undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/security/AccessControlContext/CheckCtor.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2008, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 6631361
+ * @summary Test constructor when PD array is null or contains all null contexts
+ */
+
+import java.security.AccessControlContext;
+import java.security.ProtectionDomain;
+
+public class CheckCtor {
+
+    public static void main(String[] args) throws Exception {
+
+        // check that null PD array throws NPE
+        try {
+            new AccessControlContext(null);
+            throw new Exception("Expected NullPointerException not thrown");
+        } catch (Exception e) {
+            if (!(e instanceof NullPointerException)) {
+                throw new Exception("Expected NullPointerException not thrown");
+            }
+        }
+
+        // check that empty PD array equals PD array of one or more nulls
+        ProtectionDomain zero[] = {};
+        ProtectionDomain null1[] = {null};
+        ProtectionDomain null2[] = {null, null};
+
+        AccessControlContext accZero = new AccessControlContext(zero);
+        AccessControlContext accNull1 = new AccessControlContext(null1);
+        AccessControlContext accNull2 = new AccessControlContext(null2);
+
+        testEquals(accZero, accNull1);
+        testEquals(accZero, accNull2);
+        testEquals(accNull1, accNull2);
+        testEquals(accNull1, accZero);
+        testEquals(accNull2, accZero);
+        testEquals(accNull2, accNull1);
+    }
+
+    private static void testEquals(AccessControlContext acc1,
+        AccessControlContext acc2) throws Exception {
+        if (!acc1.equals(acc2)) {
+            throw new Exception("AccessControlContexts should be equal");
+        }
+    }
+}

test/jdk/java/security/AccessControlContext/NullCombinerEquals.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.security.*;
+
+/*
+ * @test
+ * @bug 4250093
+ * @summary AccessControlContext throws NullPointerException
+ * if the Combiner is null.
+ */
+public class NullCombinerEquals {
+    public static void main(String[] args) throws Exception {
+        NullCombinerEquals nce = new NullCombinerEquals();
+
+        try {
+            nce.go();
+        } catch (Exception e) {
+            throw new Exception("Test Failed: " + e.toString());
+        }
+    }
+
+    void go() throws Exception {
+        AccessControlContext acc = AccessController.getContext();
+
+        // test both combiners are NULL
+        acc.equals(acc);
+
+        // test one combiner is NULL
+        AccessControlContext acc2 = new AccessControlContext(acc, new DC());
+        acc.equals(acc2);
+
+        // test other combiner is NULL
+        acc2.equals(acc);
+
+        // test neither combiner is NULL
+        AccessControlContext acc3 = new AccessControlContext(acc, new DC());
+        acc2.equals(acc3);
+    }
+
+    private static class DC implements DomainCombiner {
+        public ProtectionDomain[] combine(ProtectionDomain[] a,
+                                        ProtectionDomain[] b) {
+            // this is irrelevant
+            return a;
+        }
+    }
+}

test/jdk/java/security/AccessController/PreserveCombiner.java

@@ -0,0 +1,109 @@
+/*
+ * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4819194
+ * @summary doPrivileged should preserve DomainCombiner
+ */
+
+import java.security.*;
+import java.util.concurrent.Callable;
+import javax.security.auth.Subject;
+import javax.security.auth.x500.X500Principal;
+
+public class PreserveCombiner {
+
+    public static void main(String[] args) throws Exception {
+
+        Subject s = new Subject();
+        s.getPrincipals().add(new X500Principal("cn=duke"));
+
+        String result = Subject.callAs(s, new Callable<String>() {
+            public String call() {
+
+                // get subject from current ACC - this always worked
+                Subject callAsSubject = Subject.current();
+                if (callAsSubject == null) {
+                    return "test 1 failed";
+                } else {
+                    System.out.println(callAsSubject);
+                    System.out.println("test 1 passed");
+                }
+
+                // try doPriv (PrivilegedAction) test
+                String result = AccessController.doPrivilegedWithCombiner
+                    (new PrivilegedAction<String>() {
+                    public String run() {
+                        // get subject after doPriv
+                        Subject doPrivSubject = Subject.current();
+                        if (doPrivSubject == null) {
+                            return "test 2 failed";
+                        } else {
+                            System.out.println(doPrivSubject);
+                            return "test 2 passed";
+                        }
+                    }
+                });
+
+                if ("test 2 failed".equals(result)) {
+                    return result;
+                } else {
+                    System.out.println(result);
+                }
+
+                // try doPriv (PrivilegedExceptionAction) test
+                try {
+                    result = AccessController.doPrivilegedWithCombiner
+                        (new PrivilegedExceptionAction<String>() {
+                        public String run() throws PrivilegedActionException {
+                            // get subject after doPriv
+                            Subject doPrivSubject = Subject.current();
+                            if (doPrivSubject == null) {
+                                return "test 3 failed";
+                            } else {
+                                System.out.println(doPrivSubject);
+                                return "test 3 passed";
+                            }
+                        }
+                    });
+                } catch (PrivilegedActionException pae) {
+                    result = "test 3 failed";
+                }
+
+                if ("test 3 failed".equals(result)) {
+                    return result;
+                } else {
+                    System.out.println(result);
+                }
+
+                // tests passed
+                return result;
+            }
+        });
+
+        if (result.indexOf("passed") <= 0) {
+            throw new SecurityException("overall test failed");
+        }
+    }
+}

test/jdk/java/security/AsymmetricKey/GetParams.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import jdk.test.lib.Asserts;
+
+import javax.crypto.spec.DHParameterSpec;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.interfaces.DSAParams;
+import java.security.spec.AlgorithmParameterSpec;
+import java.security.spec.ECParameterSpec;
+import java.security.spec.NamedParameterSpec;
+
+/**
+ * @test
+ * @bug 8318096
+ * @summary Introduce AsymmetricKey interface with a getParams method
+ * @library /test/lib
+ */
+
+public class GetParams {
+    public static void main(String[] args) throws Exception {
+        test("DSA", DSAParams.class);
+        test("RSA", AlgorithmParameterSpec.class);
+        test("RSASSA-PSS", AlgorithmParameterSpec.class);
+        test("EC", ECParameterSpec.class);
+        test("DH", DHParameterSpec.class);
+        test("EdDSA", NamedParameterSpec.class);
+        test("XDH", NamedParameterSpec.class);
+    }
+
+    static void test(String alg, Class<? extends AlgorithmParameterSpec> clazz)
+            throws Exception {
+        KeyPairGenerator g = KeyPairGenerator.getInstance(alg);
+        KeyPair kp = g.generateKeyPair();
+        AlgorithmParameterSpec spec1 = kp.getPrivate().getParams();
+        Asserts.assertTrue(spec1 == null || clazz.isAssignableFrom(spec1.getClass()));
+        AlgorithmParameterSpec spec2 = kp.getPublic().getParams();
+        Asserts.assertTrue(spec2 == null || clazz.isAssignableFrom(spec2.getClass()));
+    }
+}

test/jdk/java/security/BasicPermission/BasicPermissionCollection.java

@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8056179
+ * @summary Unit test for BasicPermissionCollection subclass
+ */
+
+import java.security.BasicPermission;
+import java.security.Permission;
+import java.security.PermissionCollection;
+import java.security.SecurityPermission;
+import java.util.Enumeration;
+
+public class BasicPermissionCollection {
+
+    public static void main(String[] args) throws Exception {
+
+        int testFail = 0;
+
+        TestPermission perm = new TestPermission("foo");
+        PermissionCollection perms = perm.newPermissionCollection();
+
+        // test 1
+        System.out.println("test 1: add throws IllegalArgumentExc");
+        try {
+            perms.add(new SecurityPermission("createAccessControlContext"));
+            System.err.println("Expected IllegalArgumentException");
+            testFail++;
+        } catch (IllegalArgumentException iae) {}
+
+        // test 2
+        System.out.println("test 2: implies returns false for wrong class");
+        if (perms.implies(new SecurityPermission("getPolicy"))) {
+            System.err.println("Expected false, returned true");
+            testFail++;
+        }
+
+        // test 3
+        System.out.println("test 3: implies returns true for match on name");
+        perms.add(new TestPermission("foo"));
+        if (!perms.implies(new TestPermission("foo"))) {
+            System.err.println("Expected true, returned false");
+            testFail++;
+        }
+
+        // test 4
+        System.out.println("test 4: implies returns true for wildcard match");
+        perms.add(new TestPermission("bar.*"));
+        if (!perms.implies(new TestPermission("bar.foo"))) {
+            System.err.println("Expected true, returned false");
+            testFail++;
+        }
+
+        // test 5
+        System.out.println
+            ("test 5: implies returns false for invalid wildcard");
+        perms.add(new TestPermission("baz*"));
+        if (perms.implies(new TestPermission("baz.foo"))) {
+            System.err.println("Expected false, returned true");
+            testFail++;
+        }
+
+        // test 6
+        System.out.println
+            ("test 6: implies returns true for deep wildcard match");
+        if (!perms.implies(new TestPermission("bar.foo.baz"))) {
+            System.err.println("Expected true, returned false");
+            testFail++;
+        }
+
+        // test 7
+        System.out.println
+            ("test 7: implies returns true for all wildcard match");
+        perms.add(new TestPermission("*"));
+        if (!perms.implies(new TestPermission("yes"))) {
+            System.err.println("Expected true, returned false");
+            testFail++;
+        }
+
+        // test 8
+        System.out.println("test 8: elements returns correct number of perms");
+        int numPerms = 0;
+        Enumeration<Permission> e = perms.elements();
+        while (e.hasMoreElements()) {
+            numPerms++;
+            System.out.println(e.nextElement());
+        }
+        if (numPerms != 4) {
+            System.err.println("Expected 4, got " + numPerms);
+            testFail++;
+        }
+
+        if (testFail > 0) {
+            throw new Exception(testFail + " test(s) failed");
+        }
+    }
+
+    private static class TestPermission extends BasicPermission {
+        TestPermission(String name) {
+            super(name);
+        }
+    }
+}

test/jdk/java/security/BasicPermission/EqualsImplies.java

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4157921
+ * @summary Test subclasses of BasicPermission to make sure different
+ * subclasses don't equal or imply each other.
+ */
+
+import java.security.Permission;
+import java.security.BasicPermission;
+
+class A extends BasicPermission {
+    public A(String name) { super(name); }
+}
+
+class B extends BasicPermission {
+    public B(String name) { super(name); }
+}
+
+public class EqualsImplies {
+
+    public static void main(String[]args) throws Exception {
+
+      Permission p1 = new A("foo");
+      Permission p2 = new B("foo");
+
+      if (p1.implies(p2) || p2.implies(p1) || p1.equals(p2)) {
+          throw new Exception("Test failed");
+      }
+
+      // make sure permissions imply and equal themselves
+      if (! (p1.implies(p1) && p1.equals(p1))) {
+          throw new Exception("Test failed");
+      }
+
+    }
+}

test/jdk/java/security/BasicPermission/ExitVMEquals.java

@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2007, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 6569218
+ * @summary  Specification of some BasicPermission method does not fit with implementation
+ */
+
+import java.security.BasicPermission;
+
+public class ExitVMEquals {
+    public static void main(String[] args) throws Exception {
+        BasicPermission bp1 = new BP("exitVM");
+        BasicPermission bp2 = new BP("exitVM.*");
+
+        StringBuffer sb = new StringBuffer();
+
+        // First, make sure the old restrictions on exitVM and exitVM.* still hold.
+        if (!bp1.implies(bp2)) sb.append("bp1 does not implies bp2\n");
+        if (!bp2.implies(bp1)) sb.append("bp2 does not implies bp1\n");
+
+        // Test against hashCode spec
+        if (bp1.hashCode() != bp1.getName().hashCode())
+            sb.append("bp1 hashCode not spec consistent\n");
+        if (bp2.hashCode() != bp2.getName().hashCode())
+            sb.append("bp2 hashCode not spec consistent\n");
+
+        // Test against equals spec
+        if (bp1.getName().equals(bp2.getName())) {
+            if (!bp1.equals(bp2)) {
+                sb.append("BP breaks equals spec\n");
+            }
+        }
+        if (!bp1.getName().equals(bp2.getName())) {
+            if (bp1.equals(bp2)) {
+                sb.append("BP breaks equals spec in another way\n");
+            }
+        }
+
+        // Tests against common knowledge: If equals, then hashCode should be same
+        if (bp1.equals(bp2)) {
+            if (bp1.hashCode() != bp2.hashCode()) {
+                sb.append("Equal objects have unequal hashCode?\n");
+            }
+        }
+
+        if (sb.length() > 0) {
+            throw new Exception(sb.toString());
+        }
+    }
+}
+
+class BP extends BasicPermission {
+    BP(String name) {
+        super(name);
+    }
+}

test/jdk/java/security/BasicPermission/Homogeneity.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2000, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4291610
+ * @summary BasicPermission.newPermissionCollection collection does not
+ *      enforce homogeneity
+ */
+
+import java.security.BasicPermission;
+
+public class Homogeneity {
+
+    public static void main(String[] args) {
+
+        java.lang.RuntimePermission rp = new java.lang.RuntimePermission
+                                        ("*");
+        java.lang.RuntimePermission rp2 = new java.lang.RuntimePermission
+                                        ("exitVM");
+        java.net.NetPermission np = new java.net.NetPermission
+                                        ("setDefaultAuthenticator");
+
+        // should be able to add identical BasicPermission subclasses to the
+        // same collection
+        java.security.PermissionCollection perms = rp.newPermissionCollection();
+        try {
+            perms.add(rp);
+            perms.add(rp2);
+        } catch (IllegalArgumentException iae) {
+            throw new SecurityException("GOOD ADD TEST FAILED");
+        }
+
+        // make sure you can't add different BasicPermission subclasses
+        // to the same collection
+        try {
+            // this should fail
+            perms.add(np);
+            throw new SecurityException("BAD ADD TEST FAILED");
+        } catch (IllegalArgumentException iae) {
+            // good
+        }
+
+        // make sure a BasicPermissionCollection doesn't imply
+        // random BasicPermission subclasses
+        if (perms.implies(np)) {
+            throw new SecurityException("IMPLIES TEST FAILED");
+        }
+    }
+}

test/jdk/java/security/BasicPermission/MixedBasicPermissions.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2007, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 6568872
+ * @summary BasicPermission.newPermissionCollection() violates general contract specified in Permission class
+ */
+public class MixedBasicPermissions {
+    public static void main(String[] args) {
+        try {
+            new java.net.NetPermission("1.1.1.1", "connect").newPermissionCollection().add(new java.util.PropertyPermission("j", "read"));
+        } catch (Exception e) {
+            return;
+            // Correct place
+        }
+        throw new RuntimeException("Should not be here");
+    }
+}

test/jdk/java/security/BasicPermission/NullOrEmptyName.java

@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 1999, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4240252
+ * @summary Make sure BasicPermission constructor raises
+ * NullPointerException if permission name is null, and
+ * IllegalArgumentException is permission name is empty.
+ * @run main/othervm NullOrEmptyName
+ */
+
+import java.util.PropertyPermission;
+
+public class NullOrEmptyName {
+
+    public static void main(String[]args) throws Exception {
+        NullOrEmptyName noe = new NullOrEmptyName();
+
+        noe.run();
+
+        try {
+            new PropertyPermission(null, "read");
+            throw new Exception("Expected NullPointerException not thrown");
+        } catch (NullPointerException npe) {
+            // expected exception thrown
+        }
+
+        try {
+            new PropertyPermission("", "read");
+            throw new Exception("Expected IllegalArgumentException not " +
+                                "thrown");
+        } catch (IllegalArgumentException iae) {
+            // expected exception thrown
+        }
+    }
+
+    void run() throws Exception {
+
+        try {
+            System.getProperty(null);
+            throw new Exception("Expected NullPointerException not " +
+                                "thrown");
+        } catch (NullPointerException npe) {
+            // expected exception thrown
+        }
+
+        try {
+            System.getProperty(null, "value");
+            throw new Exception("Expected NullPointerException not " +
+                                "thrown");
+        } catch (NullPointerException npe) {
+            // expected exception thrown
+        }
+
+        try {
+            System.getProperty("");
+            throw new Exception("Expected IllegalArgumentException not " +
+                                "thrown");
+        } catch (IllegalArgumentException iae) {
+            // expected exception thrown
+        }
+
+        try {
+            System.getProperty("", "value");
+            throw new Exception("Expected IllegalArgumentException not " +
+                                "thrown");
+        } catch (IllegalArgumentException iae) {
+            // expected exception thrown
+        }
+
+        try {
+            System.setProperty(null, "value");
+            throw new Exception("Expected NullPointerException not " +
+                                "thrown");
+        } catch (NullPointerException npe) {
+            // expected exception thrown
+        }
+
+        try {
+            System.setProperty("", "value");
+            throw new Exception("Expected IllegalArgumentException not " +
+                                "thrown");
+        } catch (IllegalArgumentException iae) {
+            // expected exception thrown
+        }
+    }
+}

test/jdk/java/security/BasicPermission/PermClass.java

@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2001, 2011, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4511601 7054918
+ * @summary BasicPermissionCollection does not set permClass
+ *              during deserialization
+ */
+
+import java.security.*;
+import java.io.*;
+
+public class PermClass {
+
+    public static void main(String[] args) throws Exception {
+
+        String dir = System.getProperty("test.src");
+        if (dir == null) {
+            dir = ".";
+        }
+
+        MyPermission mp = new MyPermission("PermClass");
+        if (args != null && args.length == 1 && args[0] != null) {
+            // set up serialized file (arg is JDK version)
+            PermissionCollection bpc = mp.newPermissionCollection();
+            bpc.add(mp);
+            File sFile = new File(dir, "PermClass." + args[0]);
+            ObjectOutputStream oos = new ObjectOutputStream
+                (new FileOutputStream("PermClass." + args[0]));
+            oos.writeObject(bpc);
+            oos.close();
+            System.exit(0);
+        }
+
+        // read in a 1.2.1 BasicPermissionCollection
+        File sFile = new File(dir, "PermClass.1.2.1");
+        try (FileInputStream fis = new FileInputStream(sFile);
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("1.2.1 collection = " + pc);
+
+            if (pc.implies(mp)) {
+                System.out.println("JDK 1.2.1 test passed");
+            } else {
+                throw new Exception("JDK 1.2.1 test failed");
+            }
+        }
+
+        // read in a 1.3.1 BasicPermissionCollection
+        sFile = new File(dir, "PermClass.1.3.1");
+        try (FileInputStream fis = new FileInputStream(sFile);
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("1.3.1 collection = " + pc);
+
+            if (pc.implies(mp)) {
+                System.out.println("JDK 1.3.1 test passed");
+            } else {
+                throw new Exception("JDK 1.3.1 test failed");
+            }
+        }
+
+        // read in a 1.4 BasicPermissionCollection
+        sFile = new File(dir, "PermClass.1.4");
+        try (FileInputStream fis = new FileInputStream(sFile);
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("1.4 collection = " + pc);
+
+            if (pc.implies(mp)) {
+                System.out.println("JDK 1.4 test 1 passed");
+            } else {
+                throw new Exception("JDK 1.4 test 1 failed");
+            }
+        }
+
+        // write out current BasicPermissionCollection
+        PermissionCollection bpc = mp.newPermissionCollection();
+        bpc.add(mp);
+        sFile = new File(dir, "PermClass.current");
+        try (FileOutputStream fos = new FileOutputStream("PermClass.current");
+                ObjectOutputStream oos = new ObjectOutputStream(fos)) {
+            oos.writeObject(bpc);
+        }
+
+        // read in current BasicPermissionCollection
+        try (FileInputStream fis = new FileInputStream("PermClass.current");
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("current collection = " + pc);
+
+            if (pc.implies(mp)) {
+                System.out.println("JDK 1.4 test 2 passed");
+            } else {
+                throw new Exception("JDK 1.4 test 2 failed");
+            }
+        }
+    }
+}
+
+class MyPermission extends BasicPermission {
+    public MyPermission(String name) {
+        super(name);
+    }
+}

test/jdk/java/security/BasicPermission/SerialVersion.java

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2001, 2011, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4502729 7054918
+ * @summary BasicPermissionCollection serial version UID incorrect
+ */
+
+import java.security.*;
+import java.io.*;
+
+public class SerialVersion {
+
+    public static void main(String[] args) throws Exception {
+        String dir = System.getProperty("test.src");
+        File  sFile =  new File (dir,"SerialVersion.1.2.1");
+        // read in a 1.2.1 BasicPermissionCollection
+        try (FileInputStream fis = new FileInputStream(sFile);
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("1.2.1 collection = " + pc);
+        }
+
+        // read in a 1.3.1 BasicPermissionCollection
+        sFile =  new File (dir,"SerialVersion.1.3.1");
+
+        try (FileInputStream fis = new FileInputStream(sFile);
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("1.3.1 collection = " + pc);
+        }
+
+        // read in a 1.4 BasicPermissionCollection
+        sFile =  new File (dir,"SerialVersion.1.4");
+        try (FileInputStream fis = new FileInputStream(sFile);
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("1.4 collection = " + pc);
+        }
+
+        // write out current BasicPermissionCollection
+        MyPermission mp = new MyPermission("SerialVersionTest");
+        PermissionCollection bpc = mp.newPermissionCollection();
+        sFile =  new File (dir,"SerialVersion.current");
+        try (FileOutputStream fos = new FileOutputStream("SerialVersion.current");
+                ObjectOutputStream oos = new ObjectOutputStream(fos)) {
+            oos.writeObject(bpc);
+        }
+
+        // read in current BasicPermissionCollection
+        try (FileInputStream fis = new FileInputStream("SerialVersion.current");
+                ObjectInputStream ois = new ObjectInputStream(fis)) {
+            PermissionCollection pc = (PermissionCollection)ois.readObject();
+            System.out.println("current collection = " + pc);
+        }
+    }
+}
+
+class MyPermission extends BasicPermission {
+    public MyPermission(String name) {
+        super(name);
+    }
+}

