feat: log trust store certificate counts and blocklist summary by stokpop · Pull Request #25 · cloudfoundry/java-buildpack-security-provider

stokpop · 2026-10-31T10:42:29Z

Logs trust store details so operators can see what the JVM actually trusts.

System TrustManager (once per JVM at INFO, FINE for later factory inits, so it does not bring back the per-connection noise fixed in fix: log system manager additions at FINE #17): number of trusted certificates, the configured trust store properties (as set), and a JDK blocklist summary (blocked.certs, or blacklisted.certs on Java 8, plus caDistrustPolicies).
Container TrustManager (CF_CA_CERTS): number of trusted certificates on first load and on every watcher reload.

Example (Temurin 8, test CA bundle as CF_CA_CERTS):

INFO: Adding System TrustManager (PKIX) with 118 trusted certificates
INFO: Blocked: 38 blocked certificates, caDistrustPolicies=SYMANTEC_TLS,ENTRUST_TLS,CAMERFIRMA_TLS,CHUNGHWA_TLS
INFO: Adding TrustManager for src/test/resources/server-certificates-173.pem
INFO: Start watching src/test/resources/server-certificates-173.pem
INFO: Initialized TrustManager for src/test/resources/server-certificates-173.pem with 173 trusted certificates

The System trust store: line is logged only when javax.net.ssl.trustStore or javax.net.ssl.trustStoreType is set, e.g. System trust store: javax.net.ssl.trustStore=/etc/ssl/custom.jks, javax.net.ssl.trustStoreType=not set.

A reload logs Updated TrustManager for <file> with N trusted certificates. If the system trust store was supplied through init(KeyStore) or init(ManagerFactoryParameters), the source line says so. If the blocklist is unreadable, the line says unknown or unavailable (access denied).

Logging is best-effort: the diagnostics never affect TLS setup. Any failure while building a log message (for example a denied property read or a malformed java.home) is reported as unavailable (<reason>) instead of being thrown, including on the watcher reload thread.

Notes:

The blocked line is JDK-level only.
Possible follow-ups: revocation settings, expired/expiring counts, FINE-level per-certificate listing.

Copilot

🟡 Changes recommended

Trust-store diagnostics can misidentify the certificate source and report misleading blocklist counts due to unreadable files, missing Java 8 filename support, and rejected properties-format entries.

4 open issues

Report the actual trust-store source · New
Support the Java 8 blacklisted.certs filename · New
Count blocklist fingerprints with empty values · New
Distinguish unavailable blocklist counts from zero · New

What changed in this PR

Adds INFO-level diagnostics to make the security provider’s trust configuration and certificate counts easier to inspect.

Changes:

Logs system and container trust-manager certificate counts, including watcher reloads.
Adds default trust-store location, revocation settings, and JDK blocked-certificate diagnostics.
Updates the system trust-manager logging test for the new INFO message.

File	Description
`src/test/java/org/cloudfoundry/security/CloudFoundryContainerTrustManagerFactoryTest.java`	Updates the expected log level and certificate-count message.
`src/main/java/org/cloudfoundry/security/TrustStoreDiagnostics.java`	Adds trust-store, revocation, and blocked-certificate summaries.
`src/main/java/org/cloudfoundry/security/FileWatchingX509ExtendedTrustManager.java`	Logs certificate counts on initialization and reload.
`src/main/java/org/cloudfoundry/security/CloudFoundryContainerTrustManagerFactory.java`	Emits system certificate counts and trust diagnostics at INFO.

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Diagnostic reads can throw SecurityException and prevent TLS setup on Java 8 with a SecurityManager, and the host-dependent blocklist test incorrectly rejects a valid unknown result.

2 open issues

4 resolved since last review

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

The trust-store diagnostics change has no active review issues requiring resolution.

No open issues 🎉

2 resolved since last review

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Trust-store source resolution lacks test coverage for property overrides, file precedence, fallback, and missing files, leaving operator-reported paths vulnerable to undetected regressions.

1 open issue

Add tests for trust-store source resolution and precedence · New

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

The watcher test does not assert the asynchronous reload summary or its expected count of 173 trusted certificates, so missing or incorrect logging would go undetected.

1 open issue

Add watcher test coverage for trust manager reload summary · New

1 resolved since last review

Add tests for trust-store source resolution and precedence

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Trust-store source resolution is deferred until manager retrieval, so a property change after initialization can make the log name a different store than the one actually used.

1 open issue

Capture the trust-store source immediately after initialization · New

1 resolved since last review

Add watcher test coverage for trust manager reload summary

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

An explicitly empty javax.net.ssl.trustStore value produces a misleading blank-source diagnostic instead of identifying the runtime-selected default store, and this case needs a regression test.

1 open issue

Report the runtime-selected trust store for an empty override · New

1 resolved since last review

Capture the trust-store source immediately after initialization

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

The trust-store diagnostic incorrectly treats NONE as an empty store even when a PKCS11 token supplies certificates, potentially contradicting the reported certificate count.

1 open issue

Avoid claiming NONE PKCS11 trust stores contain no certificates · New

1 resolved since last review

Report the runtime-selected trust store for an empty override

_{Review effort: Balanced}

Log the number of trusted certificates for the system and container trust managers, plus the system trust store source and the JDK blocklist summary. The system summary is logged at INFO once per JVM and at FINE afterwards, so it does not bring back the per-connection noise fixed in cloudfoundry#17.

