Trying to parse PKCS12 generated by WS2016 using Java Keystore: Failed PKCS12 integrity checking

Question

I am trying to parse a PKCS12 certificate into a x509 and a private key using the Java Keystore:

final KeyStore keystore = KeyStore.getInstance("PKCS12", "SunJSSE");
keystore.load(pkcs12Certificate, password.toCharArray());
final Enumeration<String> aliases = keystore.aliases();
final String alias = aliases.nextElement();
final PrivateKey key = (PrivateKey) keystore.getKey(alias,
            password.toCharArray());
final X509Certificate publicCertificate = (X509Certificate) keystore
            .getCertificate(alias);
return create(clientId, key, publicCertificate);`

This has worked well for certificates built by windows-server-2012. We have updated VMs to windows-server-2016, which has broken this code with the following error:

Exception in thread "main" java.io.IOException: Integrity check failed: 
java.security.UnrecoverableKeyException: Failed PKCS12 integrity checking
at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2146)
at java.base/java.security.KeyStore.load(KeyStore.java:1479)
at com.company.AsymmetricKeyCredential.create(AsymmetricKeyCredential.java:164)
at com.company.Main.main(Main.java:29)
Caused by: java.security.UnrecoverableKeyException: Failed PKCS12 integrity checking
at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2142)
... 3 more`

After some digging around it seems that windows-server-2016 has changed the way they format PKCS12 and PFX certificates. Specifically:

Pre-RS1, PKCS7 EncryptedData was used for the CertBag; in RS1, that was switched to PKCS7 Data. There are the multiple options of AUthSafe contents in a CertBag:

      AuthenticatedSafe ::= SEQUENCE OF ContentInfo
   -- Data if unencrypted
   -- EncryptedData if password-encrypted
   -- EnvelopedData if public key-encrypted

It seems like this switch might be causing the Java Keystore to fail, but I'm not sure how to fix it. I can parse the certificate with open ssl, so I know its not an issue with the certificate itself. We have to support certificates coming from WS2016, so any insight here is greatly appreciated.

Answer 1

This was a bug with JDK 8 which has since been resolved. https://bugs.openjdk.java.net/browse/JDK-8202299