test/jdk/java/security/BasicPermission/Wildcard.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.lang.RuntimePermission;
+import java.net.NetPermission;
+import java.sql.SQLPermission;
+import java.util.PropertyPermission;
+import javax.net.ssl.SSLPermission;
+
+/*
+ * @test
+ * @bug 7167056
+ * @summary Check that BasicPermission subclasses don't throw exception if name
+ *          contains wildcard character ("*") but does not signify a
+ *          wildcard match
+ * @modules java.sql
+ */
+
+public class Wildcard {
+
+    public static void main(String[] args) throws Exception {
+        wildcard("*java");
+        wildcard("java*");
+        wildcard("ja*va");
+    }
+
+    private static void wildcard(String wildcard) throws Exception {
+        new RuntimePermission(wildcard);
+        new NetPermission(wildcard);
+        new SQLPermission(wildcard);
+        new PropertyPermission(wildcard, "read");
+        new SSLPermission(wildcard);
+    }
+}

test/jdk/java/security/CodeSigner/Serialize.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 6799854
+ * @summary CodeSigner.hashCode() does not work with serialization
+ */
+
+import java.io.*;
+import java.security.CodeSigner;
+import java.security.Timestamp;
+import java.security.cert.*;
+import java.util.Collections;
+import java.util.Date;
+
+public class Serialize {
+
+    public static void main(String[] args) throws Exception {
+
+        // Create a certpath consisting of one certificate
+        File f = new File(System.getProperty("test.src", "."), "cert_file");
+        FileInputStream fis = new FileInputStream(f);
+        CertificateFactory cf = CertificateFactory.getInstance("X.509");
+        Certificate c = cf.generateCertificate(fis);
+        fis.close();
+        CertPath cp = cf.generateCertPath(Collections.singletonList(c));
+
+        // Create a code signer
+        CodeSigner cs = new CodeSigner(cp, new Timestamp(new Date(), cp));
+
+        // Serialize the code signer
+        ByteArrayOutputStream byteOut = new ByteArrayOutputStream();
+        ObjectOutputStream out = new ObjectOutputStream(byteOut);
+        out.writeObject(cs);
+        out.close();
+
+        // Deserialize the code signer
+        byte[] data = byteOut.toByteArray();
+        CodeSigner cs2 = (CodeSigner) new ObjectInputStream(
+            new ByteArrayInputStream(data)).readObject();
+
+        // Test for equality
+        if (!cs.equals(cs2) || cs.hashCode() != cs2.hashCode()) {
+            throw new Exception("CodeSigner serialization test FAILED");
+        }
+    }
+}

test/jdk/java/security/CodeSource/CertsMatch.java

@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2005, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+ /*
+ * @test
+ * @bug 6299163
+ * @summary Test to compare java.security.CodeSource
+ *          Instructions to re-create the used certs file.
+ *          - Generate a self-signed certificate with basicConstraints=CA:TRUE
+ *          - Copy the generated certificate 2 times into a newly created certs file.
+ */
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.net.URL;
+import java.security.CodeSigner;
+import java.security.CodeSource;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.util.ArrayList;
+import java.util.List;
+
+public class CertsMatch {
+
+    public static void main(String[] args) throws Exception {
+
+        File certsFile = new File(System.getProperty("test.src", "."), "certs");
+        CertificateFactory cf = CertificateFactory.getInstance("X.509");
+
+        try (FileInputStream fis = new FileInputStream(certsFile);
+                BufferedInputStream bis = new BufferedInputStream(fis)) {
+
+            ArrayList certs1 = new ArrayList();
+            ArrayList certs2 = new ArrayList();
+
+            // read the first cert
+            Certificate cert = cf.generateCertificate(bis);
+            certs1.add(cert);
+            certs2.add(cert);
+
+            // read the second cert
+            cert = cf.generateCertificate(bis);
+            certs2.add(cert);
+
+            URL location = certsFile.toURI().toURL();
+            CodeSource cs0 = new CodeSource(location, (Certificate[]) null);
+            CodeSource cs1 = new CodeSource(location,
+                    (Certificate[]) certs1.toArray(new Certificate[certs1.size()]));
+            CodeSource cs2 = new CodeSource(location,
+                    (Certificate[]) certs2.toArray(new Certificate[certs2.size()]));
+
+            if (!cs0.implies(cs1) || !cs1.implies(cs2)) {
+                throw new Exception("The implies method is not working correctly");
+            }
+            if (cs0.equals(cs1) || cs1.equals(cs0)
+                    || cs2.equals(cs1) || cs1.equals(cs2)) {
+                throw new Exception("The equals method is not working correctly");
+            }
+            if (verifySigner(cs0.getCodeSigners(), null)) {
+                throw new RuntimeException("CodeSource.getCodeSigners() should be null");
+            }
+            if (!((verifySigner(cs1.getCodeSigners(), certs1))
+                    && (verifySigner(cs2.getCodeSigners(), certs2)))) {
+                throw new RuntimeException("Mismatched CodeSigners certificate");
+            }
+        }
+    }
+
+    private static boolean verifySigner(CodeSigner[] css, List certs) {
+        if (css == null || certs == null) {
+            return false;
+        }
+        if (css.length < 1 || certs.size() < 1) {
+            return false;
+        }
+        boolean result = true;
+        for (CodeSigner cs : css) {
+            result &= cs.getSignerCertPath().getCertificates().equals(certs);
+        }
+        return result;
+    }
+}

test/jdk/java/security/CodeSource/CodeSourceNoInputs.java

@@ -0,0 +1,110 @@
+/*
+ * Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.security.CodeSigner;
+import java.security.CodeSource;
+import java.security.PublicKey;
+import java.security.cert.Certificate;
+
+/**
+ * @test
+ * @bug 8366522
+ * @summary Verify that getCertificates() and getCodeSigners() return correct
+ *          results when CodeSource is created with empty or null Certificate[]
+ *          or CodeSigner[] arguments, or there are no X509 certificates in
+ *          certs. Make sure that NPE is not thrown from
+ *          CodeSource.getCodeSigners()
+ */
+public class CodeSourceNoInputs {
+    private static final Certificate NON_X509_CERT = new Certificate("") {
+        @Override
+        public byte[] getEncoded() {
+            return new byte[0];
+        }
+
+        @Override
+        public void verify(PublicKey key) {
+        }
+
+        @Override
+        public void verify(PublicKey key, String sigProvider) {
+        }
+
+        @Override
+        public String toString() {
+            return "";
+        }
+
+        @Override
+        public PublicKey getPublicKey() {
+            return null;
+        }
+    };
+
+    public static void main(String[] args) throws Exception {
+        CodeSource cs;
+
+        cs = new CodeSource(null, (Certificate[]) null);
+        if (cs.getCodeSigners() != null || cs.getCertificates() != null) {
+
+            throw new SecurityException("Both CodeSource.getCodeSigners() " +
+                "and CodeSource.getCertificates() should return null for " +
+                "new CodeSource(null, (Certificate[]) null)");
+        }
+
+        cs = new CodeSource(null, (CodeSigner[]) null);
+        if (cs.getCodeSigners() != null || cs.getCertificates() != null) {
+
+            throw new SecurityException("Both CodeSource.getCodeSigners() " +
+                "and CodeSource.getCertificates() should return null for " +
+                "new CodeSource(null, (CodeSigners[]) null)");
+        }
+
+        cs = new CodeSource(null, new Certificate[0]);
+        if (cs.getCodeSigners().length != 0
+            || cs.getCertificates().length != 0) {
+
+            throw new SecurityException("Both CodeSource.getCodeSigners()" +
+                "and CodeSource.getCertificates() should return empty arrays " +
+                "for new CodeSource(null, new Certificate[0])");
+
+        }
+
+        cs = new CodeSource(null, new CodeSigner[0]);
+        if (cs.getCodeSigners().length != 0
+            || cs.getCertificates().length != 0) {
+
+            throw new SecurityException("Both CodeSource.getCodeSigners() and" +
+                " CodeSource.getCertificates() should return empty arrays for" +
+                " new CodeSource(null, new CodeSigners[0])");
+        }
+
+        cs = new CodeSource(null, new Certificate[]{NON_X509_CERT});
+        if (cs.getCodeSigners().length != 0 || cs.getCertificates() == null) {
+
+            throw new SecurityException("Both CodeSource.getCodeSigners() and" +
+                " CodeSource.getCertificates() should return arrays for new" +
+                " CodeSource(null, new CodeSigners[1]{NON-X509-CERTIFICATE})");
+        }
+    }
+}

test/jdk/java/security/CodeSource/Implies.java

@@ -0,0 +1,103 @@
+/*
+ * Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4866847 7152564 7155693 8356557
+ * @summary various CodeSource.implies tests
+ */
+
+import java.security.CodeSource;
+import java.net.InetAddress;
+import java.net.URL;
+
+public class Implies {
+
+    public static void main(String[] args) throws Exception {
+        URL thisURL = new URL("http", "localhost", "file");
+        URL thatURL = new URL("http", null, "file");
+        // should not throw NullPointerException
+        testImplies(thisURL, thatURL, false);
+
+        thisURL = new URL("http", "localhost", "dir/-");
+        thatURL = new URL("HTTP", "localhost", "dir/file");
+        // protocol check should ignore case
+        testImplies(thisURL, thatURL, true);
+
+        thisURL = new URL("http", "localhost", 80, "dir/-");
+        thatURL = new URL("HTTP", "localhost", "dir/file");
+        // port check should match default port of thatURL
+        testImplies(thisURL, thatURL, true);
+
+        thisURL = new URL("http", "204.160.241.0", "file");
+        thatURL = new URL("http", "localhost", "file");
+        // ip address should not imply localhost's IP address
+        testImplies(thisURL, thatURL, false);
+
+        thisURL = new URL("http", "204.160.241.0", "file");
+        thatURL = new URL("http", "*.example.com", "file");
+        // ip address should not imply wildcarded host
+        testImplies(thisURL, thatURL, false);
+
+        InetAddress ia = InetAddress.getLocalHost();
+        thisURL = new URL("http", ia.getHostAddress(), "file");
+        thatURL = new URL("http", ia.getHostName(), "file");
+        // ip address should imply host name with same ip address
+        testImplies(thisURL, thatURL, true);
+
+        thisURL = new URL("http", "*.example.com", "file");
+        thatURL = new URL("http", "*.foo.example.com", "file");
+        // wildcarded host name should imply wildcarded host name ending with
+        // same canonical host name
+        testImplies(thisURL, thatURL, true);
+
+        thisURL = new URL("http", "example.com", "file");
+        thatURL = new URL("http", "*.foo.example.com", "file");
+        // host name should not imply wildcarded host name ending with same
+        // canonical host name
+        testImplies(thisURL, thatURL, false);
+
+        thisURL = new URL("http", "*.example.com", "file");
+        thatURL = new URL("http", "foo.example.com", "file");
+        // wildcarded host name should imply host name ending with same
+        // canonical host name
+        testImplies(thisURL, thatURL, true);
+
+        System.out.println("test passed");
+    }
+
+    private static void testImplies(URL thisURL, URL thatURL, boolean result)
+            throws SecurityException {
+        CodeSource thisCs
+                = new CodeSource(thisURL, (java.security.cert.Certificate[]) null);
+        CodeSource thatCs
+                = new CodeSource(thatURL, (java.security.cert.Certificate[]) null);
+        if (thisCs.implies(thatCs) != result) {
+            throw new SecurityException("CodeSource.implies() returned "
+                    + !result + " instead of " + result);
+        }
+        if (thisCs.getCodeSigners() != null && thatCs.getCodeSigners() != null) {
+            throw new SecurityException("Both getCodeSigners should be null");
+        }
+    }
+}

test/jdk/java/security/CodeSource/certs

@@ -0,0 +1,42 @@
+-----BEGIN CERTIFICATE-----
+MIIDgzCCAmugAwIBAgIJALi3XHB1pDxTMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
+BAYTAlVTMQ0wCwYDVQQIDAR0ZXN0MQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDAR0
+ZXN0MQ0wCwYDVQQLDAR0ZXN0MQ0wCwYDVQQDDAR0ZXN0MB4XDTIyMDYwODA3Mzkz
+MFoXDTQ3MDYwMjA3MzkzMFowWDELMAkGA1UEBhMCVVMxDTALBgNVBAgMBHRlc3Qx
+DTALBgNVBAcMBHRlc3QxDTALBgNVBAoMBHRlc3QxDTALBgNVBAsMBHRlc3QxDTAL
+BgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUfQUR
+jdnE1KyZKjPoL2np9T9grBJFaApt1oxNOXLzOW19EYUbbmzERKf9bHALfYIRZonj
+wYEywWMLxVuM1YdJAKO2X/X2nvPZLmi9BPVa0aGyG/X19L9FKXEKugzujrq2gko0
+ryDpV1Rrbqpv5G9wXA1+jzPVteFgCX9IoNLEatXVAN8gfnuOCvAM83VMit91+LNs
+uK9Eo9xcPyVt0n7Tl+VtW/nVzlRz/p6xHIB0Uo3Dl//QziMllWng98TCxtcTvOBd
+gl1AlTAwFWGwQRL2xC8iFrJ5vgY4/afth68W0pqsIH5TCJumGVf/0VBYIs+OWdyT
+Wu0Eswjx34gsuvyTAgMBAAGjUDBOMB0GA1UdDgQWBBRmeQRExt2gPyc+b6fB8hL8
++oiT+jAfBgNVHSMEGDAWgBRmeQRExt2gPyc+b6fB8hL8+oiT+jAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCRlgYqBPXnrhHySR0GzTG2eSQ2B6MqLTOX
+nt10kmp92zFJ/AZIoHZGyNC45dRXLX1ZcV8dtAKzbZLo2u07TGxM/q66bHOpXbCn
+FGZqyhanDrkwHWPI58pyDuzRKUQKq+kuwpctDiZpjVBcZIVP/ecZcI0DO7qKWEXc
+JVXgfkqjU0PMCQDpahDuPLQ3otYDUgNAY82c4WETypjTE8GaLCg++JmPy0Yo8kR4
+VBabOgp4FJi+DDo7VNZRuCTZG91pNlKUZNnR/T1VO0KPtbJoRV5XBRcwdCfhtxNW
+lK33pqJx7xAY5Gkg+SdvQOA0d4y6YbCF7eO1QyA5x+dqq+YGHpw7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDgzCCAmugAwIBAgIJALi3XHB1pDxTMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
+BAYTAlVTMQ0wCwYDVQQIDAR0ZXN0MQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDAR0
+ZXN0MQ0wCwYDVQQLDAR0ZXN0MQ0wCwYDVQQDDAR0ZXN0MB4XDTIyMDYwODA3Mzkz
+MFoXDTQ3MDYwMjA3MzkzMFowWDELMAkGA1UEBhMCVVMxDTALBgNVBAgMBHRlc3Qx
+DTALBgNVBAcMBHRlc3QxDTALBgNVBAoMBHRlc3QxDTALBgNVBAsMBHRlc3QxDTAL
+BgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUfQUR
+jdnE1KyZKjPoL2np9T9grBJFaApt1oxNOXLzOW19EYUbbmzERKf9bHALfYIRZonj
+wYEywWMLxVuM1YdJAKO2X/X2nvPZLmi9BPVa0aGyG/X19L9FKXEKugzujrq2gko0
+ryDpV1Rrbqpv5G9wXA1+jzPVteFgCX9IoNLEatXVAN8gfnuOCvAM83VMit91+LNs
+uK9Eo9xcPyVt0n7Tl+VtW/nVzlRz/p6xHIB0Uo3Dl//QziMllWng98TCxtcTvOBd
+gl1AlTAwFWGwQRL2xC8iFrJ5vgY4/afth68W0pqsIH5TCJumGVf/0VBYIs+OWdyT
+Wu0Eswjx34gsuvyTAgMBAAGjUDBOMB0GA1UdDgQWBBRmeQRExt2gPyc+b6fB8hL8
++oiT+jAfBgNVHSMEGDAWgBRmeQRExt2gPyc+b6fB8hL8+oiT+jAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCRlgYqBPXnrhHySR0GzTG2eSQ2B6MqLTOX
+nt10kmp92zFJ/AZIoHZGyNC45dRXLX1ZcV8dtAKzbZLo2u07TGxM/q66bHOpXbCn
+FGZqyhanDrkwHWPI58pyDuzRKUQKq+kuwpctDiZpjVBcZIVP/ecZcI0DO7qKWEXc
+JVXgfkqjU0PMCQDpahDuPLQ3otYDUgNAY82c4WETypjTE8GaLCg++JmPy0Yo8kR4
+VBabOgp4FJi+DDo7VNZRuCTZG91pNlKUZNnR/T1VO0KPtbJoRV5XBRcwdCfhtxNW
+lK33pqJx7xAY5Gkg+SdvQOA0d4y6YbCF7eO1QyA5x+dqq+YGHpw7
+-----END CERTIFICATE-----

test/jdk/java/security/DigestInputStream/TestSkipAndReset.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import jdk.test.lib.Asserts;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.DigestInputStream;
+import java.security.MessageDigest;
+
+/**
+ * @test
+ * @bug 6587699
+ * @summary Document DigestInputStream behavior when skip() or mark() / reset() is used
+ * @library /test/lib
+ */
+
+public class TestSkipAndReset {
+    public static void main(String[] args) throws Exception {
+        byte[] data = "1234567890".getBytes(StandardCharsets.UTF_8);
+        MessageDigest md = MessageDigest.getInstance("SHA-256");
+        DigestInputStream dis = new DigestInputStream(new ByteArrayInputStream(data), md);
+
+        dis.read(); // read 1
+        dis.read(new byte[2], 0, 1); // read 2
+        dis.skip(3); // skip 3 4 5
+        dis.mark(10); // remember 5
+        dis.read(new byte[2]); // read 6 7
+        dis.skip(1); // skip 8
+        dis.read(); // read 9
+        dis.reset(); // back to 5
+        dis.readNBytes(3); // read 6 7 8
+        dis.reset(); // back to 5
+        dis.skip(2); // skip 6 7
+        dis.readAllBytes(); // read 8 9 0
+        dis.reset(); // back to 5
+        dis.skip(3); // skip 6 7 8
+        dis.transferTo(new ByteArrayOutputStream()); // read 9 0
+
+        byte[] hash = md.digest();
+        byte[] directHash = md.digest("1267967889090".getBytes(StandardCharsets.UTF_8));
+
+        Asserts.assertTrue(MessageDigest.isEqual(hash, directHash));
+    }
+}

test/jdk/java/security/Exceptions/ChainingConstructors.java

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4496095 8296406
+ * @summary Test constructors for exception chaining of security-related exceptions
+ */
+
+import java.security.*;
+import java.security.cert.*;
+import java.security.spec.*;
+import javax.net.ssl.*;
+
+public class ChainingConstructors {
+
+    private static final String MSG = "msg";
+    private static Exception cause = new Exception("cause");
+
+    public static <E extends Exception> void test(E ex1, E ex2) throws Exception {
+        String cln = ex1.getClass().getSimpleName();
+        if (!ex1.getCause().equals(cause)) {
+            throw new SecurityException("Cause test failed for " + cln);
+        }
+        if (!ex2.getMessage().equals(MSG) || !ex2.getCause().equals(cause)) {
+            throw new SecurityException("Cause and message test failed for " + cln);
+        }
+    }
+
+    public static void main(String[] args) throws Exception {
+        test(new SecurityException(cause), new SecurityException(MSG, cause));
+        test(new DigestException(cause), new DigestException(MSG, cause));
+        test(new GeneralSecurityException(cause), new GeneralSecurityException(MSG, cause));
+        test(new InvalidAlgorithmParameterException(cause),
+             new InvalidAlgorithmParameterException(MSG, cause));
+        test(new InvalidKeyException(cause), new InvalidKeyException(MSG, cause));
+        test(new InvalidKeySpecException(cause), new InvalidKeySpecException(MSG, cause));
+        test(new InvalidParameterException(cause), new InvalidParameterException(MSG, cause));
+        test(new KeyException(cause), new KeyException(MSG, cause));
+        test(new KeyManagementException(cause), new KeyManagementException(MSG, cause));
+        test(new KeyStoreException(cause), new KeyStoreException(MSG, cause));
+        test(new NoSuchAlgorithmException(cause), new NoSuchAlgorithmException(MSG, cause));
+        test(new ProviderException(cause), new ProviderException(MSG, cause));
+        test(new SignatureException(cause), new SignatureException(MSG, cause));
+        test(new CRLException(cause), new CRLException(MSG, cause));
+        test(new CertificateException(cause), new CertificateException(MSG, cause));
+        test(new CertificateParsingException(cause), new CertificateParsingException(MSG, cause));
+        test(new CertificateEncodingException(cause), new CertificateEncodingException(MSG, cause));
+        test(new CertPathBuilderException(cause), new CertPathBuilderException(MSG, cause));
+        test(new SSLException(cause), new SSLException(MSG, cause));
+    }
+}

