Pinning in TlsReloadableX509TrustManager

[danielkec]

Usage of TlsReloadableX509TrustManager.checkClientTrusted causes pinning because of sun.security.provider.certpath.URICertStore.engineGetCRLs(sun.security.provider.certpath.URICertStore.java:405) method is synchronized.

Error:  io.helidon.examples.webserver.mtls.RevocationConfigTest  Time elapsed: 2.342 s  <<< FAILURE!
io.helidon.common.testing.virtualthreads.PinningException: 
Pinned virtual threads were detected:
jdk.VirtualThreadPinned {
  startTime = 13:42:49.059 (2024-12-18)
  duration = 30.2 ms
  eventThread = "" (javaThreadId = 41, virtual)
  stackTrace = [
    java.lang.VirtualThread.parkOnCarrierThread(boolean, long) line: 689
    java.lang.VirtualThread.parkNanos(long) line: 648
    java.lang.System$2.parkVirtualThread(long) line: 2652
    jdk.internal.misc.VirtualThreads.park(long) line: 67
    java.util.concurrent.locks.LockSupport.parkNanos(long) line: 408
    ...
  ]
}


	at java.lang.VirtualThread.parkOnCarrierThread(java.lang.VirtualThread.java:689)
	at java.lang.VirtualThread.parkNanos(java.lang.VirtualThread.java:648)
	at java.lang.System$2.parkVirtualThread(java.lang.System$2.java:2652)
	at jdk.internal.misc.VirtualThreads.park(jdk.internal.misc.VirtualThreads.java:67)
	at java.util.concurrent.locks.LockSupport.parkNanos(java.util.concurrent.locks.LockSupport.java:408)
	at sun.nio.ch.Poller.pollIndirect(sun.nio.ch.Poller.java:137)
	at sun.nio.ch.Poller.poll(sun.nio.ch.Poller.java:102)
	at sun.nio.ch.Poller.poll(sun.nio.ch.Poller.java:87)
	at sun.nio.ch.NioSocketImpl.park(sun.nio.ch.NioSocketImpl.java:175)
	at sun.nio.ch.NioSocketImpl.timedRead(sun.nio.ch.NioSocketImpl.java:280)
	at sun.nio.ch.NioSocketImpl.implRead(sun.nio.ch.NioSocketImpl.java:304)
	at sun.nio.ch.NioSocketImpl.read(sun.nio.ch.NioSocketImpl.java:346)
	at sun.nio.ch.NioSocketImpl$1.read(sun.nio.ch.NioSocketImpl$1.java:796)
	at java.net.Socket$SocketInputStream.read(java.net.Socket$SocketInputStream.java:1099)
	at java.io.BufferedInputStream.fill(java.io.BufferedInputStream.java:291)
	at java.io.BufferedInputStream.read1(java.io.BufferedInputStream.java:347)
	at java.io.BufferedInputStream.implRead(java.io.BufferedInputStream.java:420)
	at java.io.BufferedInputStream.read(java.io.BufferedInputStream.java:399)
	at sun.net.www.http.HttpClient.parseHTTPHeader(sun.net.www.http.HttpClient.java:827)
	at sun.net.www.http.HttpClient.parseHTTP(sun.net.www.http.HttpClient.java:759)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(sun.net.www.protocol.http.HttpURLConnection.java:1705)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(sun.net.www.protocol.http.HttpURLConnection.java:1614)
	at sun.security.provider.certpath.URICertStore.engineGetCRLs(sun.security.provider.certpath.URICertStore.java:405)
	at java.security.cert.CertStore.getCRLs(java.security.cert.CertStore.java:182)
	at sun.security.provider.certpath.DistributionPointFetcher.getCRL(sun.security.provider.certpath.DistributionPointFetcher.java:236)
	at sun.security.provider.certpath.DistributionPointFetcher.getCRLs(sun.security.provider.certpath.DistributionPointFetcher.java:179)
	at sun.security.provider.certpath.DistributionPointFetcher.getCRLs(sun.security.provider.certpath.DistributionPointFetcher.java:110)
	at sun.security.provider.certpath.RevocationChecker.checkCRLs(sun.security.provider.certpath.RevocationChecker.java:583)
	at sun.security.provider.certpath.RevocationChecker.checkCRLs(sun.security.provider.certpath.RevocationChecker.java:470)
	at sun.security.provider.certpath.RevocationChecker.check(sun.security.provider.certpath.RevocationChecker.java:399)
