTrustManagerTests.java:133)
05:21:48    > 	at java.lang.Thread.run(Thread.java:748)
05:21:48 Completed [161/187] on J3 in 0.15s, 4 tests, 4 failures <<< FAILURES!

logs:
https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+master+matrix-java-periodic/ES_BUILD_JAVA=java10,ES_RUNTIME_JAVA=java8fips,nodes=virtual&&linux/255/console

steps to reproduce

./gradlew :x-pack:plugin:core:test -Dtests.seed=ABE170715C771857 -Dtests.class=org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests -Dtests.method="testTrustWithRegexCertificateName" -Dtests.security.manager=true -Dtests.locale=th-TH-u-nu-thai-x-lvariant-TH -Dtests.timezone=America/Dominica -Dcompiler.java=10 -Druntime.java=8FIPS -Djavax.net.ssl.keyStorePassword=password -Djavax.net.ssl.trustStorePassword=password

 ./gradlew :x-pack:plugin:core:test -Dtests.seed=ABE170715C771857 -Dtests.class=org.elasticsearch.xpack.core.ssl.RestrictedTrustManagerTests -Dtests.method="testThatDelegateTrustManagerIsRespected" -Dtests.security.manager=true -Dtests.locale=th-TH-u-nu-thai-x-lvariant-TH -Dtests.timezone=America/Dominica -Dcompiler.java=10 -Druntime.java=8FIPS -Djavax.net.ssl.keyStorePassword=password -Djavax.net.ssl.trustStorePassword=password

I was not able to reproduce it locally.

[elasticmachine]

Pinging @elastic/es-core-infra

[jkakavas]

This fails locally too ( in a FIPS JVM )

Error is java.security.cert.CertPathValidatorException: Could not validate certificate: certificate expired on 20450904132213GMT+00:00". The date is clearly in the future but the format seems off and this points me to -Dtests.locale=th-TH-u-nu-thai-x-lvariant-TH being the culprit here. In fact it passes with any other -Dtests.locale.
The fact that this fails only in the FIPS JVM is curious though

[jkakavas]

The issue has to do with the fact that BC internally uses DateFormat and SimpleDateFormat to parse the time String it parses out of org.bouncycastle.asn1.ASN1UTCTime to a java.util.Date object.

https://github.com/bcgit/bc-java/blob/a6c3de20781cca2b4c61750eaabe8ba85ed7f3bb/core/src/main/java/org/bouncycastle/asn1/ASN1UTCTime.java#L164

public Date getDate() throws ParseException {
        SimpleDateFormat dateF = new SimpleDateFormat("yyMMddHHmmssz");
        return dateF.parse(getTime());
}

The issue with SimpleDateFormat is that it is locale-sensitive and as such the parsed Date is affected by the locale used.

Thailand uses a different epoch but is still based on Gregorian Calendar and the general rule for converting the year is

To convert dates from 1 January to 31 March prior to 1941, the number to add or subtract is 542; otherwise, it is 543.

The effect of that is that the expiry date of the certificates (20450904132213GMT+00:00) gets parsed as (2045-543 = 1502-09-04) which is in the past, and the certificate is marked as expired.

I assume this could be an issue with other locales too (maybe @DaveCTurner has more details :) ) , I will open an issue upstream.

[jkakavas]

Opened: bcgit/bc-java#405