test/jdk/java/security/Identity/EqualsHashCodeContract.java

@@ -0,0 +1,146 @@
+/*
+ * Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @author Gary Ellison
+ * @bug 4183136
+ * @summary java.security.Identity violates equals/hashCode contract
+ */
+import java.security.*;
+import java.io.*;
+
+public class EqualsHashCodeContract
+{
+    public static void main(String args[]) throws Exception {
+
+        Identity i1=new MyIdentity("identity",
+                                   new MyIdentityScope("IdentityScope"));
+        Identity i2=new MyIdentity("identity",
+                                   new MyIdentityScope("IdentityScope"));
+        Identity i3=new MyIdentity("identity",
+                                   new MyIdentityScope(""));
+
+        PublicKey pk1=new MyPublicKey();
+        PublicKey pk2=new MyPublicKey();
+
+        if ( !(i1.equals(i2)) == (i1.hashCode()==i2.hashCode()) ) {
+            System.err.println("FAILED");
+            Exception up = new
+                Exception("Contract violated -- same name and same scope");
+            throw up;
+        }
+        System.out.println("Test same name, same scope........... PASSED");
+
+        i1.setPublicKey(pk1);
+        i3.setPublicKey(pk1);
+        if ( !((i1.equals(i3)) && (i1.hashCode()==i3.hashCode()))) {
+            System.err.println("FAILED");
+            Exception up = new Exception("Contract violated -- PublicKeys do not differ");
+            throw up;
+        }
+        System.out.println("Test same name, same PublicKeys ..... PASSED");
+
+        System.out.println("TEST PASSED");
+
+    }
+}
+
+class MyIdentity extends Identity {
+    public MyIdentity(String name, IdentityScope is) throws KeyManagementException {
+        super(name, is);
+    }
+}
+
+class MyPublicKey implements PublicKey, Certificate {
+    private byte e[] = null;
+    public String getAlgorithm() {
+        return null;
+    }
+    public String getFormat() {
+        return new String("PKCS15");
+    }
+
+    public byte[] getEncoded() {
+        if (e == null) {
+            ByteArrayOutputStream bs = new ByteArrayOutputStream();
+            DataOutputStream ds = new DataOutputStream(bs);
+            try {
+                ds.writeLong(System.currentTimeMillis());
+            } catch (IOException ioe) {
+                ioe.printStackTrace();
+            }
+            e = bs.toByteArray();
+        }
+
+        return e;
+    }
+
+    public void decode(InputStream stream) {
+    }
+    public void encode(OutputStream stream) {
+    }
+    public Principal getGuarantor() {
+        return null;
+    }
+    public Principal getPrincipal() {
+        return null;
+    }
+    public PublicKey getPublicKey() {
+        return this;
+    }
+    public String toString(boolean detailed) {
+        return null;
+    }
+}
+
+
+class MyIdentityScope extends IdentityScope {
+    public MyIdentityScope(String name) {
+        super(name);
+    }
+
+    public int size() {
+        return 0;
+    }
+
+    public Identity getIdentity(String name) {
+        return null;
+    }
+
+    public Identity getIdentity(PublicKey key) {
+        return null;
+    }
+
+    public void addIdentity(Identity identity)  {
+    }
+
+    public void removeIdentity(Identity identity)  {
+    }
+
+    public java.util.Enumeration identities() {
+        return null;
+    }
+
+
+}

test/jdk/java/security/IdentityScope/NoDefaultSystemScope.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 6921001
+ * @summary The default system identity scope is now null.
+ */
+import java.security.*;
+
+public class NoDefaultSystemScope {
+
+    public static void main(String args[]) throws Exception {
+        IdentityScope s = IdentityScope.getSystemScope();
+
+        if (s != null) {
+            throw new Exception("The default system scope should be null");
+        }
+        System.out.println("TEST PASSED");
+    }
+}
+

test/jdk/java/security/KeyAgreement/Generic.java

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8189441
+ * @library /test/lib /test/jdk/sun/security/pkcs11
+ * @summary make sure Generic is accepted by all KeyAgreement implementations
+ * @run main Generic builtin
+ * @run main/othervm Generic nss
+ * @run main/othervm -DCUSTOM_P11_CONFIG_NAME=p11-nss-sensitive.txt Generic nss
+ */
+import jdk.test.lib.Asserts;
+
+import javax.crypto.KeyAgreement;
+import java.security.KeyPairGenerator;
+import java.security.Provider;
+import java.security.Security;
+import java.util.List;
+
+public class Generic {
+
+    public static void main(String[] args) throws Exception {
+        if (args[0].equals("nss")) {
+            test(PKCS11Test.getSunPKCS11(PKCS11Test.getNssConfig()));
+        } else {
+            for (var p : Security.getProviders()) {
+                test(p);
+            }
+        }
+    }
+
+    static void test(Provider p) throws Exception {
+        for (var s : p.getServices()) {
+            if (s.getType().equalsIgnoreCase("KeyAgreement")) {
+                try {
+                    System.out.println(s.getProvider().getName() + "." + s.getAlgorithm());
+                    var g = KeyPairGenerator.getInstance(ka2kpg(s.getAlgorithm()), p);
+                    var kp1 = g.generateKeyPair();
+                    var kp2 = g.generateKeyPair();
+                    var ka = KeyAgreement.getInstance(s.getAlgorithm(), s.getProvider());
+                    for (var alg : List.of("TlsPremasterSecret", "Generic")) {
+                        ka.init(kp1.getPrivate());
+                        ka.doPhase(kp2.getPublic(), true);
+                        Asserts.assertEquals(
+                                ka.generateSecret(alg).getAlgorithm(), alg);
+                    }
+                } catch (Exception e) {
+                    throw e;
+                }
+            }
+        }
+    }
+
+    // Find key algorithm from KeyAgreement algorithm
+    private static String ka2kpg(String ka) {
+        return ka.equals("ECDH") ? "EC" : ka;
+    }
+}

test/jdk/java/security/KeyAgreement/KeyAgreementTest.java

@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+ /*
+ * @test
+ * @bug 4936763 8184359 8205476 8226307
+ * @summary KeyAgreement Test with all supported algorithms from JCE.
+ *          Arguments order <KeyExchangeAlgorithm> <KeyGenAlgorithm> <Provider>
+ *          It removes com/sun/crypto/provider/KeyAgreement/DHGenSecretKey.java
+ *          as the same functionality for DiffieHellman is covered along with
+ *          this test file was covered before with JDK-4936763.
+ * @run main/othervm -Djdk.crypto.KeyAgreement.legacyKDF=true KeyAgreementTest
+ *          DiffieHellman DH SunJCE
+ * @run main KeyAgreementTest ECDH EC SunEC
+ * @run main KeyAgreementTest XDH XDH SunEC
+ */
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.spec.NamedParameterSpec;
+import java.security.spec.AlgorithmParameterSpec;
+import java.security.spec.ECGenParameterSpec;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import javax.crypto.KeyAgreement;
+import javax.crypto.spec.DHGenParameterSpec;
+
+public class KeyAgreementTest {
+
+    public static void main(String[] args) throws Exception {
+
+        String kaAlgo = args[0];
+        String kpgAlgo = args[1];
+        String provider = System.getProperty("test.provider.name", args[2]);
+        System.out.println("Testing " + kaAlgo);
+        AlgoSpec aSpec = AlgoSpec.valueOf(AlgoSpec.class, kaAlgo);
+        List<AlgorithmParameterSpec> specs = aSpec.getAlgorithmParameterSpecs();
+        for (AlgorithmParameterSpec spec : specs) {
+            testKeyAgreement(provider, kaAlgo, kpgAlgo, spec);
+        }
+    }
+
+    /**
+     * Generate AlgorithmParameterSpec using all possible supported curve for
+     * KeyExchangeAlgorithm.
+     */
+    private enum AlgoSpec {
+        // EC curve supported for KeyGeneration can found between intersection
+        // of curves define in
+        // "java.base/share/classes/sun/security/util/CurveDB.java"
+
+        ECDH("secp256r1", "secp384r1", "secp521r1"),
+        XDH("X25519", "X448", "x25519"),
+        // There is no curve for DiffieHellman
+        DiffieHellman(new String[]{});
+
+        private final List<AlgorithmParameterSpec> specs = new ArrayList<>();
+
+        private AlgoSpec(String... curves) {
+            // Generate AlgorithmParameterSpec for each KeyExchangeAlgorithm
+            for (String crv : curves) {
+                switch (this.name()) {
+                    case "ECDH":
+                        specs.add(new ECGenParameterSpec(crv));
+                        break;
+                    case "XDH":
+                        specs.add(new NamedParameterSpec(crv));
+                        break;
+                    case "DiffieHellman":
+                        specs.add(new DHGenParameterSpec(512, 64));
+                        break;
+                    default:
+                        throw new RuntimeException("Invalid Algo name "
+                                + this.name());
+                }
+            }
+        }
+
+        public List<AlgorithmParameterSpec> getAlgorithmParameterSpecs() {
+            return this.specs;
+        }
+    }
+
+    /**
+     * Perform KeyAgreement operation
+     */
+    private static void testKeyAgreement(String provider, String kaAlgo,
+            String kpgAlgo, AlgorithmParameterSpec spec) throws Exception {
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgo, provider);
+        kpg.initialize(spec);
+        if (spec instanceof ECGenParameterSpec) {
+            System.out.println("Testing curve: " +
+                    ((ECGenParameterSpec)spec).getName());
+        } else if (spec instanceof NamedParameterSpec) {
+                System.out.println("Testing curve: " +
+                        ((NamedParameterSpec)spec).getName());
+        }
+        KeyPair kp1 = kpg.generateKeyPair();
+        KeyPair kp2 = kpg.generateKeyPair();
+
+        // Uses KeyAgreement based on Provider search order.
+        KeyAgreement ka1 = KeyAgreement.getInstance(kaAlgo);
+        ka1.init(kp1.getPrivate());
+        ka1.doPhase(kp2.getPublic(), true);
+        byte[] secret1 = ka1.generateSecret();
+
+        // Uses SunJCE provider
+        KeyAgreement ka2 = KeyAgreement.getInstance(kaAlgo, provider);
+        ka2.init(kp2.getPrivate());
+        ka2.doPhase(kp1.getPublic(), true);
+        // Keeping the legacy generateSecret method for DiffieHellman as it was
+        // defined in removed Test file from JDK-4936763,
+        // com/sun/crypto/provider/KeyAgreement/DHGenSecretKey.java.
+        byte[] secret2 = "DiffieHellman".equals(kaAlgo)
+                ? ka2.generateSecret("AES").getEncoded() : ka2.generateSecret();
+
+        // With related keypairs, each provider should generate same
+        // KeyAgreement secret.
+        if (!Arrays.equals(secret1, secret2)) {
+            throw new Exception("KeyAgreement secret mismatch.");
+        }
+
+        // ensure that a new secret cannot be produced before the next doPhase
+        try {
+            ka2.generateSecret();
+            throw new RuntimeException("state not reset");
+        } catch (IllegalStateException ex) {
+            // this is expected
+        }
+
+        // calling doPhase and then generateSecret should succeed
+        ka2.doPhase(kp1.getPublic(), true);
+        ka2.generateSecret();
+    }
+}

test/jdk/java/security/KeyAgreement/KeySizeTest.java

@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+ /*
+ * @test
+ * @bug 8184359
+ * @summary KeyLength support test for DiffieHellman, EC, XDH.
+ *  Arguments order <KeyExchangeAlgorithm> <Provider> <KeyGenAlgorithm> <keyLen>
+ * @library /test/lib
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 512
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 768
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 832
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 1024
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 2048
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 3072
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 4096
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 6144
+ * @run main KeySizeTest DiffieHellman SunJCE DiffieHellman 8192
+ * @run main/othervm KeySizeTest ECDH SunEC EC 256
+ * @run main/othervm KeySizeTest ECDH SunEC EC 384
+ * @run main/othervm KeySizeTest ECDH SunEC EC 521
+ * @run main KeySizeTest XDH SunEC XDH 255
+ * @run main KeySizeTest XDH SunEC XDH 448
+ */
+import java.math.BigInteger;
+import java.security.KeyFactory;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.interfaces.ECPrivateKey;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.XECPrivateKey;
+import java.security.interfaces.XECPublicKey;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.security.spec.NamedParameterSpec;
+import java.util.Arrays;
+import java.util.HexFormat;
+import javax.crypto.KeyAgreement;
+import javax.crypto.interfaces.DHPrivateKey;
+import javax.crypto.interfaces.DHPublicKey;
+
+public class KeySizeTest {
+
+    public static void main(String[] args) throws Exception {
+
+        String kaAlgo = args[0];
+        String provider = System.getProperty("test.provider.name", args[1]);
+        String kpgAlgo = args[2];
+        int keySize = Integer.parseInt(args[3]);
+        testKeyAgreement(provider, kaAlgo, kpgAlgo, keySize);
+    }
+
+    /**
+     * Perform KeyAgreement operation.
+     */
+    private static void testKeyAgreement(String provider, String kaAlgo,
+            String kpgAlgo, int keySize) throws Exception {
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgo, provider);
+        kpg.initialize(keySize);
+        KeyPair kp = kpg.generateKeyPair();
+        // Test standard Key attributes.
+        testKeyAttributes(provider, kpgAlgo, kp, keySize);
+        // Test KeyAgreement.
+        KeyAgreement ka = KeyAgreement.getInstance(kaAlgo, provider);
+        ka.init(kp.getPrivate());
+        ka.doPhase(kp.getPublic(), true);
+        ka.generateSecret();
+    }
+
+    /**
+     * Test standard Key attributes.
+     */
+    private static void testKeyAttributes(String provider, String kpgAlgo,
+            KeyPair kp, int keySize) throws Exception {
+
+        KeyFactory kf = KeyFactory.getInstance(kpgAlgo, provider);
+        switch (kpgAlgo) {
+            case "DiffieHellman":
+                // Verify PrivateKey attributes.
+                DHPrivateKey dhPri = (DHPrivateKey) kp.getPrivate();
+                BigInteger p = dhPri.getParams().getP();
+                if (p.bitLength() != keySize) {
+                    throw new Exception(String.format("Invalid modulus size: "
+                            + "%s/%s", p.bitLength(), keySize));
+                }
+                if (!p.isProbablePrime(128)) {
+                    throw new Exception("The modulus is composite!");
+                }
+                PKCS8EncodedKeySpec dhPriSpec
+                        = new PKCS8EncodedKeySpec(dhPri.getEncoded());
+                DHPrivateKey dhPriDecod
+                        = (DHPrivateKey) kf.generatePrivate(dhPriSpec);
+                equals(dhPri.getX(), dhPriDecod.getX());
+                equals(dhPri.getFormat(), dhPriDecod.getFormat());
+                equals(dhPri.getEncoded(), dhPriDecod.getEncoded());
+                equals(dhPri.getParams().getG(), dhPriDecod.getParams().getG());
+                equals(dhPri.getParams().getL(), dhPriDecod.getParams().getL());
+                equals(dhPri.getParams().getP(), dhPriDecod.getParams().getP());
+
+                // Verify PublicKey attributes.
+                DHPublicKey dhPub = (DHPublicKey) kp.getPublic();
+                p = dhPub.getParams().getP();
+                if (p.bitLength() != keySize) {
+                    throw new Exception(String.format("Invalid modulus size: "
+                            + "%s/%s", p.bitLength(), keySize));
+                }
+                X509EncodedKeySpec dhPubSpec
+                        = new X509EncodedKeySpec(dhPub.getEncoded());
+                DHPublicKey dhPubDecod
+                        = (DHPublicKey) kf.generatePublic(dhPubSpec);
+                equals(dhPub.getY(), dhPubDecod.getY());
+                equals(dhPub.getFormat(), dhPubDecod.getFormat());
+                equals(dhPub.getEncoded(), dhPubDecod.getEncoded());
+                equals(dhPub.getParams().getG(), dhPubDecod.getParams().getG());
+                equals(dhPub.getParams().getL(), dhPubDecod.getParams().getL());
+                equals(dhPub.getParams().getP(), dhPubDecod.getParams().getP());
+
+                BigInteger left = BigInteger.ONE;
+                BigInteger right = p.subtract(BigInteger.ONE);
+                BigInteger x = dhPri.getX();
+                if ((x.compareTo(left) <= 0) || (x.compareTo(right) >= 0)) {
+                    throw new Exception(
+                            "X outside range [2, p - 2]: x: " + x + " p: " + p);
+                }
+                BigInteger y = dhPub.getY();
+                if ((y.compareTo(left) <= 0) || (y.compareTo(right) >= 0)) {
+                    throw new Exception(
+                            "Y outside range [2, p - 2]: x: " + x + " p: " + p);
+                }
+                break;
+            case "EC":
+                // Verify PrivateKey attributes.
+                ECPrivateKey ecPriv = (ECPrivateKey) kp.getPrivate();
+                PKCS8EncodedKeySpec ecPriSpec
+                        = new PKCS8EncodedKeySpec(ecPriv.getEncoded());
+                ECPrivateKey ecPriDecod
+                        = (ECPrivateKey) kf.generatePrivate(ecPriSpec);
+                equals(ecPriv.getS(), ecPriDecod.getS());
+                equals(ecPriv.getFormat(), ecPriDecod.getFormat());
+                equals(ecPriv.getEncoded(), ecPriDecod.getEncoded());
+                equals(ecPriv.getParams().getCofactor(),
+                        ecPriDecod.getParams().getCofactor());
+                equals(ecPriv.getParams().getCurve(),
+                        ecPriDecod.getParams().getCurve());
+                equals(ecPriv.getParams().getGenerator(),
+                        ecPriDecod.getParams().getGenerator());
+                equals(ecPriv.getParams().getOrder(),
+                        ecPriDecod.getParams().getOrder());
+
+                // Verify PublicKey attributes.
+                ECPublicKey ecPub = (ECPublicKey) kp.getPublic();
+                X509EncodedKeySpec ecPubSpec
+                        = new X509EncodedKeySpec(ecPub.getEncoded());
+                ECPublicKey ecPubDecod
+                        = (ECPublicKey) kf.generatePublic(ecPubSpec);
+                equals(ecPub.getW(), ecPubDecod.getW());
+                equals(ecPub.getFormat(), ecPubDecod.getFormat());
+                equals(ecPub.getEncoded(), ecPubDecod.getEncoded());
+                equals(ecPub.getParams().getCofactor(),
+                        ecPubDecod.getParams().getCofactor());
+                equals(ecPub.getParams().getCurve(),
+                        ecPubDecod.getParams().getCurve());
+                equals(ecPub.getParams().getGenerator(),
+                        ecPubDecod.getParams().getGenerator());
+                equals(ecPub.getParams().getOrder(),
+                        ecPubDecod.getParams().getOrder());
+                break;
+            case "XDH":
+                // Verify PrivateKey attributes.
+                XECPrivateKey xdhPri = (XECPrivateKey) kp.getPrivate();
+                PKCS8EncodedKeySpec xdhPriSpec
+                        = new PKCS8EncodedKeySpec(xdhPri.getEncoded());
+                XECPrivateKey xdhPriDec
+                        = (XECPrivateKey) kf.generatePrivate(xdhPriSpec);
+                equals(xdhPri.getScalar().get(), xdhPriDec.getScalar().get());
+                equals(xdhPri.getFormat(), xdhPriDec.getFormat());
+                equals(xdhPri.getEncoded(), xdhPriDec.getEncoded());
+                equals(((NamedParameterSpec) xdhPri.getParams()).getName(),
+                        ((NamedParameterSpec) xdhPriDec.getParams()).getName());
+
+                // Verify PublicKey attributes.
+                XECPublicKey xdhPub = (XECPublicKey) kp.getPublic();
+                X509EncodedKeySpec xdhPubSpec
+                        = new X509EncodedKeySpec(xdhPub.getEncoded());
+                XECPublicKey xdhPubDec
+                        = (XECPublicKey) kf.generatePublic(xdhPubSpec);
+                equals(xdhPub.getU(), xdhPubDec.getU());
+                equals(xdhPub.getFormat(), xdhPubDec.getFormat());
+                equals(xdhPub.getEncoded(), xdhPubDec.getEncoded());
+                equals(((NamedParameterSpec) xdhPub.getParams()).getName(),
+                        ((NamedParameterSpec) xdhPubDec.getParams()).getName());
+                break;
+            default:
+                throw new RuntimeException("Invalid Algo name " + kpgAlgo);
+        }
+    }
+
+    private static boolean equals(Object actual, Object expected) {
+        boolean equals = actual.equals(expected);
+        if (!equals) {
+            throw new RuntimeException(String.format("Actual: %s, Expected: %s",
+                    actual, expected));
+        }
+        return equals;
+    }
+
+    private static boolean equals(byte[] actual, byte[] expected) {
+        boolean equals = Arrays.equals(actual, expected);
+        if (!equals) {
+            throw new RuntimeException(String.format("Actual array: %s, Expected array:%s",
+                    HexFormat.of().withUpperCase().formatHex(actual),
+                    HexFormat.of().withUpperCase().formatHex(expected)));
+        }
+        return equals;
+    }
+}