	at sun.security.provider.certpath.RevocationChecker.check(sun.security.provider.certpath.RevocationChecker.java:343)
	at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(sun.security.provider.certpath.PKIXMasterCertPathValidator.java:125)
	at sun.security.provider.certpath.PKIXCertPathValidator.validate(sun.security.provider.certpath.PKIXCertPathValidator.java:224)
	at sun.security.provider.certpath.PKIXCertPathValidator.validate(sun.security.provider.certpath.PKIXCertPathValidator.java:144)
	at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(sun.security.provider.certpath.PKIXCertPathValidator.java:83)
	at java.security.cert.CertPathValidator.validate(java.security.cert.CertPathValidator.java:309)
	at sun.security.validator.PKIXValidator.doValidate(sun.security.validator.PKIXValidator.java:313)
	at sun.security.validator.PKIXValidator.engineValidate(sun.security.validator.PKIXValidator.java:256)
	at sun.security.validator.Validator.validate(sun.security.validator.Validator.java:256)
	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(sun.security.ssl.X509TrustManagerImpl.java:241)
	at sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(sun.security.ssl.X509TrustManagerImpl.java:107)
	at io.helidon.common.tls.TlsReloadableX509TrustManager.checkClientTrusted(io.helidon.common.tls.TlsReloadableX509TrustManager.java:36)
	at sun.security.ssl.AbstractTrustManagerWrapper.checkClientTrusted(sun.security.ssl.AbstractTrustManagerWrapper.java:1423)
	at sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkClientCerts(sun.security.ssl.CertificateMessage$T13CertificateConsumer.java:1247)
	at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(sun.security.ssl.CertificateMessage$T13CertificateConsumer.java:1167)
	at sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(sun.security.ssl.CertificateMessage$T13CertificateConsumer.java:1144)
	at sun.security.ssl.SSLHandshake.consume(sun.security.ssl.SSLHandshake.java:393)
	at sun.security.ssl.HandshakeContext.dispatch(sun.security.ssl.HandshakeContext.java:476)
	at sun.security.ssl.HandshakeContext.dispatch(sun.security.ssl.HandshakeContext.java:447)
	at sun.security.ssl.TransportContext.dispatch(sun.security.ssl.TransportContext.java:206)
	at sun.security.ssl.SSLTransport.decode(sun.security.ssl.SSLTransport.java:172)
	at sun.security.ssl.SSLSocketImpl.decode(sun.security.ssl.SSLSocketImpl.java:1506)
	at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(sun.security.ssl.SSLSocketImpl.java:1421)
	at sun.security.ssl.SSLSocketImpl.startHandshake(sun.security.ssl.SSLSocketImpl.java:455)
	at sun.security.ssl.SSLSocketImpl.startHandshake(sun.security.ssl.SSLSocketImpl.java:426)
	at io.helidon.webserver.ConnectionHandler.run(io.helidon.webserver.ConnectionHandler.java:129)
	at io.helidon.common.task.InterruptableTask.call(io.helidon.common.task.InterruptableTask.java:47)
	at io.helidon.webserver.ThreadPerTaskExecutor$ThreadBoundFuture.run(io.helidon.webserver.ThreadPerTaskExecutor$ThreadBoundFuture.java:239)
	at java.lang.Thread.runWith(java.lang.Thread.java:1596)
	at java.lang.VirtualThread.run(java.lang.VirtualThread.java:329)
	at java.lang.VirtualThread$VThreadContinuation$1.run(java.lang.VirtualThread$VThreadContinuation$1.java:209)
	at jdk.internal.vm.Continuation.enter0(jdk.internal.vm.Continuation.java:320)
	at jdk.internal.vm.Continuation.enter(jdk.internal.vm.Continuation.java:312)
	at jdk.internal.vm.Continuation.enterSpecial(jdk.internal.vm.Continuation.java)

[danielkec]

Reproduce by enabling pinning detection in io.helidon.examples.webserver.mtls.RevocationConfigTest