From 723376810e48033cee6a5f052a61dc41c366f1ed Mon Sep 17 00:00:00 2001 From: nmburgan <13688219+nmburgan@users.noreply.github.com> Date: Wed, 30 Sep 2026 23:21:46 +0000 Subject: [PATCH 1/2] Give the localhost test certificate a subject alternative name BouncyCastle's TLS provider stopped matching a hostname against the subject CN in bctls-fips 1.0.24, 2.0.24, and 2.1.24 (CVE-2026-59638). The proxy tests run Jetty's HTTPS client against this certificate under the FIPS profile, and they fail with those jars because the certificate had no subject alternative name. The certificate is reissued from the same key and CA with DNS:localhost and IP:127.0.0.1 as subject alternative names. It keeps serial 2 so the CRL fixtures still refer to it. Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com> Assisted-by: Claude Fable 5.1 --- .../config/jetty/ssl/certs/localhost.pem | 54 ++++++++++--------- 1 file changed, 29 insertions(+), 25 deletions(-) diff --git a/dev-resources/config/jetty/ssl/certs/localhost.pem b/dev-resources/config/jetty/ssl/certs/localhost.pem index ab51335d..7f643f13 100644 --- a/dev-resources/config/jetty/ssl/certs/localhost.pem +++ b/dev-resources/config/jetty/ssl/certs/localhost.pem @@ -1,27 +1,31 @@ -----BEGIN CERTIFICATE----- -MIIEpzCCAo8CAQIwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUUHVwcGV0IENB -OiBsb2NhbGhvc3QwHhcNMTkwMjI1MTUxNzQwWhcNMjkwMjIyMTUxNzQwWjAUMRIw -EAYDVQQDDAlsb2NhbGhvc3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC -AQC85+MXGxoUl+uX4EiKPjQeBDmF/sycWx2pr/oW0JIQMah8VErMww/OvrPWbDfH -L6QyEXsdf0n5DUSoYFVBxolGG6JfvUS6YKXR2CyQmNEtJDsgVIFqhHEKwLVQ2KcG -jQuajJ3omZHDb0O+KZ7hTmtP2826S8jo2ChEKtwVyt9shiyx7Hm/zyF9aG6nLmIk -esiO0t8CvYSc0qOgUT0s9HDWTaZ121v8i0bR27YQbc04nzNjFto7Vrhb4DltZcvb -8cExwqyb+SsTLm1Q66gMfkZpjrJ99uwDzt6+jVK9gs1dbxvAjKiwKbHupnSqQmeV -DS5uHcAlHts1gENENhG2vPDuPNGx/JP7fDVBl5VrduQfAVBPK5JWNI8EsL/A8o3W -tJqHqMYDDGW/qID402Pw7P4doYBc8vw1Lhq7+pMlccx9P6ToNvR3g6FGiiGqowLD -fIf6GEyegojigKln24vCWUZohFU3pLJEuXskrD6jwnoHwJH6SJc+BFOBTdANrzkS -O3qVuJjYiXAi29Pb+Y6ICvg4X3krHA7K2ICBfHgDy8Oq/YdWpvr16A+r7bSMGQbt -eaZwll3Q3ClgTY8fs2FOuPImfVf6hRt9bkyWsNM9fHhT8k3CTfErU56Bmc4yiNgM -oxuReqL/0u5p1NyP8L9AeVaunz40rzK7AZWwXSNz2698PwIDAQABMA0GCSqGSIb3 -DQEBCwUAA4ICAQAl+Z4XvZSvzncH7IcfhtU+NGDaE5MpB4nxrKjYyohK7/9ru9ln -YH65yr2Mt3+tlHGqz1Jxg1pKv/v4v9l77SzGilu4j3zCHxO2Ir9su23ytrtmwWue -Qnd9hPUsO1T8xigTZ3TKFkRbvCGmftetl1095/tAufM5loFDk3qOI0Nl5f7Ck8VS -zmzohVSB5N9qTFg7YLua/fgGIkCJ7cjLjtU3EZyuNvhi1I/FsWioS8OJ7U+h/2Wx -amb3cJvazc2Za9XRL/bMpau1XClOEtpQ8JpG/hbBhOC1fUAnNsmCiNQXlyyGUAdv -nS0QBlvlqf/+qBjQ6YEaONzyvHoNLjcsx02ef5u9H21VuJNr8O0G04B1yFHnTExe -XgEDolUfoLef+0/aXO8DVomvubWZ9id2Fi0SSDIitMQ9zYsNkhSTswDRJlGs6aVL -J2tWn8tnqEezPWsFO+o4ea0RaLIQuxoaM3Ggu3yy4FLT+ME5TaQ1WqXxEJ/TzgF5 -rBWfYzhfkQmhooTVDnuuRYG3tuxsQzEaD6cdw8lGXLAXTfPfmjr0pJBTcKrE5BcG -5RcdbN3IBS/HBYSCB6x5AxXMcVAKmFdQFFUMmyCQwfy+CMkA0On7LVv2cecsHE+B -32fBUI8O5aSGdEnNU0x/gv9M/ihRrOj+8Vb67c/B8bBFtoCgDOwDMU7KmA== +MIIFTjCCAzagAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw +ZXQgQ0E6IGxvY2FsaG9zdDAeFw0yNjA5MzAyMzE3MzNaFw0zNjA5MjcyMzE3MzNa +MBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC +AgoCggIBALzn4xcbGhSX65fgSIo+NB4EOYX+zJxbHamv+hbQkhAxqHxUSszDD86+ +s9ZsN8cvpDIRex1/SfkNRKhgVUHGiUYbol+9RLpgpdHYLJCY0S0kOyBUgWqEcQrA +tVDYpwaNC5qMneiZkcNvQ74pnuFOa0/bzbpLyOjYKEQq3BXK32yGLLHseb/PIX1o +bqcuYiR6yI7S3wK9hJzSo6BRPSz0cNZNpnXbW/yLRtHbthBtzTifM2MW2jtWuFvg +OW1ly9vxwTHCrJv5KxMubVDrqAx+RmmOsn327APO3r6NUr2CzV1vG8CMqLApse6m +dKpCZ5UNLm4dwCUe2zWAQ0Q2Eba88O480bH8k/t8NUGXlWt25B8BUE8rklY0jwSw +v8Dyjda0moeoxgMMZb+ogPjTY/Ds/h2hgFzy/DUuGrv6kyVxzH0/pOg29HeDoUaK +IaqjAsN8h/oYTJ6CiOKAqWfbi8JZRmiEVTekskS5eySsPqPCegfAkfpIlz4EU4FN +0A2vORI7epW4mNiJcCLb09v5jogK+DhfeSscDsrYgIF8eAPLw6r9h1am+vXoD6vt +tIwZBu15pnCWXdDcKWBNjx+zYU648iZ9V/qFG31uTJaw0z18eFPyTcJN8StTnoGZ +zjKI2AyjG5F6ov/S7mnU3I/wv0B5Vq6fPjSvMrsBlbBdI3Pbr3w/AgMBAAGjgZ8w +gZwwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwIAYDVR0lAQH/BBYwFAYI +KwYBBQUHAwEGCCsGAQUFBwMCMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATAd +BgNVHQ4EFgQUz9tP/qEPtakX60jnqR5QFli0ODwwHwYDVR0jBBgwFoAUWctw9L0B +ogbt5p4IKvI4hGREaF8wDQYJKoZIhvcNAQELBQADggIBAAlvZPF7W+Y7kN95SoBp +oZNxbKGHBVV1aZu62XG3h6HTuTR/Wv1WrATEjvOZ/mc6PGWAfry65B8U7ra9H59l +rWxV51ubof+L6Rm4/c/yibPmqEfetT3MfjnVsegb6bEF4AK4729pKAt1PB9T2Ck2 +DtjNwHTKlMravabm3mjIV+KO8K5hJfVtlkdMBBdJ+Ydtp2mL6xM5AJ3xXZu7rqAL +UiB4Y7yks6L68QDKsudk0Ek+yg7waCE9btSZi8f8WfXfGLYgDf4gA4fnwr6sRCRu +wlOKrewXf19rppum44huO2q9FgEMuTmmTFH37gYBumN+NRWj7Z4ZVfSIezIAqbht +08PO3ksNKetg2eXE8umGoMXNhwd93hYD2QAkrzCzPUFIm/fY2uzX4I9BEnpJXWpV +sSVs9MibckpvluawpF0IVBJbZouIBwsZxdD+LWTLppK0IyYRtpm/5YkswY5CtWvw +HulHc400xmtzYN2TfDOKE/m+BEE7wr+ALx94hFr/FIRGMS6I2mv7nOUJuaYtCwsF +t7WQYeXa34YNThAMIer6v9M3XNg8YcSeQIC+UJExzZckPNKt6xYJJwrZmu6AYHMt +XYLfKKaCXABXHorDMjHYf0KPsw7e50liAlxkL+y0CkVCJEEgk6e8N0frTcXfLiZw +FcSlZjHxGjwwIYgfDsuuT0jr -----END CERTIFICATE----- From 826224bc4d93807e1a734721f2a6c8bebdd2c36d Mon Sep 17 00:00:00 2001 From: nmburgan <13688219+nmburgan@users.noreply.github.com> Date: Wed, 30 Sep 2026 23:21:46 +0000 Subject: [PATCH 2/2] Move the FIPS test profile to BouncyCastle FIPS 2.1 Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com> Assisted-by: Claude Fable 5.1 --- project.clj | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/project.clj b/project.clj index 33a1ec49..2651fb94 100644 --- a/project.clj +++ b/project.clj @@ -46,9 +46,10 @@ [compojure "1.7.2"] [javax.servlet/javax.servlet-api "4.0.1"] [org.bouncycastle/bcpkix-jdk18on "1.86"] - [org.bouncycastle/bcpkix-fips "1.0.13"] - [org.bouncycastle/bc-fips "1.0.2.6"] - [org.bouncycastle/bctls-fips "1.0.19"] + [org.bouncycastle/bcpkix-fips "2.1.13"] + [org.bouncycastle/bc-fips "2.1.3"] + [org.bouncycastle/bctls-fips "2.1.25"] + [org.bouncycastle/bcutil-fips "2.1.8"] [org.flatland/ordered "1.15.12"] [org.openvoxproject/http-client "2.4.1"] [org.openvoxproject/i18n ~i18n-version] @@ -132,7 +133,8 @@ :dev [:shared :dev-only] :fips-only {:dependencies [[org.bouncycastle/bcpkix-fips] [org.bouncycastle/bc-fips] - [org.bouncycastle/bctls-fips]] + [org.bouncycastle/bctls-fips] + [org.bouncycastle/bcutil-fips]] ;; this only ensures that we run with the proper profiles ;; during testing. This JVM opt will be set in the puppet module ;; that sets up the JVM classpaths during installation.