test/jdk/java/security/KeyAgreement/KeySpecTest.java

@@ -0,0 +1,318 @@
+/*
+ * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+ /*
+ * @test
+ * @bug 8184359
+ * @library /test/lib
+ * @summary Standard tests on KeySpec, KeyFactory, KeyPairs and Keys.
+ *  Arguments order <KeyExchangeAlgorithm> <Provider> <KeyGenAlgorithm> <Curve*>
+ * @run main KeySpecTest DiffieHellman SunJCE DiffieHellman
+ * @run main KeySpecTest ECDH SunEC EC
+ * @run main KeySpecTest XDH SunEC XDH X25519
+ * @run main KeySpecTest XDH SunEC XDH X448
+ */
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.security.KeyFactory;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.spec.ECPrivateKeySpec;
+import java.security.spec.ECPublicKeySpec;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.security.spec.NamedParameterSpec;
+import java.security.spec.XECPublicKeySpec;
+import java.security.spec.XECPrivateKeySpec;
+import java.security.spec.KeySpec;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Arrays;
+import javax.crypto.KeyAgreement;
+import javax.crypto.spec.DHPrivateKeySpec;
+import javax.crypto.spec.DHPublicKeySpec;
+import jdk.test.lib.security.SecurityUtils;
+
+public class KeySpecTest {
+
+    public static void main(String[] args) throws Exception {
+
+        String kaAlgo = args[0];
+        String provider = System.getProperty("test.provider.name", args[1]);
+        String kpgAlgo = args[2];
+        KeyPair kp = genKeyPair(provider, kpgAlgo,
+                (args.length > 3) ? args[3] : kpgAlgo);
+        testKeySpecs(provider, kaAlgo, kpgAlgo, kp);
+        testEncodedKeySpecs(provider, kaAlgo, kpgAlgo, kp);
+    }
+
+    /**
+     * Generate keyPair based on KeyPairGenerator algorithm.
+     */
+    private static KeyPair genKeyPair(String provider, String kpgAlgo,
+            String kpgInit) throws Exception {
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgo, provider);
+        switch (kpgInit) {
+            case "DiffieHellman":
+                kpg.initialize(SecurityUtils.getTestKeySize(kpgInit));
+                break;
+            case "EC":
+                kpg.initialize(256);
+                break;
+            case "X25519":
+                kpg.initialize(255);
+                break;
+            case "X448":
+                kpg.initialize(448);
+                break;
+            default:
+                throw new RuntimeException("Invalid Algo name " + kpgInit);
+        }
+        return kpg.generateKeyPair();
+    }
+
+    /**
+     * Standard Test with Keys and the one generated through Spec.
+     */
+    private static void testKeySpecs(String provider, String kaAlgo,
+            String kpgAlgo, KeyPair kp) throws Exception {
+
+        KeyFactory kf = KeyFactory.getInstance(kpgAlgo, provider);
+        // For each public KeySpec supported by KeyPairGenerator
+        for (Class pubSpecType
+                : getCompatibleKeySpecs(kpgAlgo, KeyType.PUBLIC)) {
+            //For each private KeySpec supported by KeyPairGenerator
+            for (Class priSpecType
+                    : getCompatibleKeySpecs(kpgAlgo, KeyType.PRIVATE)) {
+                // Transform original PublicKey through KeySpec
+                KeySpec pubSpec = kf.getKeySpec(kp.getPublic(), pubSpecType);
+                PublicKey pubKey = kf.generatePublic(pubSpec);
+                // Transform original PrivateKey through KeySpec
+                KeySpec priSpec = kf.getKeySpec(kp.getPrivate(), priSpecType);
+                PrivateKey priKey = kf.generatePrivate(priSpec);
+
+                // Test the keys are equal after transformation through KeySpec.
+                testKeyEquals(kp, pubKey, priKey);
+                // Test the keys are serializable.
+                testSerialize(kp);
+                // Test Parameter name.
+                if (!kaAlgo.equals("DiffieHellman")) {
+                    testParamName(priSpec, pubSpec);
+                }
+                // Compare KeyAgreement secret generated from original keys
+                // and by the keys after transformed through KeySpec.
+                if (!Arrays.equals(getKeyAgreementSecret(provider, kaAlgo,
+                        kp.getPublic(), kp.getPrivate()),
+                        getKeyAgreementSecret(provider, kaAlgo,
+                                pubKey, priKey))) {
+                    throw new RuntimeException("KeyAgreement secret mismatch.");
+                }
+            }
+        }
+    }
+
+    /**
+     * Standard Test with Keys and the one generated from encoded bytes.
+     */
+    private static void testEncodedKeySpecs(String provider, String kaAlgo,
+            String kpgAlgo, KeyPair kp) throws Exception {
+
+        KeyFactory kf = KeyFactory.getInstance(kpgAlgo, provider);
+        PKCS8EncodedKeySpec priSpec
+                = new PKCS8EncodedKeySpec(kp.getPrivate().getEncoded());
+        PrivateKey priKey = kf.generatePrivate(priSpec);
+
+        X509EncodedKeySpec pubSpec
+                = new X509EncodedKeySpec(kp.getPublic().getEncoded());
+        PublicKey pubKey = kf.generatePublic(pubSpec);
+
+        // Test the keys are equal after transformation through KeySpec.
+        testKeyEquals(kp, pubKey, priKey);
+        // Test the keys are serializable.
+        testSerialize(kp);
+        // Test Parameter name.
+        if (!kaAlgo.equals("DiffieHellman")) {
+            testParamName(priSpec, pubSpec);
+        }
+        // Compare KeyAgreement secret generated from original keys
+        // and by the keys after transformed through KeySpec.
+        if (!Arrays.equals(getKeyAgreementSecret(provider, kaAlgo,
+                kp.getPublic(), kp.getPrivate()),
+                getKeyAgreementSecret(provider, kaAlgo, pubKey, priKey))) {
+            throw new RuntimeException("KeyAgreement secret mismatch.");
+        }
+    }
+
+    private enum KeyType {
+        PUBLIC, PRIVATE;
+    }
+
+    /**
+     * Provides Compatible KeySpec Type list for KeyPairGenerator algorithm.
+     */
+    private static List<Class> getCompatibleKeySpecs(String kpgAlgo,
+            KeyType type) {
+
+        List<Class> specs = new ArrayList<>();
+        switch (kpgAlgo) {
+            case "DiffieHellman":
+                if (type == KeyType.PUBLIC) {
+                    return Arrays.asList(X509EncodedKeySpec.class,
+                            DHPublicKeySpec.class);
+                } else {
+                    return Arrays.asList(PKCS8EncodedKeySpec.class,
+                            DHPrivateKeySpec.class);
+                }
+            case "EC":
+                if (type == KeyType.PUBLIC) {
+                    return Arrays.asList(X509EncodedKeySpec.class,
+                            ECPublicKeySpec.class);
+                } else {
+                    return Arrays.asList(PKCS8EncodedKeySpec.class,
+                            ECPrivateKeySpec.class);
+                }
+            case "XDH":
+                if (type == KeyType.PUBLIC) {
+                    return Arrays.asList(X509EncodedKeySpec.class,
+                            XECPublicKeySpec.class);
+                } else {
+                    return Arrays.asList(PKCS8EncodedKeySpec.class,
+                            XECPrivateKeySpec.class);
+                }
+        }
+        return specs;
+    }
+
+    /**
+     * Generate KeyAgreement Secret.
+     */
+    private static byte[] getKeyAgreementSecret(String provider, String kaAlgo,
+            PublicKey pubKey, PrivateKey priKey) throws Exception {
+
+        KeyAgreement ka = KeyAgreement.getInstance(kaAlgo, provider);
+        ka.init(priKey);
+        ka.doPhase(pubKey, true);
+        return ka.generateSecret();
+    }
+
+    /**
+     * Compare original KeyPair with transformed ones.
+     */
+    private static void testKeyEquals(KeyPair kp, PublicKey pubKey,
+            PrivateKey priKey) {
+
+        if (!kp.getPrivate().equals(priKey)
+                && kp.getPrivate().hashCode() != priKey.hashCode()) {
+            throw new RuntimeException("PrivateKey is not equal with PrivateKey"
+                    + " generated through KeySpec");
+        }
+        if (!kp.getPublic().equals(pubKey)
+                && kp.getPublic().hashCode() != pubKey.hashCode()) {
+            throw new RuntimeException("PublicKey is not equal with PublicKey"
+                    + " generated through KeySpec");
+        }
+    }
+
+    /**
+     * Compare the parameter names of Public/Private KeySpec from a pair.
+     */
+    private static void testParamName(KeySpec priSpec, KeySpec pubSpec) {
+
+        if (priSpec instanceof XECPrivateKeySpec
+                && pubSpec instanceof XECPublicKeySpec) {
+            if (((NamedParameterSpec) ((XECPrivateKeySpec) priSpec)
+                    .getParams()).getName()
+                    != ((NamedParameterSpec) ((XECPublicKeySpec) pubSpec)
+                            .getParams()).getName()) {
+                throw new RuntimeException("Curve name mismatch found");
+            }
+        }
+    }
+
+    /**
+     * Test serialization of KeyPair and Keys it holds.
+     */
+    private static void testSerialize(KeyPair keyPair) throws Exception {
+
+        // Verify Serialized PrivateKey instance.
+        if (!keyPair.getPrivate().equals(
+                deserializedCopy(keyPair.getPrivate(), PrivateKey.class))) {
+            throw new RuntimeException("PrivateKey is not equal with PrivateKey"
+                    + " generated through Serialization");
+        }
+        // Verify Serialized PublicKey instance.
+        if (!keyPair.getPublic().equals(
+                deserializedCopy(keyPair.getPublic(), PublicKey.class))) {
+            throw new RuntimeException("PublicKey is not equal with PublicKey"
+                    + " generated through Serialization");
+        }
+        // Verify Serialized KeyPair instance.
+        KeyPair copy = deserializedCopy(keyPair, KeyPair.class);
+        if (!keyPair.getPrivate().equals(copy.getPrivate())) {
+            throw new RuntimeException("PrivateKey is not equal with PrivateKey"
+                    + " generated through Serialized KeyPair");
+        }
+        if (!keyPair.getPublic().equals(copy.getPublic())) {
+            throw new RuntimeException("PublicKey is not equal with PublicKey"
+                    + " generated through Serialized KeyPair");
+        }
+    }
+
+    private static <T extends Object> T deserializedCopy(T orig, Class<T> type)
+            throws IOException, ClassNotFoundException {
+        return deserialize(serialize(orig), type);
+    }
+
+    /**
+     * Deserialize the Key object.
+     */
+    private static <T extends Object> T deserialize(byte[] serialized,
+            Class<T> type) throws IOException, ClassNotFoundException {
+
+        T key = null;
+        try (ByteArrayInputStream bis = new ByteArrayInputStream(serialized);
+                ObjectInputStream ois = new ObjectInputStream(bis)) {
+            key = (T) ois.readObject();
+        }
+        return key;
+    }
+
+    /**
+     * Serialize the given Key object.
+     */
+    private static <T extends Object> byte[] serialize(T key)
+            throws IOException {
+
+        try (ByteArrayOutputStream bos = new ByteArrayOutputStream();
+                ObjectOutputStream oos = new ObjectOutputStream(bos)) {
+            oos.writeObject(key);
+            return bos.toByteArray();
+        }
+    }
+}

test/jdk/java/security/KeyAgreement/MultiThreadTest.java

@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+ /*
+ * @test
+ * @bug 8184359
+ * @library /test/lib
+ * @summary KeyPairGenerator Test with multiple threads.
+ *  Arguments order <KeyExchangeAlgorithm> <Provider> <KeyGenAlgorithm> <Curve*>
+ * @run main MultiThreadTest DiffieHellman SunJCE DiffieHellman
+ * @run main MultiThreadTest ECDH SunEC EC
+ * @run main MultiThreadTest XDH SunEC XDH X25519
+ * @run main MultiThreadTest XDH SunEC XDH X448
+ */
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.util.Arrays;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadFactory;
+import javax.crypto.KeyAgreement;
+import jdk.test.lib.security.SecurityUtils;
+
+/**
+ * This test targets KeyPairGenerator API related issue in a multi threaded
+ * context.
+ */
+public class MultiThreadTest {
+
+    // Tested a shared KeyPairGenerator with 100 number of threads.
+    private static final int THREAD_COUNT = 100;
+
+    public static void main(String[] args) throws Exception {
+
+        String kaAlgo = args[0];
+        String provider = System.getProperty("test.provider.name", args[1]);
+        String kpgAlgo = args[2];
+        KeyPairGenerator kpg = genKeyGenerator(provider, kpgAlgo,
+                (args.length > 3) ? args[3] : kpgAlgo);
+        new MultiThreadTest().runTest(provider, kaAlgo, kpg);
+    }
+
+    /**
+     * Initialize KeyPairGenerator based on different algorithm names.
+     */
+    private static KeyPairGenerator genKeyGenerator(String provider,
+            String kpgAlgo, String kpgInit) throws Exception {
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgo, provider);
+        switch (kpgInit) {
+            case "DiffieHellman":
+                kpg.initialize(SecurityUtils.getTestKeySize(kpgInit));
+                break;
+            case "EC":
+                kpg.initialize(256);
+                break;
+            case "X25519":
+                kpg.initialize(255);
+                break;
+            case "X448":
+                kpg.initialize(448);
+                break;
+            default:
+                throw new RuntimeException("Invalid Algo name " + kpgInit);
+        }
+        return kpg;
+    }
+
+    private void runTest(String provider, String kaAlgo, KeyPairGenerator kpg)
+            throws Exception {
+
+        ExecutorService executor = null;
+        try {
+            executor = Executors.newCachedThreadPool(new ThreadFactory() {
+                @Override
+                public Thread newThread(Runnable r) {
+                    Thread t = Executors.defaultThreadFactory().newThread(r);
+                    t.setDaemon(true);
+                    return t;
+                }
+            });
+            CountDownLatch latch = new CountDownLatch(THREAD_COUNT);
+
+            for (int i = 0; i < THREAD_COUNT; i++) {
+                executor.execute(new Runnable() {
+                    @Override
+                    public void run() {
+                        try {
+                            testKeyAgreement(provider, kaAlgo, kpg);
+                        } catch (Exception e) {
+                            throw new RuntimeException(e);
+                        } finally {
+                            // Indicate a task completed.
+                            latch.countDown();
+                        }
+                    }
+                });
+            }
+            // Wait till all tasks get complete.
+            latch.await();
+        } finally {
+            if (executor != null) {
+                executor.shutdown();
+            }
+        }
+    }
+
+    /**
+     * Perform KeyAgreement operation with a shared KeyPairGenerator instance.
+     */
+    private static void testKeyAgreement(String provider, String kaAlgo,
+            KeyPairGenerator kpg) throws Exception {
+
+        KeyPair kp1 = kpg.generateKeyPair();
+        KeyPair kp2 = kpg.generateKeyPair();
+
+        KeyAgreement ka1 = KeyAgreement.getInstance(kaAlgo, provider);
+        ka1.init(kp1.getPrivate());
+        ka1.doPhase(kp2.getPublic(), true);
+        byte[] secret1 = ka1.generateSecret();
+        KeyAgreement ka2 = KeyAgreement.getInstance(kaAlgo, provider);
+        ka2.init(kp2.getPrivate());
+        ka2.doPhase(kp1.getPublic(), true);
+        byte[] secret2 = ka2.generateSecret();
+
+        // With related keypairs, generated KeyAgreement secret should be same.
+        if (!Arrays.equals(secret1, secret2)) {
+            throw new Exception("KeyAgreement secret mismatch.");
+        }
+    }
+}

