openjdk1.7：使用BouncyCastleProvider时无法列出PKCS11密钥库别名

Question

I want to look into a nssdb keystore to extract get some info from available aliases. On some other part of the same application, I use BouncyCastleProvider to handle some other security stuff. The small code below shows how I load and run into it, and was working well with openjdk-1.6.0. Now, with openjdk-1.7.0, it only works if I don't use the BouncyCastleProvider or if this provider is added AFTER the PKCS11 provider. In case I add BC before PKCS11, all seems ok (no exception), but Keystore.aliases() returns an empty list for my nss container. Just like if load() did not work.

import java.io.InputStream;
import java.io.ByteArrayInputStream;
import java.util.Enumeration;
import java.security.KeyStore;
import java.security.Provider;
import java.security.Security;    
import java.security.cert.X509Certificate;
import java.security.cert.Certificate;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

public class TestNSS {  
public static void main(String[] args) {
    try {
        Provider prov = new BouncyCastleProvider();
        Security.addProvider(prov);

        String config = "name = nssdb\n";
        config += "nssSecmodDirectory = /nssdbpath\n";
        InputStream stream = new ByteArrayInputStream(config.getBytes("UTF-8"));
        Provider nss = new sun.security.pkcs11.SunPKCS11(stream);
        stream.close();
        Security.addProvider(nss);

        KeyStore ks = KeyStore.getInstance("PKCS11", "SunPKCS11-nssdb");
        ks.load((InputStream)null, "".toCharArray());
        System.out.println("load is ok: SunPKCS11-nssdb");
        for (Enumeration<String> e = ks.aliases(); e.hasMoreElements();) {
            String alias = e.nextElement();
            Certificate cert = ks.getCertificate(alias);
            System.out.println(" . alias: "+alias+", "+cert.getType()+","+((X509Certificate)cert).getNotAfter());
        }
    } catch(Exception e) {
        e.printStackTrace();
    }

}
}

Any idea is welcome...

Note: /nssdbpath contains a nssdb structure created using certutil.

Answer 1

I found that - SunPKCS11 instanciation in java.security is a change in openjdk7 compared to openJDK6. - loading my nssdb through nss.cfg instead of the default "nodb" mode looks ok for this matter, but this is no valid workaround, because causing side effects like keytool errors...

Moreover, - I still don't know why BouncyCastleProvider is interacting with SunPKCS11 . - it looks nssdb is not loaded by load() method but rather at SunPKCS11 instanciation - only one SunPKCS11 instance with a single nssdb may be loaded in a JVM

=> SunPKCS11 is not the good way to go to read my nssdb data: I'll go through external (non-java) code as workaround.

Anyway if someone has another solution, I'm still interested in reading.