- 
                Notifications
    You must be signed in to change notification settings 
- Fork 54
zwe validate certificate #4554
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: feature/v3/validate-bind
Are you sure you want to change the base?
zwe validate certificate #4554
Conversation
Signed-off-by: 1000TurquoisePogs <[email protected]>
Signed-off-by: 1000TurquoisePogs <[email protected]>
| build 8975 SUCCEEDED. | 
Signed-off-by: 1000TurquoisePogs <[email protected]>
| build 8976 SUCCEEDED. | 
| Test workflow 7654 is started. | 
| Test workflow 7655 is started. | 
Signed-off-by: Martin Zeithaml <[email protected]>
| build 8980 SUCCEEDED. | 
| Test workflow 7659 is started. | 
Signed-off-by: 1000TurquoisePogs <[email protected]>
| build 8981 SUCCEEDED. | 
| Test workflow 7660 is started. | 
This PR utilizes apiml's
certificate-analyser.jarto check zowe's keystore/truststore and report action items for specific situations.It's run at startup of zowe, but also via the command
zwe validate certificate.This command can be run with argument
-e STRICTto change the lEvel of verification to STRICT, for example. This allows users to see what would happen with different levels of strictness.The command might not run well when run standalone, because often keyrings aren't readable by the user who runs
zwe. But, it will have the right conditions to be a startup check.This command can be disabled with
zowe.launchScript.startupChecks.certificate: false.This command does not verify ICSF certificates, or at least it's very likely not to. It seems java 11+ doesnt ship with the right security config that 8 had, so when you request to read these, it just tells you JCECCARACFKS isn't available. It then becomes some administrative task to customize the java 11+ config? Not a problem I can solve.
This PR is based upon #4447 and #4276
Do not merge it into 4447 - I am pointing to that for the sake of easy diff reading.
I wish to merge this and review this independently as certificate error checking is a big topic.