test/jdk/java/security/KeyAgreement/NegativeTest.java

@@ -0,0 +1,408 @@
+/*
+ * Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+ /*
+ * @test
+ * @bug 8200219
+ * @summary Negative tests for Key related Test with DiffieHellman, ECDH, XDH.
+ *          It Tests,
+ *          Use modified encoding while generating Public/Private Keys
+ *          Short, long, unsupported keysize
+ *          Invalid Algo names including Null
+ *          Invalid provider names including Null
+ *          Invalid curve names
+ *          Invalid spec usage
+ *  Arguments order <KeyExchangeAlgorithm> <Provider> <KeyGenAlgorithm>
+ *                  <keySize> <Curve*>
+ * @library /test/lib
+ * @run main NegativeTest DiffieHellman SunJCE DiffieHellman 2048
+ * @run main NegativeTest ECDH SunEC EC 256
+ * @run main NegativeTest XDH SunEC XDH 255 X25519
+ * @run main NegativeTest XDH SunEC XDH 448 X448
+ */
+import java.math.BigInteger;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidParameterException;
+import java.security.KeyFactory;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.Security;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.NamedParameterSpec;
+import java.security.spec.KeySpec;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.security.spec.XECPrivateKeySpec;
+import java.security.spec.XECPublicKeySpec;
+import java.util.Arrays;
+import java.util.HexFormat;
+import javax.crypto.KeyAgreement;
+import jdk.test.lib.security.SecurityUtils;
+
+public class NegativeTest {
+
+    public static void main(String[] args) throws Exception {
+
+        String kaAlgo = args[0];
+        String provider = System.getProperty("test.provider.name", args[1]);
+        String kpgAlgo = args[2];
+        int keySize = Integer.parseInt(args[3]);
+        String kpgInit = (args.length > 4) ? args[4] : args[2];
+        testModifiedKeyEncodingTest(provider, kpgAlgo, kpgInit);
+        testInvalidKeyLen(provider, kaAlgo, kpgAlgo, kpgInit);
+        testInvalidKpgAlgo(provider, kaAlgo, keySize);
+        testInvalidKaAlgo(provider, kpgAlgo, keySize);
+        testInvalidProvider(kaAlgo, kpgAlgo, keySize);
+        if (!kaAlgo.equals("DiffieHellman")) {
+            testNamedParameter(provider, kpgAlgo);
+        }
+        if (kaAlgo.equals("XDH")) {
+            testInvalidSpec(provider, kpgAlgo, kpgInit);
+            testInCompatibleSpec(provider, kpgAlgo, kpgInit);
+        }
+    }
+
+    /**
+     * Generate keyPair based on KeyPairGenerator algorithm.
+     */
+    private static KeyPair genKeyPair(String provider, String kpgAlgo,
+            String kpgInit) throws Exception {
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgo,
+                Security.getProvider(provider));
+        switch (kpgInit) {
+            case "DiffieHellman":
+                kpg.initialize(SecurityUtils.getTestKeySize(kpgInit));
+                break;
+            case "EC":
+                kpg.initialize(256);
+                break;
+            case "X25519":
+                kpg.initialize(255);
+                break;
+            case "X448":
+                kpg.initialize(448);
+                break;
+            default:
+                throw new RuntimeException("Invalid Algo name " + kpgInit);
+        }
+        return kpg.generateKeyPair();
+    }
+
+    private static void testModifiedKeyEncodingTest(String provider,
+            String kpgAlgo, String kpgInit) throws Exception {
+
+        KeyFactory kf = KeyFactory.getInstance(kpgAlgo, provider);
+        KeyPair kp = genKeyPair(provider, kpgAlgo, kpgInit);
+        // Test modified PrivateKey encoding
+        byte[] encoded = kp.getPrivate().getEncoded();
+        byte[] modified = modifyEncoded(encoded);
+        PKCS8EncodedKeySpec priSpec = new PKCS8EncodedKeySpec(modified);
+        try {
+            // Generate PrivateKey with modified encoding
+            kf.generatePrivate(priSpec);
+            throw new RuntimeException(
+                    "testModifiedKeyTest should fail but passed.");
+        } catch (InvalidKeySpecException e) {
+            System.out.printf("Expected InvalidKeySpecException for invalid "
+                    + "PrivateKey %s%n and modified encoding: %s, %s%n",
+                    HexFormat.of().withUpperCase().formatHex(encoded),
+                    HexFormat.of().withUpperCase().formatHex(modified), e.getMessage());
+        }
+        // Test modified PublicKey encoding
+        encoded = kp.getPublic().getEncoded();
+        modified = modifyEncoded(encoded);
+        X509EncodedKeySpec pubSpec = new X509EncodedKeySpec(modified);
+        try {
+            // Generate PublicKey with modified encoding
+            kf.generatePublic(pubSpec);
+            throw new RuntimeException(
+                    "testModifiedKeyTest should fail but passed.");
+        } catch (InvalidKeySpecException e) {
+            System.out.printf("Expected InvalidKeySpecException for invalid "
+                    + "PublicKey %s%n and modified encoding: %s, %s%n",
+                    HexFormat.of().withUpperCase().formatHex(encoded),
+                    HexFormat.of().withUpperCase().formatHex(modified), e.getMessage());
+        }
+    }
+
+    /**
+     * Test with all Invalid key length.
+     */
+    private static void testInvalidKeyLen(String provider, String kaAlgo,
+            String kpgAlgo, String kpgInit) throws Exception {
+
+        for (int keySize : selectInvalidKeylength(kpgInit)) {
+            try {
+                startKeyAgreement(provider, kaAlgo, kpgAlgo, keySize);
+                throw new RuntimeException(
+                        "testInvalidKeyLen should fail but passed.");
+            } catch (InvalidParameterException e) {
+                System.out.printf("Expected InvalidParameterException for "
+                        + "keyLength: %s, %s%n", keySize, e.getMessage());
+            }
+        }
+    }
+
+    /**
+     * Test with all Invalid KeyPairGenerator algorithms.
+     */
+    private static void testInvalidKpgAlgo(String provider, String algo,
+            int keySize) throws Exception {
+
+        for (String kpgAlgo : new String[]{null, " ", "", "NoSuchAlgorithm"}) {
+            try {
+                startKeyAgreement(provider, algo, kpgAlgo, keySize);
+                throw new RuntimeException(
+                        "testInvalidKpgAlgo should fail but passed.");
+            } catch (NoSuchAlgorithmException e) {
+                System.out.printf("Expected NoSuchAlgorithmException for "
+                        + "KeyAgreement algo: %s, %s%n",
+                        kpgAlgo, e.getMessage());
+            } catch (NullPointerException e) {
+                if (kpgAlgo == null) {
+                    System.out.printf("Expected NullPointerException for "
+                            + "KeyPairGenerator algo: %s, %s%n",
+                            kpgAlgo, e.getMessage());
+                    continue;
+                }
+                throw new RuntimeException(
+                        "Unknown failure in testInvalidKpgAlgo.");
+            }
+        }
+    }
+
+    /**
+     * Test with all Invalid KeyAgreement algorithms.
+     */
+    private static void testInvalidKaAlgo(String provider, String kpgAlgo,
+            int keySize) throws Exception {
+
+        for (String algo : new String[]{null, " ", "", "NoSuchAlgorithm"}) {
+            try {
+                startKeyAgreement(provider, algo, kpgAlgo, keySize);
+                throw new RuntimeException(
+                        "testInvalidKaAlgo should fail but passed.");
+            } catch (NoSuchAlgorithmException e) {
+                System.out.printf("Expected NoSuchAlgorithmException for "
+                        + "KeyAgreement algo: %s, %s%n", algo, e.getMessage());
+            } catch (NullPointerException e) {
+                if (algo == null) {
+                    System.out.printf("Expected NullPointerException for "
+                            + "KeyAgreement algo: %s, %s%n",
+                            algo, e.getMessage());
+                    continue;
+                }
+                throw new RuntimeException(
+                        "Unknown failure in testInvalidKaAlgo.");
+            }
+        }
+    }
+
+    /**
+     * Test with all Invalid Provider names.
+     */
+    private static void testInvalidProvider(String kaAlgo, String kpgAlgo,
+            int keySize) throws Exception {
+
+        for (String provider : new String[]{null, " ", "", "NoSuchProvider"}) {
+            try {
+                startKeyAgreement(provider, kaAlgo, kpgAlgo, keySize);
+                throw new RuntimeException(
+                        "testInvalidProvider should fail but passed.");
+            } catch (NoSuchProviderException e) {
+                System.out.printf("Expected NoSuchProviderException for "
+                        + "Provider: %s, %s%n", provider, e.getMessage());
+            } catch (IllegalArgumentException e) {
+                System.out.printf("Expected IllegalArgumentException for "
+                        + "Provider: %s, %s%n", provider, e.getMessage());
+            }
+        }
+    }
+
+    /**
+     * Test for (in)valid curve names as argument to NamedParameterSpec
+     */
+    private static void testNamedParameter(String provider, String kpgAlgo)
+            throws Exception {
+
+        for (String name : new String[]{null, " ", "", "NoSuchCurve"}) {
+            try {
+                NamedParameterSpec spec = new NamedParameterSpec(name);
+                KeyPairGenerator kpg
+                        = KeyPairGenerator.getInstance(kpgAlgo, provider);
+                kpg.initialize(spec);
+                kpg.generateKeyPair();
+                throw new RuntimeException(
+                        "testNamedParameter should fail but passed.");
+            } catch (NullPointerException e) {
+                if (name == null) {
+                    System.out.printf("Expected NullPointerException for "
+                            + "NamedParameterSpec name: %s, %s%n",
+                            name, e.getMessage());
+                    continue;
+                }
+                throw new RuntimeException(
+                        "Unknown failure in testNamedParameter.");
+            } catch (InvalidAlgorithmParameterException e) {
+                System.out.printf("Expected InvalidAlgorithmParameterException"
+                        + " for NamedParameterSpec name: %s, %s%n",
+                        name, e.getMessage());
+            }
+        }
+    }
+
+    /**
+     * Test to generate Public/Private keys using (in)valid coordinate/scalar.
+     */
+    private static void testInvalidSpec(String provider,
+            String kpgAlgo, String curve) throws Exception {
+
+        NamedParameterSpec spec = new NamedParameterSpec(curve);
+        KeyFactory kf = KeyFactory.getInstance(kpgAlgo, provider);
+        int validLen = curve.equalsIgnoreCase("X448") ? 56 : 32;
+        for (byte[] scalarBytes : new byte[][]{null, new byte[]{},
+            new byte[32], new byte[56], new byte[65535]}) {
+            try {
+                KeySpec privateSpec = new XECPrivateKeySpec(spec, scalarBytes);
+                kf.generatePrivate(privateSpec);
+                if (scalarBytes.length != validLen) {
+                    throw new RuntimeException(String.format("testInvalidSpec "
+                            + "should fail but passed when Scalar bytes length "
+                            + "!= %s for curve %s", validLen, curve));
+                }
+            } catch (NullPointerException e) {
+                if (scalarBytes == null) {
+                    System.out.printf("Expected NullPointerException for "
+                            + "scalar: %s, %s%n", scalarBytes, e.getMessage());
+                    continue;
+                }
+                throw new RuntimeException(e);
+            } catch (InvalidKeySpecException e) {
+                if (scalarBytes.length != validLen) {
+                    System.out.printf("Expected InvalidKeySpecException for "
+                            + "scalar length %s and curve %s: %s%n",
+                            scalarBytes.length, curve, e.getMessage());
+                    continue;
+                }
+                throw new RuntimeException(e);
+            }
+        }
+        for (BigInteger coordinate : new BigInteger[]{null, BigInteger.ZERO,
+            BigInteger.ONE, new BigInteger("2").pow(255),
+            new BigInteger("2").pow(448)}) {
+            try {
+                KeySpec publicSpec = new XECPublicKeySpec(spec, coordinate);
+                kf.generatePublic(publicSpec);
+            } catch (NullPointerException e) {
+                if (coordinate == null) {
+                    System.out.printf("Expected NullPointerException for "
+                            + "coordinate : %s, %s%n", coordinate,
+                            e.getMessage());
+                    continue;
+                }
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    private static void testInCompatibleSpec(String provider,
+            String kpgAlgo, String curve) throws Exception {
+
+        int validLen = curve.equalsIgnoreCase("X448") ? 56 : 32;
+        NamedParameterSpec spec = new NamedParameterSpec(curve);
+        KeyFactory kf = KeyFactory.getInstance(kpgAlgo, provider);
+        KeySpec privateSpec = new XECPrivateKeySpec(spec, new byte[validLen]);
+        KeySpec publicSpec = new XECPublicKeySpec(spec, BigInteger.ONE);
+        try {
+            kf.generatePrivate(publicSpec);
+            throw new RuntimeException(
+                    "testInCompatibleSpec should fail but passed.");
+        } catch (InvalidKeySpecException e) {
+            System.out.printf("Expected XECPublicKeySpec to XECPrivateKeySpec :"
+                    + " %s%n", e.getMessage());
+        }
+        try {
+            kf.generatePublic(privateSpec);
+            throw new RuntimeException(
+                    "testInCompatibleSpec should fail but passed.");
+        } catch (InvalidKeySpecException e) {
+            System.out.printf("Expected XECPrivateKeySpec to XECPublicKeySpec :"
+                    + " %s%n", e.getMessage());
+        }
+    }
+
+    /**
+     * Perform KeyAgreement operation.
+     */
+    private static void startKeyAgreement(String provider, String kaAlgo,
+            String kpgAlgo, int keySize) throws Exception {
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgo, provider);
+        kpg.initialize(keySize);
+        KeyPair kp = kpg.generateKeyPair();
+        KeyAgreement ka = KeyAgreement.getInstance(kaAlgo, provider);
+        ka.init(kp.getPrivate());
+        ka.doPhase(kp.getPublic(), true);
+        ka.generateSecret();
+    }
+
+    /**
+     * Return manipulated encoded bytes.
+     */
+    private static byte[] modifyEncoded(byte[] encoded) {
+
+        byte[] copy = Arrays.copyOf(encoded, encoded.length);
+        for (int i = 0; i < copy.length; i++) {
+            copy[i] = (byte) ~copy[i];
+        }
+        return copy;
+    }
+
+    /**
+     * Select invalid key sizes for different Key generation algorithms.
+     */
+    private static int[] selectInvalidKeylength(String kpgInit) {
+
+        int[] keySize = new int[]{};
+        switch (kpgInit) {
+            case "DiffieHellman":
+                keySize = new int[]{256, 513, 1023, 2176, 4032, 6400, 8200};
+                break;
+            case "EC":
+                keySize = new int[]{100, 300};
+                break;
+            case "X25519":
+                keySize = new int[]{100, 300};
+                break;
+            case "X448":
+                keySize = new int[]{100, 500};
+                break;
+            default:
+                throw new RuntimeException("Invalid Algo name " + kpgInit);
+        }
+        return keySize;
+    }
+}

test/jdk/java/security/KeyFactory/Failover.java

@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 4894125 7054918 8130181
+ * @library /test/lib
+ * @summary test that failover for KeyFactory works
+ * @author Andreas Sterbenz
+ */
+
+import java.util.*;
+
+import java.security.*;
+import java.security.spec.*;
+import jdk.test.lib.security.ProvidersSnapshot;
+import jdk.test.lib.security.SecurityUtils;
+
+public class Failover {
+
+    public static void main(String[] args) throws Exception {
+        ProvidersSnapshot snapshot = ProvidersSnapshot.create();
+        try {
+            main0(args);
+        } finally {
+            snapshot.restore();
+        }
+    }
+
+    public static void main0(String[] args) throws Exception {
+        Security.insertProviderAt(new ProviderFail(), 1);
+        Security.addProvider(new ProviderPass());
+        System.out.println(Arrays.asList(Security.getProviders()));
+
+        KeyFactory kf;
+        kf = KeyFactory.getInstance("FOO");
+        kf.generatePublic(null);
+        kf.generatePublic(null);
+        kf.generatePrivate(null);
+
+        kf = KeyFactory.getInstance("FOO");
+        kf.generatePrivate(null);
+        kf.getKeySpec(null, null);
+        kf.translateKey(null);
+
+        kf = KeyFactory.getInstance("FOO");
+        kf.getKeySpec(null, null);
+        kf.translateKey(null);
+
+        kf = KeyFactory.getInstance("FOO");
+        kf.translateKey(null);
+
+        // somewhat more real tests using DSA
+        System.out.println("DSA tests...");
+
+        String kpgAlgorithm = "DSA";
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithm);
+        kpg.initialize(SecurityUtils.getTestKeySize(kpgAlgorithm));
+        KeyPair kp = kpg.generateKeyPair();
+
+        kf = KeyFactory.getInstance("DSA");
+        System.out.println(kf.translateKey(kp.getPrivate()));
+
+        kf = KeyFactory.getInstance("DSA");
+        KeySpec spec = kf.getKeySpec(kp.getPublic(), DSAPublicKeySpec.class);
+
+        kf = KeyFactory.getInstance("DSA");
+        System.out.println(kf.generatePublic(spec));
+
+        kf = KeyFactory.getInstance("DSA");
+        try {
+            kf.generatePrivate(spec);
+            throw new Exception("no exception");
+        } catch (InvalidKeySpecException e) {
+            System.out.println(e);
+        }
+    }
+
+    private static class ProviderPass extends Provider {
+        ProviderPass() {
+            super("Pass", "1.0", "Pass");
+            put("KeyFactory.FOO" , "Failover$KeyFactoryPass");
+        }
+    }
+
+    private static class ProviderFail extends Provider {
+        ProviderFail() {
+            super("Fail", "1.0", "Fail");
+            put("KeyFactory.FOO" , "Failover$KeyFactoryFail");
+            put("KeyFactory.DSA" , "Failover$KeyFactoryFail");
+        }
+    }
+
+    public static class KeyFactoryPass extends KeyFactorySpi {
+
+        protected PublicKey engineGeneratePublic(KeySpec keySpec) throws InvalidKeySpecException {
+            System.out.println("MyKeyFactoryPass.engineGeneratePublic()");
+            return null;
+        }
+
+        protected PrivateKey engineGeneratePrivate(KeySpec keySpec) throws InvalidKeySpecException {
+            System.out.println("MyKeyFactoryPass.engineGeneratePrivate()");
+            return null;
+        }
+
+        protected <T extends KeySpec> T
+            engineGetKeySpec(Key key, Class<T> keySpec) throws InvalidKeySpecException
+        {
+            System.out.println("MyKeyFactoryPass.engineGetKeySpec()");
+            return null;
+        }
+
+        protected Key engineTranslateKey(Key key) throws InvalidKeyException {
+            System.out.println("MyKeyFactoryPass.engineTranslateKey()");
+            return null;
+        }
+
+    }
+
+    public static class KeyFactoryFail extends KeyFactorySpi {
+
+        protected PublicKey engineGeneratePublic(KeySpec keySpec) throws InvalidKeySpecException {
+            System.out.println("MyKeyFactoryFail.engineGeneratePublic()");
+            throw new InvalidKeySpecException();
+        }
+
+        protected PrivateKey engineGeneratePrivate(KeySpec keySpec) throws InvalidKeySpecException {
+            System.out.println("MyKeyFactoryFail.engineGeneratePrivate()");
+            throw new InvalidKeySpecException();
+        }
+
+        protected <T extends KeySpec> T engineGetKeySpec(Key key, Class<T> keySpec) throws InvalidKeySpecException {
+            System.out.println("MyKeyFactoryFail.engineGetKeySpec()");
+            throw new InvalidKeySpecException();
+        }
+
+        protected Key engineTranslateKey(Key key) throws InvalidKeyException {
+            System.out.println("MyKeyFactoryFail.engineTranslateKey()");
+            throw new InvalidKeyException();
+        }
+
+    }
+
+}

test/jdk/java/security/KeyFactory/GenerateRSAPrivateCrtKey.java

@@ -0,0 +1,189 @@
+/*
+ * Copyright (c) 2001, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4413634
+ * @summary Make sure that RSA Private CRT Key factory generation using
+ * java.security.spec.RSAPrivateCrtKeySpec passes
+ */
+
+import java.math.BigInteger;
+import java.security.KeyFactory;
+import java.security.interfaces.RSAPrivateCrtKey;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.RSAPrivateCrtKeySpec;
+import java.util.Arrays;
+
+public class GenerateRSAPrivateCrtKey {
+
+    public static void main(String[] args) throws Exception {
+
+        // Create an RSA Private Key from the CRT information
+        RSAPrivateCrtKeySpec rsaCrtSpec =
+            new RSAPrivateCrtKeySpec(new BigInteger(1, modulus),
+                                     new BigInteger(1, pubExpo),
+                                     new BigInteger(1, priExpo),
+                                     new BigInteger(1, primeP),
+                                     new BigInteger(1, primeQ),
+                                     new BigInteger(1, expoP),
+                                     new BigInteger(1, expoQ),
+                                     new BigInteger(1, coeff));
+
+        // Create an RSA private key from the CRT specification
+        KeyFactory kf = KeyFactory.getInstance("RSA",
+                System.getProperty("test.provider.name", "SunRsaSign"));
+        RSAPrivateCrtKey rsaPriKey =
+            (RSAPrivateCrtKey) kf.generatePrivate(rsaCrtSpec);
+
+        // test resulting key against original specification
+        if (!rsaPriKey.getCrtCoefficient().equals(rsaCrtSpec.getCrtCoefficient()))
+            throw new Exception("coefficients not equal");
+        if (!rsaPriKey.getPrimeExponentP().equals(rsaCrtSpec.getPrimeExponentP()))
+            throw new Exception("primeExponentPs not equal");
+        if (!rsaPriKey.getPrimeExponentQ().equals(rsaCrtSpec.getPrimeExponentQ()))
+            throw new Exception("primeExponentQs not equal");
+        if (!rsaPriKey.getPrimeP().equals(rsaCrtSpec.getPrimeP()))
+            throw new Exception("primePs not equal");
+        if (!rsaPriKey.getPrimeQ().equals(rsaCrtSpec.getPrimeQ()))
+            throw new Exception("primeQs not equal");
+        if (!rsaPriKey.getPublicExponent().equals(rsaCrtSpec.getPublicExponent()))
+            throw new Exception("public exponents not equal");
+        if (!rsaPriKey.getPrivateExponent().equals(rsaCrtSpec.getPrivateExponent()))
+            throw new Exception("private exponents not equal");
+        if (!rsaPriKey.getModulus().equals(rsaCrtSpec.getModulus()))
+            throw new Exception("modulus not equal");
+        if (!rsaPriKey.getFormat().equals("PKCS#8") &&
+            !rsaPriKey.getFormat().equals("PKCS8"))
+            throw new Exception("format not PKCS#8");
+        if (!rsaPriKey.getAlgorithm().equals("RSA"))
+            throw new Exception("algorithm not RSA");
+        if (rsaPriKey.getEncoded() == null)
+            throw new Exception("encoded key is null");
+
+        PKCS8EncodedKeySpec pkcs8Key =
+            new PKCS8EncodedKeySpec(rsaPriKey.getEncoded());
+
+        RSAPrivateCrtKey rsaPriKey2
+            = (RSAPrivateCrtKey) kf.generatePrivate(pkcs8Key);
+        if (!Arrays.equals(rsaPriKey.getEncoded(), rsaPriKey2.getEncoded()))
+            throw new Exception("encoded keys not equal");
+    }
+
+    static byte[] modulus = {
+        (byte)0xab, (byte)0x38, (byte)0x39, (byte)0x40,
+        (byte)0x54, (byte)0x2c, (byte)0xac, (byte)0x9a,
+        (byte)0xc0, (byte)0x37, (byte)0x40, (byte)0xd0,
+        (byte)0x49, (byte)0x04, (byte)0xed, (byte)0x51,
+        (byte)0x0e, (byte)0x95, (byte)0x72, (byte)0x02,
+        (byte)0x51, (byte)0xc2, (byte)0xad, (byte)0x9d,
+        (byte)0xa7, (byte)0xeb, (byte)0xba, (byte)0x29,
+        (byte)0xae, (byte)0xd4, (byte)0x49, (byte)0x79,
+        (byte)0x53, (byte)0xfa, (byte)0xdf, (byte)0x01,
+        (byte)0x6c, (byte)0xbc, (byte)0x69, (byte)0x46,
+        (byte)0x4c, (byte)0x83, (byte)0x1b, (byte)0xd9,
+        (byte)0x3b, (byte)0x59, (byte)0x42, (byte)0x04,
+        (byte)0x99, (byte)0x0f, (byte)0x63, (byte)0x24,
+        (byte)0x75, (byte)0xa0, (byte)0xbe, (byte)0x6f,
+        (byte)0x92, (byte)0x4d, (byte)0x9d, (byte)0xa2,
+        (byte)0x40, (byte)0xda, (byte)0xf8, (byte)0x49
+    };
+
+    static byte[] pubExpo = {
+        (byte)0x01, (byte)0x00, (byte)0x01
+    };
+
+    static byte[] priExpo = {
+        (byte)0x4a, (byte)0xd2, (byte)0xe7, (byte)0x32,
+        (byte)0x15, (byte)0x96, (byte)0xf0, (byte)0x57,
+        (byte)0x30, (byte)0x68, (byte)0xf5, (byte)0x0a,
+        (byte)0x10, (byte)0xde, (byte)0xf6, (byte)0x56,
+        (byte)0xd5, (byte)0xe8, (byte)0xb9, (byte)0x4a,
+        (byte)0x0a, (byte)0x30, (byte)0xe9, (byte)0x6e,
+        (byte)0x5c, (byte)0x53, (byte)0xc7, (byte)0xa7,
+        (byte)0x2f, (byte)0x9f, (byte)0xd5, (byte)0xfb,
+        (byte)0x58, (byte)0x9b, (byte)0x1e, (byte)0x5b,
+        (byte)0xe8, (byte)0x6e, (byte)0xae, (byte)0x02,
+        (byte)0xaa, (byte)0x15, (byte)0x23, (byte)0x67,
+        (byte)0xaa, (byte)0x20, (byte)0x9e, (byte)0x82,
+        (byte)0x76, (byte)0x4c, (byte)0xad, (byte)0xe1,
+        (byte)0x95, (byte)0xde, (byte)0xe3, (byte)0x25,
+        (byte)0x66, (byte)0x2f, (byte)0xb0, (byte)0xab,
+        (byte)0x1c, (byte)0xe5, (byte)0xa0, (byte)0x01
+    };
+
+    static byte[] primeP = {
+        (byte)0xd1, (byte)0xeb, (byte)0x51, (byte)0xbd,
+        (byte)0x09, (byte)0x26, (byte)0x7e, (byte)0xe7,
+        (byte)0x12, (byte)0x8c, (byte)0xeb, (byte)0x5c,
+        (byte)0x32, (byte)0x18, (byte)0xd1, (byte)0x60,
+        (byte)0x0b, (byte)0x49, (byte)0x67, (byte)0x8f,
+        (byte)0x78, (byte)0x3c, (byte)0x58, (byte)0xc5,
+        (byte)0xb0, (byte)0x01, (byte)0x70, (byte)0xee,
+        (byte)0x1a, (byte)0xcf, (byte)0x6e, (byte)0xe1
+    };
+
+    static byte[] primeQ = {
+        (byte)0xd0, (byte)0xce, (byte)0x21, (byte)0x83,
+        (byte)0x41, (byte)0x73, (byte)0xf6, (byte)0x84,
+        (byte)0x32, (byte)0x06, (byte)0xa8, (byte)0xa6,
+        (byte)0xad, (byte)0x13, (byte)0x2b, (byte)0x65,
+        (byte)0x27, (byte)0x86, (byte)0x28, (byte)0xef,
+        (byte)0x0e, (byte)0x8c, (byte)0xca, (byte)0x4f,
+        (byte)0x20, (byte)0xc0, (byte)0x19, (byte)0x95,
+        (byte)0xfe, (byte)0x6c, (byte)0x3e, (byte)0x69
+    };
+
+    static byte[] expoP = {
+        (byte)0x1a, (byte)0x49, (byte)0x9c, (byte)0xb7,
+        (byte)0xce, (byte)0x80, (byte)0x8a, (byte)0x9d,
+        (byte)0xc7, (byte)0x3d, (byte)0xec, (byte)0x6f,
+        (byte)0x64, (byte)0x3a, (byte)0xa5, (byte)0x65,
+        (byte)0xa0, (byte)0xa4, (byte)0x35, (byte)0x9a,
+        (byte)0xca, (byte)0xd4, (byte)0xcb, (byte)0xcd,
+        (byte)0x1d, (byte)0xc8, (byte)0x60, (byte)0x6b,
+        (byte)0x00, (byte)0xe2, (byte)0x7f, (byte)0x21
+    };
+
+    static byte[] expoQ = {
+        (byte)0xa7, (byte)0x93, (byte)0xd7, (byte)0x77,
+        (byte)0x94, (byte)0xef, (byte)0x31, (byte)0x78,
+        (byte)0x55, (byte)0x01, (byte)0xdd, (byte)0x16,
+        (byte)0xaf, (byte)0xae, (byte)0xc3, (byte)0xd4,
+        (byte)0x12, (byte)0x0d, (byte)0x6d, (byte)0x0a,
+        (byte)0xb6, (byte)0xdd, (byte)0xad, (byte)0x7c,
+        (byte)0x25, (byte)0xe7, (byte)0xa6, (byte)0x61,
+        (byte)0x27, (byte)0xe8, (byte)0xcd, (byte)0x89
+    };
+
+    static byte[] coeff = {
+        (byte)0x0b, (byte)0xdb, (byte)0x90, (byte)0x7f,
+        (byte)0x33, (byte)0xc5, (byte)0x1f, (byte)0x5b,
+        (byte)0x4d, (byte)0xa4, (byte)0x86, (byte)0xda,
+        (byte)0x77, (byte)0xd4, (byte)0xb3, (byte)0x1d,
+        (byte)0xbc, (byte)0xc3, (byte)0xae, (byte)0x0b,
+        (byte)0xac, (byte)0x91, (byte)0xf3, (byte)0x38,
+        (byte)0x4a, (byte)0xcf, (byte)0x10, (byte)0xb1,
+        (byte)0x5e, (byte)0x5a, (byte)0xd1, (byte)0x86
+    };
+}

