Sun Java KeyManagerFactory and null passwords

Question

We are having a problem with the KeyManagerFactory in the Sun JRE 1.6. We are using code similar to the following to upload and use a certificate in p12 format:

KeyStore keyStore = KeyStore.getInstance(PKCS12);
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(SUN_X509);

InputStream certificateFile = getSSLCertificate();
String certificatePassword = getSSLCertificatePassword();
keyStore.load(certificateFile, certificatePassword);
keyManagerFactory.init(keyStore, certificatePassword);

This code works correctly when the certificate password exists. But when the certificate password is null (so the certificate is not protected by a password) we get a divide by zero error from the keyManagerFactory.init line.

Does anyone know why this is happening? Is it not possible to use a certificate without a password? Thanks

that is correct, you must have a password. – President James K. Polk Dec 31 '09 at 01:48 — President James K. Polk, Dec 31 '09 at 01:48

score 4 · Answer 1 · answered Sep 06 '10 at 11:42

4

This is a bug:

http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6415637

Workaround is to set a password.

answered Sep 06 '10 at 11:42

Elin

41
1

score 3 · Answer 2 · answered Nov 29 '09 at 00:55

3

Because PKCS12 contains private key, you should always have a password. I think Sun accidentally enforces this :)

For all Keystore API, password is required for the store and private keys. If you don't really want deal with the configuration or user-interaction, just use the default password "changeit" everywhere.

answered Nov 29 '09 at 00:55

ZZ Coder

74,484
29
137
169

Sun intentionally enforces this, so that you don't accidentally forget that its important. – President James K. Polk Dec 31 '09 at 01:48

score 0 · Answer 3 · answered Jun 10 '22 at 22:29

It appears that using an empty character array will configure the KeyManagerFactory to allow access to the keys without a password.

There are all kinds of reasons to have a KeyStore without a password (in-memory-only KeyStores being one possibility).

String keystorePassword = ...;
KeyStore keys = ...;

char[] kpwd;
if(null != keystorePassword && 0 != keystorePassword.length())
    kpwd = keystorePassword.toCharArray();
else
    kpwd = new char[0];

KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());

kmf.init(keys, kpwd);

KeyManagers managers = kmf.getKeyManagers();

// Now, use "managers" for great things

Sun Java KeyManagerFactory and null passwords

3 Answers3

Linked