JarSigner cannot verify signature of ics64.jar with recent OpenJDK

[Srdjan_B]

Hello,

Our customer is using SSL Extender and ESOD. One of their users who recently installed Java is getting "Check Point Deployment Shell Internal Error"

Checking cshell.elg on the client I see following

INFO [global] (Log log) [General] Java vendor: Eclipse Adoptium (verion 11.0.14.1)
INFO [global] (Log log) [General] Certificate checking: Path does not chain with any of the trust anchors
INFO [global] (Log log) [Component] has_invalid_cert and has_unsigned_entry are false
INFO [global] (Log log) [Component] Verify - Returning false
INFO [global] (Log log) [Component] Failed to verify C:\Users\admin\AppData\Local\Temp\CSHELL\ics64\100001160\ics64.jar.tmp using JarSigner

Trying a bit older version, it still does not work

INFO [global] (Log log) [General] Java vendor: Eclipse Foundation (verion 11.0.12)                                                          
INFO [global] (Log log) [General] Certificate checking: Path does not chain with any of the trust anchors                                   
INFO [global] (Log log) [Component] has_invalid_cert and has_unsigned_entry are false                                                       
INFO [global] (Log log) [Component] Verify - Returning false                                                                                
INFO [global] (Log log) [Component] Failed to verify C:\Users\admin\AppData\Local\Temp\CSHELL\ics64\100001160\ics64.jar.tmp using JarSigner 

When using old Oracle OpenJDK it works fine and cshell.elg on the client shows:

INFO [global] (Log log) [General] Java vendor: Oracle Corporation (verion 11.0.2)
INFO [global] (Log log) [Component] Verify - Returning true
INFO [global] (Log log) [Component] Verified C:\Users\admin\AppData\Local\Temp\CSHELL\ics64\100001160\ics64.jar.tmp using JarSigner

What can be done so that newer versions of OpenJDK can be used? I tried latest Microsoft OpenJDK 11 too, with the same results.

Thank you

[PhoneBoy]

I recommend opening a TAC case, but I suspect it's because we don't support that version of OpenJDK (in which case, it'd be an RFE to support it).