test/jdk/java/security/KeyFactory/KeyFactoryGetKeySpecForInvalidSpec.java

@@ -0,0 +1,137 @@
+/*
+ * Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+ * Copyright (c) 2024, 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 8254717 8263404
+ * @summary isAssignableFrom checks in KeyFactorySpi.engineGetKeySpec appear to be backwards.
+ * @author Greg Rubin, Ziyi Luo
+ */
+
+import java.math.BigInteger;
+import java.security.KeyFactory;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.interfaces.RSAPrivateCrtKey;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.spec.*;
+
+public class KeyFactoryGetKeySpecForInvalidSpec {
+
+    // Test for 8263404: This method generates RSAPrivateKey (without Crt info) from a RSAPrivateCrtKey
+    public static RSAPrivateKey privateCrtToPrivate(RSAPrivateCrtKey crtKey) {
+        return new RSAPrivateKey() {
+            @Override
+            public BigInteger getPrivateExponent() {
+                return crtKey.getPrivateExponent();
+            }
+
+            @Override
+            public String getAlgorithm() {
+                return crtKey.getAlgorithm();
+            }
+
+            @Override
+            public String getFormat() {
+                return crtKey.getFormat();
+            }
+
+            @Override
+            public byte[] getEncoded() {
+                return crtKey.getEncoded();
+            }
+
+            @Override
+            public BigInteger getModulus() {
+                return crtKey.getModulus();
+            }
+        };
+    }
+
+    public static void main(String[] args) throws Exception {
+        KeyPairGenerator kg = KeyPairGenerator.getInstance("RSA",
+                System.getProperty("test.provider.name", "SunRsaSign"));
+        kg.initialize(2048);
+        KeyPair pair = kg.generateKeyPair();
+
+        KeyFactory factory = KeyFactory.getInstance("RSA");
+
+        // === Case 1: private key is RSAPrivateCrtKey, keySpec is RSAPrivateKeySpec
+        // === Expected: return RSAPrivateCrtKeySpec
+        // Since RSAPrivateCrtKeySpec inherits from RSAPrivateKeySpec, we'd expect this next line to return an instance of RSAPrivateKeySpec
+        // (because the private key has CRT parts).
+        KeySpec spec = factory.getKeySpec(pair.getPrivate(), RSAPrivateKeySpec.class);
+        if (!(spec instanceof RSAPrivateCrtKeySpec)) {
+            throw new Exception("Spec should be an instance of RSAPrivateCrtKeySpec");
+        }
+
+        // === Case 2: private key is RSAPrivateCrtKey, keySpec is RSAPrivateCrtKeySpec
+        // === Expected: return RSAPrivateCrtKeySpec
+        spec = factory.getKeySpec(pair.getPrivate(), RSAPrivateCrtKeySpec.class);
+        if (!(spec instanceof RSAPrivateCrtKeySpec)) {
+            throw new Exception("Spec should be an instance of RSAPrivateCrtKeySpec");
+        }
+
+        // === Case 3: private key is RSAPrivateKey, keySpec is RSAPrivateKeySpec
+        // === Expected: return RSAPrivateKeySpec not RSAPrivateCrtKeySpec
+        RSAPrivateKey notCrtKey = privateCrtToPrivate((RSAPrivateCrtKey)pair.getPrivate());
+        // InvalidKeySpecException should not be thrown
+        KeySpec notCrtSpec = factory.getKeySpec(notCrtKey, RSAPrivateKeySpec.class);
+        if (notCrtSpec instanceof RSAPrivateCrtKeySpec) {
+            throw new Exception("Spec should be an instance of RSAPrivateKeySpec not RSAPrivateCrtKeySpec");
+        }
+        if (!(notCrtSpec instanceof RSAPrivateKeySpec)) {
+            throw new Exception("Spec should be an instance of RSAPrivateKeySpec");
+        }
+
+        // === Case 4: private key is RSAPrivateKey, keySpec is RSAPrivateCrtKeySpec
+        // === Expected: throw InvalidKeySpecException
+        try {
+            factory.getKeySpec(notCrtKey, RSAPrivateCrtKeySpec.class);
+            throw new Exception("InvalidKeySpecException is expected but not thrown");
+        } catch (InvalidKeySpecException e) {
+            // continue;
+        }
+
+        // This next line should give an InvalidKeySpec exception
+        try {
+            spec = factory.getKeySpec(pair.getPublic(), FakeX509Spec.class);
+            throw new Exception("InvalidKeySpecException is expected but not thrown");
+        } catch (final ClassCastException ex) {
+            throw new Exception("InvalidKeySpecException is expected ClassCastException is thrown", ex);
+        } catch (final InvalidKeySpecException ex) {
+            // Pass
+        }
+    }
+
+    public static class FakeX509Spec extends X509EncodedKeySpec {
+        public FakeX509Spec(byte[] encodedKey) {
+            super(encodedKey);
+        }
+
+        public FakeX509Spec(byte[] encodedKey, String algorithm) {
+            super(encodedKey, algorithm);
+        }
+    }
+}

test/jdk/java/security/KeyPairGenerator/Failover.java

@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 4894125 7054918 8130181
+ * @library /test/lib
+ * @summary test that failover for KeyPairGenerator works
+ * @author Andreas Sterbenz
+ */
+
+import java.util.*;
+
+import java.security.*;
+import java.security.spec.*;
+import jdk.test.lib.security.ProvidersSnapshot;
+
+public class Failover {
+
+    public static void main(String[] args) throws Exception {
+        ProvidersSnapshot snapshot = ProvidersSnapshot.create();
+        try {
+            main0(args);
+        } finally {
+            snapshot.restore();
+        }
+    }
+
+    public static void main0(String[] args) throws Exception {
+        Security.insertProviderAt(new ProviderFail(), 1);
+        Security.addProvider(new ProviderPass());
+        System.out.println(Arrays.asList(Security.getProviders()));
+
+        KeyPairGenerator kpg;
+        kpg = KeyPairGenerator.getInstance("FOO");
+        kpg.generateKeyPair();
+        kpg.generateKeyPair();
+
+        kpg = KeyPairGenerator.getInstance("FOO");
+        kpg.initialize(1024);
+        kpg.initialize(1024);
+        kpg.initialize(null, null);
+        kpg.generateKeyPair();
+
+        kpg = KeyPairGenerator.getInstance("FOO");
+        kpg.initialize(null, null);
+        kpg.generateKeyPair();
+
+        kpg = KeyPairGenerator.getInstance("FOO");
+        kpg.initialize(512);
+        kpg.generateKeyPair();
+        kpg.generateKeyPair();
+
+        // the SUN DSA KeyPairGenerator implementation extends
+        // KeyPairGenerator (in order to implement
+        // java.security.interfaces.DSAKeyPairGenerator)
+        // failover cannot work
+        kpg = KeyPairGenerator.getInstance("DSA");
+        try {
+            kpg.initialize(1024);
+            throw new Exception("no exception");
+        } catch (InvalidParameterException e) {
+            System.out.println(e);
+        }
+
+        KeyPair kp;
+        kpg = KeyPairGenerator.getInstance("RSA");
+        kpg.initialize(512);
+        kp = kpg.generateKeyPair();
+        System.out.println(kp.getPublic());
+
+        kpg = KeyPairGenerator.getInstance("RSA");
+        kpg.initialize(768);
+        kp = kpg.generateKeyPair();
+        System.out.println(kp.getPublic());
+
+        kpg = KeyPairGenerator.getInstance("RSA");
+        kp = kpg.generateKeyPair();
+        System.out.println(kp.getPublic());
+
+        kpg = KeyPairGenerator.getInstance("RSA");
+        try {
+            kpg.initialize(128);
+            throw new Exception("no exception");
+        } catch (InvalidParameterException e) {
+            System.out.println(e);
+        }
+
+    }
+
+    private static class ProviderPass extends Provider {
+        ProviderPass() {
+            super("Pass", "1.0", "Pass");
+            put("KeyPairGenerator.FOO" , "Failover$KeyPairGeneratorPass");
+        }
+    }
+
+    private static class ProviderFail extends Provider {
+        ProviderFail() {
+            super("Fail", "1.0", "Fail");
+            put("KeyPairGenerator.FOO" , "Failover$KeyPairGeneratorFail");
+            put("KeyPairGenerator.DSA" , "Failover$KeyPairGeneratorFail");
+            put("KeyPairGenerator.RSA" , "Failover$KeyPairGeneratorFail");
+        }
+    }
+
+    public static class KeyPairGeneratorPass extends KeyPairGeneratorSpi {
+
+        public void initialize(int keysize, SecureRandom random) {
+            System.out.println("KeyPairGeneratorPass.initialize(" + keysize + ", " + random + ")");
+        }
+
+        public void initialize(AlgorithmParameterSpec params,
+                SecureRandom random) throws InvalidAlgorithmParameterException {
+            System.out.println("KeyPairGeneratorPass.initialize()");
+        }
+
+        public KeyPair generateKeyPair() {
+            System.out.println("KeyPairGeneratorPass.generateKeyPair()");
+            return null;
+        }
+
+    }
+
+    public static class KeyPairGeneratorFail extends KeyPairGeneratorSpi {
+
+        public void initialize(int keysize, SecureRandom random) {
+            if (keysize != 512) {
+                System.out.println("KeyPairGeneratorFail.initialize()");
+                throw new InvalidParameterException();
+            }
+            System.out.println("KeyPairGeneratorFail.initialize() PASS");
+        }
+
+        public void initialize(AlgorithmParameterSpec params,
+                SecureRandom random) throws InvalidAlgorithmParameterException {
+            System.out.println("KeyPairGeneratorFail.initialize()");
+            throw new InvalidParameterException();
+        }
+
+        public KeyPair generateKeyPair() {
+            System.out.println("KeyPairGeneratorFail.generateKeyPair()");
+            throw new InvalidParameterException();
+        }
+
+    }
+
+}

test/jdk/java/security/KeyPairGenerator/FinalizeHalf.java

@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 8163896 8223003
+ * @summary Finalizing one key of a KeyPair invalidates the other key
+ */
+
+import java.security.Key;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.Provider;
+import java.security.ProviderException;
+import java.security.Security;
+import java.util.function.Consumer;
+import java.util.ArrayList;
+import java.util.List;
+
+public class FinalizeHalf {
+
+    static int failures = 0;
+
+    public static void main(String[] args) throws Throwable {
+        List<Consumer<Key>> methods = new ArrayList<>();
+        methods.add((Key k) -> k.getEncoded());
+        methods.add((Key k) -> k.toString());
+
+        for (String algo : new String[] {"DiffieHellman", "DSA", "RSA"}) {
+            for (Provider provider : Security.getProviders()) {
+                for (boolean priv : new boolean[] {true, false}) {
+                    for (Consumer<Key> method : methods) {
+                        test(algo, provider, priv, method);
+                    }
+                }
+            }
+        }
+
+        if (failures > 0) {
+            throw new RuntimeException(failures + " test(s) failed.");
+        }
+    }
+
+    static void test(String algo, Provider provider, boolean priv,
+            Consumer<Key> method) throws Exception {
+        KeyPairGenerator generator;
+        try {
+            generator = KeyPairGenerator.getInstance(algo, provider);
+        } catch (NoSuchAlgorithmException nsae) {
+            return;
+        }
+
+        System.out.println("Checking " + provider.getName() + ", " + algo);
+
+        KeyPair pair = generator.generateKeyPair();
+        Key key = priv ? pair.getPrivate() : pair.getPublic();
+
+        pair = null;
+        for (int i = 0; i < 32; ++i) {
+            System.gc();
+        }
+
+        try {
+            method.accept(key);
+        } catch (ProviderException pe) {
+            failures++;
+        }
+    }
+}

test/jdk/java/security/KeyPairGenerator/GenerateKeypair.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 1999, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4221800
+ * @library /test/lib
+ * @summary Test restored generateKeyPair method
+ */
+
+import java.security.KeyPairGenerator;
+import java.security.KeyPair;
+import jdk.test.lib.security.SecurityUtils;
+
+public class GenerateKeypair {
+
+    public static void main(String[] args) throws Exception {
+
+        String kpgAlgorithm = "DSA";
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithm);
+        kpg.initialize(SecurityUtils.getTestKeySize(kpgAlgorithm));
+
+        // test generateKeyPair
+        KeyPair kpair = kpg.generateKeyPair();
+        if (kpair == null) {
+            throw new Exception("no keypair generated");
+        }
+
+        // test genKeyPair
+        kpair = kpg.genKeyPair();
+        if (kpair == null) {
+            throw new Exception("no keypair generated");
+        }
+    }
+}

test/jdk/java/security/KeyPairGenerator/GenerateRSAKeyPair.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2001, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4297026
+ * @library /test/lib
+ * @summary Make sure that RSA Keypair generation using
+ * java.security.spec.RSAKeyGenParameterSpec passes
+ */
+
+import java.security.KeyPairGenerator;
+import java.security.KeyPair;
+import java.security.spec.RSAKeyGenParameterSpec;
+import jdk.test.lib.security.SecurityUtils;
+
+public class GenerateRSAKeyPair {
+
+    public static void main(String[] args) throws Exception {
+
+        String kpgAlgorithm = "RSA";
+        RSAKeyGenParameterSpec rsaSpec =
+        new RSAKeyGenParameterSpec (SecurityUtils.getTestKeySize(kpgAlgorithm),
+                RSAKeyGenParameterSpec.F4);
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithm,
+                System.getProperty("test.provider.name", "SunRsaSign"));
+        kpg.initialize(rsaSpec);
+
+        // test generateKeyPair
+        KeyPair kpair = kpg.generateKeyPair();
+        if (kpair == null) {
+            throw new Exception("no keypair generated");
+        }
+    }
+}

test/jdk/java/security/KeyRep/Serial.java

@@ -0,0 +1,205 @@
+/*
+ * Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4532506 4999599
+ * @library /test/lib
+ * @summary Serializing KeyPair on one VM (Sun),
+ *      and Deserializing on another (IBM) fails
+ */
+
+import java.io.*;
+import java.math.BigInteger;
+import java.security.*;
+import javax.crypto.*;
+import javax.crypto.spec.*;
+import jdk.test.lib.security.DiffieHellmanGroup;
+import jdk.test.lib.security.SecurityUtils;
+
+public class Serial {
+
+    // providers
+    private static final String SUN = System.getProperty("test.provider.name", "SUN");
+    private static final String RSA = System.getProperty("test.provider.name", "SunRsaSign");
+    private static final String JCE = System.getProperty("test.provider.name", "SunJCE");
+
+    public static void main(String[] args) throws Exception {
+
+        // generate DSA key pair
+        String kpgAlgorithmDsa = "DSA";
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithmDsa, SUN);
+        kpg.initialize(SecurityUtils.getTestKeySize(kpgAlgorithmDsa));
+        KeyPair dsaKp = kpg.genKeyPair();
+
+        // serialize DSA key pair
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ObjectOutputStream oos = new ObjectOutputStream(baos);
+        oos.writeObject(dsaKp);
+        oos.close();
+
+        // deserialize DSA key pair
+        ObjectInputStream ois = new ObjectInputStream
+                        (new ByteArrayInputStream(baos.toByteArray()));
+        KeyPair dsaKp2 = (KeyPair)ois.readObject();
+        ois.close();
+
+        if (!dsaKp2.getPublic().equals(dsaKp.getPublic()) ||
+            !dsaKp2.getPrivate().equals(dsaKp.getPrivate())) {
+            throw new SecurityException("DSA test failed");
+        }
+
+        // generate RSA key pair
+        String kpgAlgorithmRsa = "RSA";
+        kpg = KeyPairGenerator.getInstance(kpgAlgorithmRsa, RSA);
+        kpg.initialize(SecurityUtils.getTestKeySize(kpgAlgorithmRsa));
+        KeyPair rsaKp = kpg.genKeyPair();
+
+        // serialize RSA key pair
+        baos.reset();
+        oos = new ObjectOutputStream(baos);
+        oos.writeObject(rsaKp);
+        oos.close();
+
+        // deserialize RSA key pair
+        ois = new ObjectInputStream
+                        (new ByteArrayInputStream(baos.toByteArray()));
+        KeyPair rsaKp2 = (KeyPair)ois.readObject();
+        ois.close();
+
+        if (!rsaKp2.getPublic().equals(rsaKp.getPublic()) ||
+            !rsaKp2.getPrivate().equals(rsaKp.getPrivate())) {
+            throw new SecurityException("RSA test failed");
+        }
+
+        // generate DH key pair
+        DiffieHellmanGroup dhGroup = SecurityUtils.getTestDHGroup();
+        kpg = KeyPairGenerator.getInstance("DiffieHellman", JCE);
+        kpg.initialize(new DHParameterSpec(dhGroup.getPrime(), dhGroup.getBase()));
+        KeyPair dhKp = kpg.genKeyPair();
+
+        // serialize DH key pair
+        baos.reset();
+        oos = new ObjectOutputStream(baos);
+        oos.writeObject(dhKp);
+        oos.close();
+
+        // deserialize DH key pair
+        ois = new ObjectInputStream
+                        (new ByteArrayInputStream(baos.toByteArray()));
+        KeyPair dhKp2 = (KeyPair)ois.readObject();
+        ois.close();
+
+        if (!dhKp2.getPublic().equals(dhKp.getPublic()) ||
+            !dhKp2.getPrivate().equals(dhKp.getPrivate())) {
+            throw new SecurityException("DH test failed");
+        }
+
+        // generate RC5 key
+        SecretKeySpec rc5Key = new SecretKeySpec(new byte[128], "RC5");
+
+        // serialize RC5 key
+        baos.reset();
+        oos = new ObjectOutputStream(baos);
+        oos.writeObject(rc5Key);
+        oos.close();
+
+        // deserialize RC5 key
+        ois = new ObjectInputStream
+                        (new ByteArrayInputStream(baos.toByteArray()));
+        SecretKey rc5Key2 = (SecretKey)ois.readObject();
+        ois.close();
+
+        if (!rc5Key.equals(rc5Key2)) {
+            throw new SecurityException("RC5 test failed");
+        }
+
+        // generate PBE key
+
+        // Salt
+        byte[] salt = {
+                (byte)0xc7, (byte)0x73, (byte)0x21, (byte)0x8c,
+                (byte)0x7e, (byte)0xc8, (byte)0xee, (byte)0x99
+        };
+
+        // Iteration count
+        int count = 20;
+
+        // Create PBE parameter set
+        PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, count);
+
+        char[] password = new char[] {'f', 'o', 'o'};
+        PBEKeySpec pbeKeySpec = new PBEKeySpec(password);
+        SecretKeyFactory keyFac =
+                        SecretKeyFactory.getInstance("PBEWithMD5AndDES", JCE);
+        SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);
+
+        // serialize PBE key
+        baos.reset();
+        oos = new ObjectOutputStream(baos);
+        oos.writeObject(pbeKey);
+        oos.close();
+
+        // deserialize PBE key
+        ois = new ObjectInputStream
+                        (new ByteArrayInputStream(baos.toByteArray()));
+        SecretKey pbeKey2 = (SecretKey)ois.readObject();
+        ois.close();
+
+        if (!pbeKey.equals(pbeKey2)) {
+            throw new SecurityException("PBE test failed");
+        }
+
+        checkKey("AES", 128);
+        checkKey("Blowfish", -1);
+        checkKey("DES", 56);
+        checkKey("DESede", 168);
+        checkKey("HmacMD5", -1);
+        checkKey("HmacSHA1", -1);
+    }
+
+    private static void checkKey(String algorithm, int size) throws Exception {
+        // generate key
+        KeyGenerator kg = KeyGenerator.getInstance(algorithm, JCE);
+        if (size > 0) {
+            kg.init(size);
+        }
+        SecretKey key = kg.generateKey();
+
+        // serialize key
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ObjectOutputStream oos = new ObjectOutputStream(baos);
+        oos.writeObject(key);
+        oos.close();
+
+        // deserialize key
+        ObjectInputStream ois = new ObjectInputStream
+                                (new ByteArrayInputStream(baos.toByteArray()));
+        SecretKey key2 = (SecretKey)ois.readObject();
+        ois.close();
+
+        if (!key.equals(key2)) {
+            throw new SecurityException(algorithm + " test failed");
+        }
+    }
+}

