Opened 2 days ago
#24870 new defect
Update bundled Windows Java truststore: missing Certum Trusted Root CA
| Reported by: | Owned by: | team | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Installer Windows | Version: | latest |
| Keywords: | template_report certum geoportal windows java truststore cacerts mscapi | Cc: |
Description
What steps will reproduce the problem?
- Start JOSM 19613 Windows package with the bundled Java runtime.
- Enable Polish Geoportal imagery, e.g. "Geoportal 2: Ortofotomapa (zdjęcia lotnicze) WMTS" or WMS StandardResolution.
- Zoom/pan over Poland and wait for imagery tiles to load.
What is the expected result?
Geoportal imagery tiles should load without manual certificate changes.
What happens instead?
Tile downloads fail with:
javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
The affected host is:
https://mapy.geoportal.gov.pl
Please provide any additional information below. Attach a screenshot if possible.
This appears to be caused by the bundled Windows Java runtime/truststore not trusting the current Certum chain used by Polish Geoportal.
Current Geoportal certificate chain:
CN=*.geoportal.gov.pl
-> CN=Certum DV TLS G2 R39 CA, O=Asseco Data Systems S.A., C=PL
-> CN=Certum Trusted Root CA, OU=Certum Certification Authority, O=Asseco Data Systems S.A., C=PL
Missing/needed CA certificates:
Certum Trusted Root CA
SHA-256: FE:76:96:57:38:55:77:3E:37:A9:5E:7A:D4:D9:CC:96:C3:01:57:C1:5D:31:76:5B:A9:B1:57:04:E1:AE:78:FD
Certum DV TLS G2 R39 CA
SHA-256: 83:C0:A5:A7:68:44:C8:40:DF:AF:82:0F:FD:02:AD:F6:57:3A:26:82:3E:F6:AF:75:8A:33:84:A0:AC:04:40:83
Local workaround confirmed:
Importing the above Certum root/intermediate certificates into:
%LOCALAPPDATA%\JOSM\runtime\lib\security\cacerts
fixes Geoportal imagery loading.
Additional observation from the JOSM status report:
java.security.KeyStoreException: Windows-ROOT not found
Caused by: java.security.NoSuchAlgorithmException: Windows-ROOT KeyStore not available
The bundled runtime release file lists Java 21.0.12 modules, but does not appear to include jdk.crypto.mscapi. If JOSM intends to use the Windows system root store, the Windows runtime may also need that module. Otherwise, please update the bundled cacerts truststore.
-Dcom.sun.security.enableAIAcaIssuers=true, This VM argument was added manually after the initial failure and did not fix the issue by itself.
Revision:19613 Build-Date:2026-08-12 01:42:58 Identification: JOSM/1.5 (19613 pl) Windows 11 64-Bit OS Build number: Windows 10 Pro 24H2 (26100) Memory Usage: 336 MB / 24544 MB (135 MB allocated, but free) Java version: 21.0.12+8-LTS, Azul Systems, Inc., OpenJDK 64-Bit Server VM Look and Feel: com.sun.java.swing.plaf.windows.WindowsLookAndFeel Screen: \Display0 1920x1080x32bpp@32Hz (scaling 1.00×1.00) Maximum Screen Size: 1920×1080 Best cursor sizes: 16×16→32×32, 32×32→32×32 System property file.encoding: UTF-8 System property sun.jnu.encoding: Cp1250 Locale info: pl_PL Numbers with default locale: 1234567890 -> 1234567890 VM arguments: [-Djpackage.app-version=1.5.19613, -Dcom.sun.security.enableAIAcaIssuers=true, - XX:MaxRAMPercentage=75.0, --add-modules=java.scripting,java.sql,javafx.controls,javafx.media,javafx.swing,javafx.web, --add-exports=java.base/sun.security.action=ALL-UNNAMED, --add-exports=java.desktop/com.sun.imageio.plugins.jpeg=ALL-UNNAMED, --add-exports=java.desktop/com.sun.imageio.spi=ALL-UNNAMED, --add-opens=java.base/java.lang=ALL-UNNAMED, --add-opens=java.base/java.nio=ALL-UNNAMED, --add-opens=java.base/jdk.internal.loader=ALL-UNNAMED, --add-opens=java.base/jdk.internal.ref=ALL-UNNAMED, --add-opens=java.desktop/javax.imageio.spi=ALL-UNNAMED, --add-opens=java.desktop/javax.swing.text.html=ALL-UNNAMED, --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED, -Djpackage.app-path=%UserProfile%\AppData\Local\JOSM\JOSM.exe] Dataset consistency test: No problems found Last errors/warnings: - 00000.549 W: extended font config - overriding 'filename.Malgun_Gothic=malgun.ttf' with 'MALGUN.TTF' - 00000.550 W: extended font config - overriding 'filename.Myanmar_Text=mmrtext.ttf' with 'MMRTEXT.TTF' - 00000.551 W: extended font config - overriding 'filename.Mongolian_Baiti=monbaiti.ttf' with 'MONBAITI.TTF' - 00001.858 E: java.security.KeyStoreException: Windows-ROOT not found. Przyczyna: java.security.NoSuchAlgorithmException: Windows-ROOT KeyStore not available
File with correct certs %localappdata%\JOSM\runtime\lib\security