Ignore:
Timestamp:
2018-02-24T17:14:11+01:00 (20 months ago)
Author:
Don-vip
Message:

fix #15992 - force Windows to update its root CA trust store before we search for known CA in it

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java

    r13450 r13451  
    5959import java.security.spec.X509EncodedKeySpec;
    6060import java.util.ArrayList;
     61import java.util.Arrays;
    6162import java.util.Collection;
    6263import java.util.Enumeration;
     
    6465import java.util.Locale;
    6566import java.util.Properties;
     67import java.util.concurrent.ExecutionException;
    6668
    6769import javax.swing.JOptionPane;
     
    441443    public X509Certificate getX509Certificate(NativeCertAmend certAmend)
    442444            throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
     445        // Make a web request to target site to force Windows to update if needed its trust root store from its certificate trust list
     446        // A better, but a lot more complex method might be to get certificate list from Windows Registry with PowerShell
     447        // using (Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate').EncodedCtl)
     448        // then decode it using CertUtil -dump or calling CertCreateCTLContext API using JNI, and finally find and decode the certificate
     449        try {
     450            // https://stackoverflow.com/a/41618979/2257172
     451            Utils.execOutput(Arrays.asList("powershell", "-Command",
     452                    "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;" +
     453                    "Invoke-WebRequest " + certAmend.getWebSite()));
     454        } catch (ExecutionException | InterruptedException e) {
     455            Logging.error(e);
     456        }
     457        // Get Windows Trust Root Store
    443458        KeyStore ks = getRootKeystore();
    444459        // Search by alias (fast)
Note: See TracChangeset for help on using the changeset viewer.