test/jdk/java/security/KeyRep/SerialDSAPubKey.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2005, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 6232513
+ * @summary RMI interoperability issue with DSAPublicKey obj between
+ *              JDK1.4 & JDK1.5
+ * @run main/othervm -Dsun.security.key.serial.interop=true -Dsun.security.pkcs11.enable-solaris=false SerialDSAPubKey
+ */
+
+import java.io.*;
+import java.math.BigInteger;
+import java.security.*;
+import javax.crypto.*;
+import javax.crypto.spec.*;
+
+public class SerialDSAPubKey {
+
+    // provider
+    private static final String SUN = "SUN";
+
+    public static void main(String[] args) throws Exception {
+
+        // This test generates sun.security.DSAPublicKey
+        // (not sun.security.DSAPublicKeyImpl, as Serial.java does)
+
+        // generate DSA key pair
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA", SUN);
+        kpg.initialize(512);
+        KeyPair dsaKp = kpg.genKeyPair();
+
+        // serialize DSA key pair
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ObjectOutputStream oos = new ObjectOutputStream(baos);
+        oos.writeObject(dsaKp);
+        oos.close();
+
+        // deserialize DSA key pair
+        ObjectInputStream ois = new ObjectInputStream
+                        (new ByteArrayInputStream(baos.toByteArray()));
+        KeyPair dsaKp2 = (KeyPair)ois.readObject();
+        ois.close();
+
+        if (!dsaKp2.getPublic().equals(dsaKp.getPublic()) ||
+            !dsaKp2.getPrivate().equals(dsaKp.getPrivate())) {
+            throw new SecurityException("DSA test failed");
+        }
+    }
+}

test/jdk/java/security/KeyRep/SerialOld.java

@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test 1.1, 03/08/13
+ * @bug 4532506 8301126
+ * @summary Serializing KeyPair on one VM (Sun),
+ *      and Deserializing on another (IBM) fails
+ */
+
+import java.io.*;
+
+public class SerialOld {
+    public static void main(String[] args) throws Exception {
+
+        // verify tiger DSA and RSA public keys still deserialize in our VM
+
+        deserializeTigerKey("DSA");
+        deserializeTigerKey("RSA");
+
+        // verify pre-tiger keys still deserialize in our VM.
+
+        // There used to be a RSA test here, but the serialized file contained
+        // classes introduced in JDK 5.0 (sun.security.rsa.RSA*).  The older
+        // RSA keys from JDK 1.4.2 were of class JSA_* which were removed when
+        // sun.security.rsa was introduced.  (See JDK-8301126 for more
+        // details.)  The test/data has been removed.
+
+        deserializeKey("DSA");
+        deserializeKey("DH");
+        deserializeKey("AES");
+        deserializeKey("Blowfish");
+        deserializeKey("DES");
+        deserializeKey("DESede");
+        deserializeKey("RC5");
+        deserializeKey("HmacSHA1");
+        deserializeKey("HmacMD5");
+        deserializeKey("PBE");
+    }
+
+    private static void deserializeTigerKey(String algorithm) throws Exception {
+        ObjectInputStream ois = new ObjectInputStream(new FileInputStream
+                        (System.getProperty("test.src", ".") +
+                        File.separator +
+                        algorithm + ".1.5.key"));
+        ois.readObject();
+        ois.close();
+    }
+    private static void deserializeKey(String algorithm) throws Exception {
+        ObjectInputStream ois = new ObjectInputStream(new FileInputStream
+                        (System.getProperty("test.src", ".") +
+                        File.separator +
+                        algorithm + ".pre.1.5.key"));
+        ois.readObject();
+        ois.close();
+    }
+}

test/jdk/java/security/KeyStore/CheckInputStream.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8136534
+ * @summary The input stream supplied to KeyStore.load should remain open.
+ */
+
+import java.io.*;
+import java.security.*;
+
+public class CheckInputStream {
+    private final static String DIR = System.getProperty("test.src", ".");
+    private static final char[] PASSWORD = "passphrase".toCharArray();
+    private static final String KEYSTORE = DIR + "/keystore.jks";
+
+    public static final void main(String[] args) throws Exception {
+
+        KeyStore keystore = KeyStore.getInstance("JKS");
+        try (FileInputStream inStream = new FileInputStream(KEYSTORE)) {
+            System.out.println("Loading JKS keystore: " + KEYSTORE);
+            keystore.load(inStream, PASSWORD);
+            // check that the stream is still open
+            inStream.available();
+            System.out.println("OK");
+        }
+    }
+}

test/jdk/java/security/KeyStore/CheckMacOSKeyChainTrust.java

@@ -0,0 +1,137 @@
+
+/*
+ * Copyright (c) 2023, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2023 SAP SE. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.security.KeyStore;
+import java.util.HashSet;
+import java.util.Set;
+
+import jdk.test.lib.process.OutputAnalyzer;
+import jdk.test.lib.process.ProcessTools;
+
+/*
+ * @test
+ * @bug 8303465 8320362
+ * @library /test/lib
+ * @requires os.family == "mac"
+ * @summary Check whether loading of certificates from MacOS Keychain correctly
+ *          honors trust settings
+ * @run main CheckMacOSKeyChainTrust KEYCHAINSTORE
+ * @run main CheckMacOSKeyChainTrust KEYCHAINSTORE-ROOT
+ */
+public class CheckMacOSKeyChainTrust {
+    private static Set<String> trusted = new HashSet<>();
+    private static Set<String> distrusted = new HashSet<>();
+
+    public static void main(String[] args) throws Throwable {
+        String keystore = args[0];
+        if (keystore.equals("KEYCHAINSTORE")) {
+            loadUser(true);
+            loadAdmin(true);
+        } else {
+            // check user and admin trustsettings to find distrusted certs
+            loadUser(false);
+            loadAdmin(false);
+            loadSystem(true);
+        }
+        System.out.println("Trusted Certs: " + trusted);
+        System.out.println("Distrusted Certs: " + distrusted);
+        KeyStore ks = KeyStore.getInstance(keystore);
+        ks.load(null, null);
+        for (String alias : trusted) {
+            if (!ks.containsAlias(alias)) {
+                throw new RuntimeException("Not found: " + alias);
+            }
+        }
+        for (String alias : distrusted) {
+            if (ks.containsAlias(alias)) {
+                throw new RuntimeException("Found: " + alias);
+            }
+        }
+    }
+
+    private static void loadUser(boolean addTrusted) throws Throwable {
+        populate(ProcessTools.executeProcess("security", "dump-trust-settings"), addTrusted);
+    }
+
+    private static void loadAdmin(boolean addTrusted) throws Throwable {
+        populate(ProcessTools.executeProcess("security", "dump-trust-settings", "-d"), addTrusted);
+    }
+
+    private static void loadSystem(boolean addTrusted) throws Throwable {
+        populate(ProcessTools.executeProcess("security", "dump-trust-settings", "-s"), addTrusted);
+    }
+
+    private static void populate(OutputAnalyzer output, boolean addTrusted) throws Throwable {
+        if (output.getExitValue() != 0) {
+            return; // No Trust Settings were found
+        }
+        String certName = null;
+        boolean trustRootFound = false;
+        boolean trustAsRootFound = false;
+        boolean denyFound = false;
+        boolean unspecifiedFound = false;
+        for (String line : output.asLines()) {
+            if (line.startsWith("Cert ")) {
+                if (certName != null) {
+                    if (!denyFound &&
+                        !(unspecifiedFound && !(trustRootFound || trustAsRootFound)) &&
+                        !distrusted.contains(certName)) {
+                        if (addTrusted) {
+                            trusted.add(certName);
+                        }
+                    } else {
+                        distrusted.add(certName);
+                        trusted.remove(certName);
+                    }
+                }
+                certName = line.split(":", 2)[1].trim().toLowerCase();
+                trustRootFound = false;
+                trustAsRootFound = false;
+                denyFound = false;
+                unspecifiedFound = false;
+            } else if (line.contains("kSecTrustSettingsResultTrustRoot")) {
+                trustRootFound = true;
+            } else if (line.contains("kSecTrustSettingsResultTrustAsRoot")) {
+                trustAsRootFound = true;
+            } else if (line.contains("kSecTrustSettingsResultDeny")) {
+                denyFound = true;
+            } else if (line.contains("kSecTrustSettingsResultUnspecified")) {
+                unspecifiedFound = true;
+            }
+        }
+        if (certName != null) {
+            if (!denyFound &&
+                !(unspecifiedFound && !(trustRootFound || trustAsRootFound)) &&
+                !distrusted.contains(certName)) {
+                if (addTrusted) {
+                    trusted.add(certName);
+                }
+            } else {
+                distrusted.add(certName);
+                trusted.remove(certName);
+            }
+        }
+    }
+}

test/jdk/java/security/KeyStore/DefaultEntryType.java

@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test 1.1, 03/06/24
+ * @bug 4850376
+ * @summary Provide generic storage KeyStore storage facilities
+ */
+
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Principal;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.SignatureException;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateExpiredException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateNotYetValidException;
+import java.security.cert.X509Certificate;
+import java.util.Date;
+import java.util.Set;
+import java.util.HashSet;
+import java.math.BigInteger;
+import javax.security.auth.x500.X500Principal;
+
+public class DefaultEntryType {
+
+    private static class PrivKey1 implements PrivateKey {
+        public String getAlgorithm() { return ("matching_alg"); }
+        public String getFormat() { return "privkey1"; }
+        public byte[] getEncoded() { return (byte[])null; }
+    }
+
+    private static class PubKey1 implements PublicKey {
+        public String getAlgorithm() { return ("non_matching_alg"); }
+        public String getFormat() { return "pubkey1"; }
+        public byte[] getEncoded() { return (byte[])null; }
+    }
+
+    private static class PubKey2 implements PublicKey {
+        public String getAlgorithm() { return ("matching_alg"); }
+        public String getFormat() { return "pubkey2"; }
+        public byte[] getEncoded() { return (byte[])null; }
+    }
+
+    private static class Cert extends Certificate {
+        public Cert() { super("cert"); }
+        public byte[] getEncoded()
+                throws CertificateEncodingException { return (byte[])null; }
+        public void verify(PublicKey key)
+                throws CertificateException, NoSuchAlgorithmException,
+                InvalidKeyException, NoSuchProviderException,
+                SignatureException { }
+        public void verify(PublicKey key, String sigProvider)
+                throws CertificateException, NoSuchAlgorithmException,
+                InvalidKeyException, NoSuchProviderException,
+                SignatureException { }
+        public String toString() { return "cert"; }
+        public PublicKey getPublicKey() { return new PubKey1(); }
+    }
+
+    private static class X509Cert extends X509Certificate {
+        public byte[] getEncoded()
+                throws CertificateEncodingException { return (byte[])null; }
+        public void verify(PublicKey key)
+                throws CertificateException, NoSuchAlgorithmException,
+                InvalidKeyException, NoSuchProviderException,
+                SignatureException { }
+        public void verify(PublicKey key, String sigProvider)
+                throws CertificateException, NoSuchAlgorithmException,
+                InvalidKeyException, NoSuchProviderException,
+                SignatureException { }
+        public String toString() { return "x509cert"; }
+        public PublicKey getPublicKey() { return new PubKey2(); }
+
+        public void checkValidity()
+                throws CertificateExpiredException,
+                CertificateNotYetValidException { }
+        public void checkValidity(java.util.Date date)
+                throws CertificateExpiredException,
+                CertificateNotYetValidException { }
+        public int getVersion() { return 1; }
+        public BigInteger getSerialNumber() { return new BigInteger("5", 10); }
+        public Principal getIssuerDN()
+                                { return new X500Principal("cn=x509cert"); }
+        public X500Principal getIssuerX500Principal()
+                                { return new X500Principal("cn=x509cert"); }
+        public Principal getSubjectDN()
+                                { return new X500Principal("cn=x509cert"); }
+        public X500Principal getSubjectX500Principal()
+                                { return new X500Principal("cn=x509cert"); }
+        public Date getNotBefore() { return new Date(); }
+        public Date getNotAfter() { return new Date(); }
+        public byte[] getTBSCertificate() throws CertificateEncodingException
+                                { return (byte[])null; }
+        public byte[] getSignature() { return (byte[])null; }
+        public String getSigAlgName() { return "x509cert"; }
+        public String getSigAlgOID() { return "x509cert"; }
+        public byte[] getSigAlgParams() { return (byte[])null; }
+
+        public boolean[] getIssuerUniqueID() { return (boolean[])null; }
+        public boolean[] getSubjectUniqueID() { return (boolean[])null; }
+        public boolean[] getKeyUsage() { return (boolean[]) null; }
+        public int getBasicConstraints() { return 1; }
+
+        public boolean hasUnsupportedCriticalExtension() { return true; }
+        public Set getCriticalExtensionOIDs() { return new HashSet(); }
+        public Set getNonCriticalExtensionOIDs() { return new HashSet(); }
+        public byte[] getExtensionValue(String oid) { return (byte[])null; }
+    }
+
+    public static void main(String[] args) throws Exception {
+        testPrivateKeyEntry();
+        testSecretKeyEntry();
+        testTrustedCertificateEntry();
+    }
+
+    private static void testPrivateKeyEntry() throws Exception {
+        // TEST null private key
+        try {
+            Certificate[] chain = new Certificate[0];
+            KeyStore.PrivateKeyEntry pke = new KeyStore.PrivateKeyEntry
+                                                        (null, chain);
+            throw new SecurityException("test 1 failed");
+        } catch (NullPointerException npe) {
+            // good
+            System.out.println("test 1 passed");
+        }
+
+        // TEST null chain
+        try {
+            KeyStore.PrivateKeyEntry pke = new KeyStore.PrivateKeyEntry
+                                                (new PrivKey1(), null);
+            throw new SecurityException("test 2 failed");
+        } catch (NullPointerException npe) {
+            // good
+            System.out.println("test 2 passed");
+        }
+
+        // TEST empty chain
+        try {
+            Certificate[] chain = new Certificate[0];
+            KeyStore.PrivateKeyEntry pke = new KeyStore.PrivateKeyEntry
+                                                (new PrivKey1(), chain);
+            throw new SecurityException("test 3 failed");
+        } catch (IllegalArgumentException npe) {
+            // good
+            System.out.println("test 3 passed");
+        }
+
+        // TEST non-homogenous chain
+        try {
+            Certificate[] chain = new Certificate[2];
+            chain[0] = new Cert();
+            chain[1] = new X509Cert();
+            KeyStore.PrivateKeyEntry pke = new KeyStore.PrivateKeyEntry
+                                        (new PrivKey1(), chain);
+            throw new SecurityException("test 4 failed");
+        } catch (IllegalArgumentException npe) {
+            // good
+            System.out.println("test 4 passed");
+        }
+
+        // TEST non matching algorithms
+        try {
+            Certificate[] chain = new Certificate[1];
+            chain[0] = new Cert();
+            KeyStore.PrivateKeyEntry pke = new KeyStore.PrivateKeyEntry
+                                        (new PrivKey1(), chain);
+            throw new SecurityException("test 5 failed");
+        } catch (IllegalArgumentException npe) {
+            // good
+            System.out.println("test 5 passed");
+        }
+
+        // TEST correct behavior
+        Certificate[] chain = new Certificate[2];
+        chain[0] = new X509Cert();
+        chain[1] = new X509Cert();
+        PrivateKey pkey = new PrivKey1();
+        KeyStore.PrivateKeyEntry pke = new KeyStore.PrivateKeyEntry
+                                                (pkey, chain);
+        Certificate[] gotChain = pke.getCertificateChain();
+        if (gotChain instanceof X509Certificate[]) {
+            System.out.println("test 6 passed");
+        } else {
+            throw new SecurityException("test 6 failed");
+        }
+
+        if (gotChain.length == 2 &&
+            gotChain[0] == chain[0] &&
+            gotChain[1] == chain[1]) {
+            System.out.println("test 7 passed");
+        } else {
+            throw new SecurityException("test 7 failed");
+        }
+
+        if (pke.getPrivateKey() == pkey) {
+            System.out.println("test 8 passed");
+        } else {
+            throw new SecurityException("test 8 failed");
+        }
+    }
+
+    private static void testSecretKeyEntry() throws Exception {
+    }
+
+    private static void testTrustedCertificateEntry() throws Exception {
+    }
+}

test/jdk/java/security/KeyStore/DisabledKnownType.java

@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 8373690
+ * @summary verify that the exception message indicates the keystore type
+ *         when the type is disabled instead of being unrecognized
+ * @run main/othervm -Djdk.crypto.disabledAlgorithms=KeyStore.PKCS12 DisabledKnownType
+ */
+
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+
+public class DisabledKnownType {
+    public static void main(String[] args) throws Exception {
+        String cacertsPath = System.getProperty("java.home") +
+                "/lib/security/cacerts";
+        try {
+            KeyStore ks = KeyStore.getInstance(new java.io.File(cacertsPath),
+                    "changeit".toCharArray());
+            throw new RuntimeException("Expected KeyStoreException not thrown");
+        } catch (KeyStoreException kse) {
+            if (kse.getMessage().contains("PKCS12")) {
+                System.out.println("Passed: expected ex thrown: " + kse);
+            } else {
+                // pass it up
+                throw kse;
+            }
+        }
+    }
+}
+