Copilot

🟡 Changes recommended

The trust-store summary omits an independently configured store type, and logging tests do not verify that initial summaries remain at INFO before subsequent summaries use FINE.

2 open issues

1 resolved since last review

Avoid claiming NONE PKCS11 trust stores contain no certificates

_{Review effort: Balanced}

…pendently Report javax.net.ssl.trustStore and trustStoreType as set, and only when at least one is set, instead of guessing which store the JDK loads. Test the INFO-once-then-FINE summary in an isolated class loader.

Copilot

🟢 Approval recommended

The trust-store diagnostics change has no active review issues.

No open issues 🎉

2 resolved since last review

_{Review effort: Balanced}

kiril-keranov

looks fine overall, left comment about a couple of gaps that might be worth addressing

stokpop force-pushed the feature/log-trust-stores branch from 7884937 to b35afb6 Compare October 31, 2026 10:50

stokpop requested a balanced review from Copilot October 31, 2026 12:51

Copilot started reviewing on behalf of stokpop October 31, 2026 12:51

View session

Copilot AI reviewed Oct 31, 2026

View reviewed changes

stokpop force-pushed the feature/log-trust-stores branch 2 times, most recently from d9f0606 to 014e739 Compare October 31, 2026 15:52

stokpop requested a balanced review from Copilot October 31, 2026 15:54

Copilot started reviewing on behalf of stokpop October 31, 2026 15:54

View session

Copilot AI reviewed Oct 31, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/CloudFoundryContainerTrustManagerFactory.java Resolved

Comment thread src/test/java/org/cloudfoundry/security/CloudFoundryContainerTrustManagerFactoryTest.java Resolved

stokpop force-pushed the feature/log-trust-stores branch from 014e739 to 456bba3 Compare October 31, 2026 23:14

stokpop requested a balanced review from Copilot November 1, 2026 16:14

Copilot started reviewing on behalf of stokpop November 1, 2026 16:14

View session

Copilot AI reviewed Nov 1, 2026

View reviewed changes

stokpop marked this pull request as ready for review November 1, 2026 16:18

stokpop force-pushed the feature/log-trust-stores branch from a190643 to a88cdf6 Compare November 5, 2026 13:07

stokpop changed the title ~~feat: log trust store certificate counts and diagnostics~~ feat: log trust store certificate counts and blocklist summary Nov 5, 2026

stokpop force-pushed the feature/log-trust-stores branch from a88cdf6 to 27b2508 Compare November 5, 2026 13:11

stokpop requested a balanced review from Copilot November 5, 2026 13:13

Copilot started reviewing on behalf of stokpop November 5, 2026 13:13

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/TrustStoreDiagnostics.java Resolved

stokpop force-pushed the feature/log-trust-stores branch from 27b2508 to cee4ef0 Compare November 5, 2026 13:37

stokpop requested a balanced review from Copilot November 5, 2026 14:42

Copilot started reviewing on behalf of stokpop November 5, 2026 14:43

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/FileWatchingX509ExtendedTrustManager.java Resolved

stokpop force-pushed the feature/log-trust-stores branch from cee4ef0 to 9db38e2 Compare November 5, 2026 20:13

stokpop requested a balanced review from Copilot November 5, 2026 20:14

Copilot started reviewing on behalf of stokpop November 5, 2026 20:15

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/CloudFoundryContainerTrustManagerFactory.java Resolved

stokpop force-pushed the feature/log-trust-stores branch from 9db38e2 to 7ca03ee Compare November 6, 2026 06:17

stokpop requested a balanced review from Copilot November 6, 2026 06:18

Copilot started reviewing on behalf of stokpop November 6, 2026 06:19

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/TrustStoreDiagnostics.java Resolved

stokpop force-pushed the feature/log-trust-stores branch from 7ca03ee to 54cf2cc Compare November 6, 2026 06:26

stokpop requested a balanced review from Copilot November 6, 2026 06:28

Copilot started reviewing on behalf of stokpop November 6, 2026 06:29

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/TrustStoreDiagnostics.java Resolved

stokpop force-pushed the feature/log-trust-stores branch from 54cf2cc to 8d7d8aa Compare November 6, 2026 06:37

stokpop requested a balanced review from Copilot November 6, 2026 06:39

Copilot started reviewing on behalf of stokpop November 6, 2026 06:39

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/CloudFoundryContainerTrustManagerFactory.java Resolved

Comment thread src/main/java/org/cloudfoundry/security/TrustStoreDiagnostics.java Resolved

stokpop requested a balanced review from Copilot November 6, 2026 13:07

Copilot started reviewing on behalf of stokpop November 6, 2026 13:07

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

stokpop requested a review from kiril-keranov November 7, 2026 08:25

kiril-keranov approved these changes Nov 7, 2026

View reviewed changes

Comment thread src/main/java/org/cloudfoundry/security/TrustStoreDiagnostics.java Resolved

Comment thread src/main/java/org/cloudfoundry/security/FileWatchingX509ExtendedTrustManager.java Resolved

stokpop merged commit f1d84d4 into cloudfoundry:main Nov 9, 2026
4 checks passed

Conversation

stokpop commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

kiril-keranov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stokpop commented Oct 31, 2026 •

edited

Loading