test/jdk/java/security/KeyStore/EntryMethods.java

@@ -0,0 +1,578 @@
+/*
+ * Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test 1.5, 03/06/24
+ * @bug 4850376 8130850 8130181
+ * @summary Provide generic storage KeyStore storage facilities
+ */
+
+import java.security.*;
+import java.security.cert.*;
+import java.util.*;
+import java.io.*;
+
+public class EntryMethods
+    extends Provider
+    implements KeyStore.Entry
+{
+
+    private static FileInputStream pre15fis;
+    private static char[] password = {'f', 'o', 'o', 'b', 'a', 'r'};
+    private static char[] badPwd = {'b', 'a', 'd', 'p', 'w', 'd'};
+
+    public static class FooProtect implements KeyStore.ProtectionParameter { }
+    public static class FooParameter implements KeyStore.LoadStoreParameter {
+        public KeyStore.ProtectionParameter getProtectionParameter() {
+            return null;
+        }
+    }
+
+    public static class MyLoadStoreParameter
+        implements KeyStore.LoadStoreParameter {
+
+        private KeyStore.ProtectionParameter protection;
+
+        MyLoadStoreParameter(KeyStore.ProtectionParameter protection) {
+            this.protection = protection;
+        }
+
+        public KeyStore.ProtectionParameter getProtectionParameter() {
+            return protection;
+        }
+    }
+
+    public static class FooEntry implements KeyStore.Entry { }
+
+    public EntryMethods() throws Exception {
+        super("EntryMethods", "0.0", "EntryMethods");
+
+        pre15fis = new FileInputStream
+            (System.getProperty("test.src") + "/EntryMethods.pre15.keystore");
+
+        put("KeyStore.Pre15KeyStore", "EntryMethods$Pre15");
+        put("KeyStore.Post15KeyStore", "EntryMethods$Post15");
+        put("KeyStore.UnrecoverableKeyStore", "EntryMethods$UnrecoverableKS");
+    }
+
+    public static void main(String[] args) throws Exception {
+
+        EntryMethods entry = new EntryMethods();
+
+        // test pre-JDK1.5 KeyStore throws UnsupportedOperationExceptions
+        // for new methods
+        KeyStore pre15KS = KeyStore.getInstance("Pre15KeyStore", entry);
+        testPre15(pre15KS);
+
+        // test post-JDK1.5 KeyStore does right thing with new methods
+        KeyStore post15KS = KeyStore.getInstance("Post15KeyStore", entry);
+        testPost15(post15KS);
+
+        // test post-JDK1.5 KeyStore can throw new UnrecoverableEntryException
+        KeyStore uKS = KeyStore.getInstance("UnrecoverableKeyStore", entry);
+        testUnrecoverable(uKS);
+    }
+
+    private static void testPre15(KeyStore ks) throws Exception {
+
+        int tNum = 1;
+        KeyStore.Entry e = null;
+
+        // TEST load null param
+        ks.load((KeyStore.LoadStoreParameter)null);
+        System.out.println("[Pre1.5] test " + tNum++ + " passed");
+
+
+        // TEST load random param
+        try {
+            ks.load(new FooParameter());
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        } catch (UnsupportedOperationException uoe) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } catch (NoSuchAlgorithmException nsae) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST load custom param
+        ks.load(new MyLoadStoreParameter(
+            new KeyStore.PasswordProtection(password)));
+        System.out.println("[Pre1.5] test " + tNum++ + " passed");
+
+
+        // TEST store random param
+        ks.load(pre15fis, password);
+
+        // setup for later user
+        KeyStore.Entry pkeNew = ks.getEntry("privkey",
+                                new KeyStore.PasswordProtection(password));
+        KeyStore.Entry tceNew = ks.getEntry("trustedcert", null);
+
+        try {
+            ks.store(new FooParameter());
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        } catch (UnsupportedOperationException uoe) {
+            // good
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST store null param
+        try {
+            ks.store(null);
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        } catch (UnsupportedOperationException uoe) {
+            // good
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST getEntry with alias/protParam - use invalid alias
+        e = ks.getEntry("notPresent",
+                        new KeyStore.PasswordProtection(password));
+        if (e == null) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected null entry returned");
+        }
+
+
+        // TEST getEntry with alias/null protParam - get private key
+        try {
+            e = ks.getEntry("privkey", null);
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected UnrecoverableEntryException");
+        } catch (UnrecoverableEntryException uee) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST getEntry with alias/bad password - get private key
+        try {
+            e = ks.getEntry("privkey",
+                        new KeyStore.PasswordProtection(badPwd));
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected UnrecoverableEntryException");
+        } catch (UnrecoverableEntryException uee) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST getEntry with alias/unknown protection - get private key
+        try {
+            e = ks.getEntry("privkey", new FooProtect());
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected UnsupportedOperationException");
+        } catch (UnsupportedOperationException uoe) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST getEntry with alias/protParam - get private key
+        e = ks.getEntry("privkey", new KeyStore.PasswordProtection(password));
+        if (e instanceof KeyStore.PrivateKeyEntry) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected PrivateKeyEntry");
+        }
+
+
+        // TEST getEntry with alias/null protParam - get trusted cert
+        e = ks.getEntry("trustedcert", null);
+        if (e instanceof KeyStore.TrustedCertificateEntry) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        }
+
+
+        // TEST getEntry with alias/non-null protParam - get trusted cert
+        try {
+            e = ks.getEntry("trustedcert",
+                        new KeyStore.PasswordProtection(password));
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        } catch (UnsupportedOperationException uoe) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST setEntry with alias/entry/protParam - use invalid alias
+        try {
+            ks.setEntry("foo", new FooEntry(),
+                        new KeyStore.PasswordProtection(password));
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected KeyStoreException");
+        } catch (KeyStoreException kse) {
+            // good
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST setEntry with alias/entry/null protParam - set private key
+        try {
+            ks.setEntry("newPrivKey", pkeNew, null);
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected KeyStoreException");
+        } catch (KeyStoreException kse) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST setEntry with alias/entry/random protParam - set private key
+        try {
+            ks.setEntry("newPrivKey", pkeNew, new FooProtect());
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected KeyStoreException");
+        } catch (KeyStoreException kse) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST setEntry with alias/entry/protParam - set private key
+        ks.setEntry("newPrivKey", pkeNew,
+                        new KeyStore.PasswordProtection(password));
+        e = ks.getEntry("newPrivKey",
+                        new KeyStore.PasswordProtection(password));
+        if (e instanceof KeyStore.PrivateKeyEntry) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected PrivateKeyEntry");
+        }
+
+
+        // TEST setEntry with alias/entry/non null protParam - set trusted cert
+        try {
+            ks.setEntry("newTrustedcert", tceNew,
+                        new KeyStore.PasswordProtection(password));
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected KeyStoreException");
+        } catch (KeyStoreException kse) {
+            // good
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        }
+
+
+        // TEST setEntry with alias/entry/null protParam - set trusted cert
+        ks.setEntry("newTrustedcert", tceNew, null);
+        e = ks.getEntry("newTrustedcert", null);
+        if (e instanceof KeyStore.TrustedCertificateEntry) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed - " +
+                                "expected TrustedCertificateEntry");
+        }
+
+
+        // TEST entryInstanceOf - invalid alias
+        if (ks.entryInstanceOf("foo", EntryMethods.class) == false) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        }
+
+
+        // TEST entryInstanceOf - false case
+        if (ks.entryInstanceOf("privkey", EntryMethods.class) == false) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        }
+
+
+        // TEST entryInstanceOf - true case, trustedcert entry
+        if (ks.entryInstanceOf("trustedcert",
+                                KeyStore.TrustedCertificateEntry.class)) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        }
+
+
+        // TEST entryInstanceOf - true case, private key entry
+        if (ks.entryInstanceOf("privkey",
+                                KeyStore.PrivateKeyEntry.class)) {
+            System.out.println("[Pre1.5] test " + tNum++ + " passed");
+        } else {
+            throw new SecurityException("[Pre1.5] test " + tNum + " failed");
+        }
+
+    }
+
+    private static void testPost15(KeyStore ks) throws Exception {
+
+        KeyStore.Entry e = null;
+
+        ks.load(new EntryMethods.FooParameter());
+        ks.store(new EntryMethods.FooParameter());
+
+        e = ks.getEntry("foo", new KeyStore.PasswordProtection(password));
+        if (!(e instanceof EntryMethods.FooEntry)) {
+            throw new SecurityException
+                        ("testPost15 getEntry(String, ProtParm) " +
+                        "expected EntryMethods.FooEntry returned");
+        }
+
+        ks.setEntry("foo", new EntryMethods.FooEntry(),
+                        new KeyStore.PasswordProtection(password));
+
+        if (!ks.entryInstanceOf("foo", KeyStore.PrivateKeyEntry.class)) {
+            throw new SecurityException
+                        ("testPost15 entryInstanceOf(String, Class) " +
+                        "expected true returned");
+        }
+
+        System.out.println("[Post1.5] tests all passed");
+    }
+
+    private static void testUnrecoverable(KeyStore ks) throws Exception {
+        ks.load(new EntryMethods.FooParameter());
+        try {
+            ks.getEntry("foo", new KeyStore.PasswordProtection(password));
+            throw new SecurityException
+                ("UnrecoverableEntryException not thrown for " +
+                "getEntry(String, ProtectionParam)");
+        } catch (UnrecoverableEntryException uee) {
+            // good
+            System.out.println("[UnrecoverableEntry] test passed");
+        }
+    }
+
+    public static class Pre15 extends KeyStoreSpi {
+
+        private static KeyStore jks = getJKS();
+
+        private static KeyStore getJKS() {
+            try {
+                return (KeyStore) KeyStore.getInstance("JKS");
+            } catch (Exception e) {
+                e.printStackTrace();
+                throw new RuntimeException(e);
+            }
+        }
+        public Pre15() {
+        }
+
+        public Key engineGetKey(String alias, char[] password)
+            throws NoSuchAlgorithmException, UnrecoverableKeyException {
+            try {
+                return jks.getKey(alias, password);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public java.security.cert.Certificate[] engineGetCertificateChain
+                (String alias) {
+            try {
+                return jks.getCertificateChain(alias);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public java.security.cert.Certificate engineGetCertificate
+                (String alias) {
+            try {
+                return jks.getCertificate(alias);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public Date engineGetCreationDate(String alias) {
+            try {
+                return jks.getCreationDate(alias);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public void engineSetKeyEntry(String alias, Key key,
+                                   char[] password,
+                                   java.security.cert.Certificate[] chain)
+            throws KeyStoreException {
+            jks.setKeyEntry(alias, key, password, chain);
+        }
+
+        public void engineSetKeyEntry(String alias, byte[] key,
+                                   java.security.cert.Certificate[] chain)
+            throws KeyStoreException {
+            jks.setKeyEntry(alias, key, chain);
+        }
+
+        public void engineSetCertificateEntry(String alias,
+                                           java.security.cert.Certificate cert)
+            throws KeyStoreException {
+            jks.setCertificateEntry(alias, cert);
+        }
+
+        public void engineDeleteEntry(String alias)
+            throws KeyStoreException {
+            jks.deleteEntry(alias);
+        }
+
+        public Enumeration engineAliases() {
+            try {
+                return jks.aliases();
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+
+        }
+
+        public boolean engineContainsAlias(String alias) {
+            try {
+                return jks.containsAlias(alias);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public int engineSize() {
+            try {
+                return jks.size();
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public boolean engineIsKeyEntry(String alias) {
+            try {
+                return jks.isKeyEntry(alias);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public boolean engineIsCertificateEntry(String alias) {
+            try {
+                return jks.isCertificateEntry(alias);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public String engineGetCertificateAlias
+                (java.security.cert.Certificate cert) {
+            try {
+                return jks.getCertificateAlias(cert);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public void engineStore(OutputStream stream, char[] password)
+            throws IOException, NoSuchAlgorithmException, CertificateException {
+            try {
+                jks.store(stream, password);
+            } catch (KeyStoreException ke) {
+                throw new RuntimeException("Unexpected exception", ke);
+            }
+        }
+
+        public void engineLoad(InputStream stream, char[] password)
+            throws IOException, NoSuchAlgorithmException, CertificateException {
+            jks.load(stream, password);
+        }
+    }
+
+    public static class Post15 extends Pre15 {
+
+        public void engineStore(KeyStore.LoadStoreParameter parameter)
+            throws IOException, NoSuchAlgorithmException, CertificateException {
+            if (!(parameter instanceof EntryMethods.FooParameter)) {
+                throw new IOException("Post15 engineStore method expected " +
+                        "FooParameter");
+            }
+        }
+
+        public void engineLoad(KeyStore.LoadStoreParameter parameter)
+            throws IOException, NoSuchAlgorithmException, CertificateException {
+            if (!(parameter instanceof EntryMethods.FooParameter)) {
+                throw new IOException("Post15 engineLoadFrom method expected " +
+                        "FooParameter");
+            }
+        }
+
+        public KeyStore.Entry engineGetEntry(String alias,
+                        KeyStore.ProtectionParameter protectionParam)
+                        throws UnrecoverableEntryException {
+            if (!alias.equals("foo")) {
+                throw new SecurityException
+                        ("Post15 engineGetEntry(String, ProtectionParam) " +
+                        "expected [foo] alias");
+            }
+            KeyStore.PasswordProtection pwdParam =
+                                (KeyStore.PasswordProtection)protectionParam;
+            if (pwdParam.getPassword().length != 6) {
+                throw new SecurityException
+                        ("Post15 engineGetEntry(String, ProtectionParam) " +
+                        "expected [foobar] password");
+            }
+
+            return new EntryMethods.FooEntry();
+        }
+
+        public void engineSetEntry(String alias, KeyStore.Entry entry,
+                        KeyStore.ProtectionParameter protectionParam) {
+            if (!alias.equals("foo") ||
+                !(entry instanceof EntryMethods.FooEntry)) {
+                throw new SecurityException
+                        ("Post15 engineSetEntry(String, entry, ProtParm) " +
+                        "expected [foo] alias and EntryMethods.FooEntry");
+            }
+
+            KeyStore.PasswordProtection pwdParam =
+                                (KeyStore.PasswordProtection)protectionParam;
+            if (pwdParam.getPassword().length != 6) {
+                throw new SecurityException
+                        ("Post15 engineSetEntry(String, entry, ProtParm) " +
+                        "expected [foobar] password");
+            }
+        }
+
+        public boolean engineEntryInstanceOf(String alias,
+                                             Class<? extends KeyStore.Entry> entryClass)
+        {
+            if (!alias.equals("foo") ||
+                entryClass != KeyStore.PrivateKeyEntry.class) {
+                throw new SecurityException
+                        ("Post15 engineEntryInstanceOf(String, Class) " +
+                        "expected [foo] alias " +
+                        "and [KeyStore.PrivateKeyEntry] class");
+            }
+            return true;
+        }
+    }
+
+    public static class UnrecoverableKS extends Post15 {
+        public KeyStore.Entry engineGetEntry(String alias,
+                        KeyStore.ProtectionParameter protectionParam)
+                        throws UnrecoverableEntryException {
+            throw new UnrecoverableEntryException();
+        }
+    }
+}

test/jdk/java/security/KeyStore/KeyStoreBuilder.java

@@ -0,0 +1,227 @@
+/*
+ * Copyright (c) 2003, 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 4938922 4961104 5071293 6236533 8130181
+ * @summary verify that the KeyStore.Builder API works
+ * @author Andreas Sterbenz
+ */
+
+import java.io.*;
+import java.util.*;
+
+import java.security.*;
+import java.security.KeyStore.*;
+import java.security.cert.*;
+import java.security.cert.Certificate;
+
+import javax.security.auth.callback.*;
+
+public class KeyStoreBuilder {
+
+    private final static String DIR = System.getProperty("test.src", ".");
+
+    private static final char[] password = "passphrase".toCharArray();
+
+    private static final char[] wrongPassword = "wrong".toCharArray();
+
+    public static void main(String[] args) throws Exception {
+        File KSFILE = new File(DIR, "keystore.jks");
+        KeyStore ks;
+        String alias = "vajra";
+        Entry entry = null;
+
+        Builder builder;
+        builder = Builder.newInstance("JKS", null, KSFILE, new PasswordProtection(password));
+        ks = builder.getKeyStore();
+        System.out.println("-KeyStore: " + ks.size());
+        entry = ks.getEntry(alias, builder.getProtectionParameter(alias));
+        showEntry(entry);
+
+        builder = Builder.newInstance("JKS", Security.getProvider("Sun"), KSFILE,
+                new CallbackHandlerProtection(new DummyHandler()));
+        ks = builder.getKeyStore();
+        System.out.println("-KeyStore: " + ks.size());
+        entry = ks.getEntry(alias, builder.getProtectionParameter(alias));
+        showEntry(entry);
+
+        builder = Builder.newInstance("JKS", null, new PasswordProtection(password));
+        ks = builder.getKeyStore();
+        int k = ks.size();
+        System.out.println("-KeyStore: " + k);
+        if (k != 0) {
+            throw new Exception("Size not zero: " + k);
+        }
+
+        DummyHandler handler = new DummyHandler();
+
+        handler.useWrongPassword = 2;
+        builder = Builder.newInstance("JKS", null, KSFILE, new CallbackHandlerProtection(handler));
+        ks = builder.getKeyStore();
+        System.out.println("-KeyStore: " + ks.size());
+        entry = ks.getEntry(alias, builder.getProtectionParameter(alias));
+        showEntry(entry);
+
+        handler.useWrongPassword = 3;
+        builder = Builder.newInstance("JKS", null, KSFILE, new CallbackHandlerProtection(handler));
+        try {
+            ks = builder.getKeyStore();
+            throw new Exception("should not succeed");
+        } catch (KeyStoreException e) {
+            System.out.println(e);
+        }
+        try {
+            ks = builder.getKeyStore();
+            throw new Exception("should not succeed");
+        } catch (KeyStoreException e) {
+            System.out.println(e);
+        }
+
+        Provider p = new MyProvider();
+
+        handler.useWrongPassword = 2;
+        builder = Builder.newInstance("My", p, new CallbackHandlerProtection(handler));
+        ks = builder.getKeyStore();
+        k = ks.size();
+        System.out.println("-KeyStore: " + k);
+        if (k != 0) {
+            throw new Exception("Size not zero: " + k);
+        }
+
+        handler.useWrongPassword = 3;
+        builder = Builder.newInstance("My", p, new CallbackHandlerProtection(handler));
+        try {
+            ks = builder.getKeyStore();
+            throw new Exception("should not succeed");
+        } catch (KeyStoreException e) {
+            System.out.println(e);
+        }
+        try {
+            ks = builder.getKeyStore();
+            throw new Exception("should not succeed");
+        } catch (KeyStoreException e) {
+            System.out.println(e);
+        }
+
+        System.out.println("-OK");
+    }
+
+    private static void showEntry(Entry entry) {
+        PrivateKeyEntry pke = (PrivateKeyEntry)entry;
+        X509Certificate cert = (X509Certificate)pke.getCertificate();
+        System.out.println("subject: " + cert.getSubjectX500Principal());
+    }
+
+    private static class DummyHandler implements CallbackHandler {
+
+        int useWrongPassword;
+
+        public void handle(Callback[] callbacks)
+                throws IOException, UnsupportedCallbackException {
+            System.out.println("** Callbackhandler invoked");
+            for (int i = 0; i < callbacks.length; i++) {
+                Callback cb = callbacks[i];
+                if (cb instanceof PasswordCallback) {
+                    System.out.println("Found PasswordCallback");
+                    PasswordCallback pcb = (PasswordCallback)cb;
+                    if (useWrongPassword == 0) {
+                        pcb.setPassword(password);
+                    } else {
+                        pcb.setPassword(wrongPassword);
+                        useWrongPassword--;
+                    }
+                    break;
+                }
+            }
+        }
+    }
+
+    private static class BaseKeyStoreSpi extends KeyStoreSpi {
+        public Key engineGetKey(String alias, char[] password) {
+            return null;
+        }
+        public Certificate[] engineGetCertificateChain(String alias) {
+            return null;
+        }
+        public Certificate engineGetCertificate(String alias) {
+            return null;
+        }
+        public Date engineGetCreationDate(String alias) {
+            return null;
+        }
+        public void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] certs) {
+            //
+        }
+        public void engineSetKeyEntry(String alias, byte[] key, Certificate[] certs) {
+            //
+        }
+        public void engineSetCertificateEntry(String alias, Certificate cert) {
+            //
+        }
+        public void engineDeleteEntry(String alias) {
+            //
+        }
+        public Enumeration<String> engineAliases() {
+            return new Vector<String>().elements();
+        }
+        public boolean engineContainsAlias(String alias) {
+            return false;
+        }
+        public int engineSize() {
+            return 0;
+        }
+        public boolean engineIsKeyEntry(String alias) {
+            return false;
+        }
+        public boolean engineIsCertificateEntry(String alias) {
+            return false;
+        }
+        public String engineGetCertificateAlias(Certificate cert) {
+            return null;
+        }
+        public void engineStore(OutputStream stream, char[] password) {
+            //
+        }
+        public void engineLoad(InputStream stream, char[] password) throws IOException {
+            //
+        }
+    }
+
+    public static class MyKeyStoreSpi extends BaseKeyStoreSpi {
+        public void engineLoad(InputStream stream, char[] pw) throws IOException {
+            if (Arrays.equals(password, pw) == false) {
+                Throwable t = new UnrecoverableKeyException("Wrong password: " + new String(pw));
+                throw (IOException)new IOException("load() failed").initCause(t);
+            }
+        }
+    }
+
+    private static class MyProvider extends Provider {
+        MyProvider() {
+            super("My", "1.0", null);
+            put("KeyStore.My", "KeyStoreBuilder$MyKeyStoreSpi");
+        }
+    }
+
+}

test/jdk/java/security/KeyStore/OneProbeOneNot.java

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8245679
+ * @summary KeyStore cannot probe PKCS12 keystore if BouncyCastle is the top security provider
+ * @run main/othervm OneProbeOneNot
+ */
+
+import java.io.File;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.*;
+import java.security.cert.Certificate;
+import java.util.Date;
+import java.util.Enumeration;
+
+public class OneProbeOneNot {
+    public static final void main(String[] args) throws Exception {
+        Files.write(Path.of("ks"), "".getBytes());
+        // 1st provider do not support probe
+        Security.insertProviderAt(new P1(), 1);
+        // 2nd provider support probe
+        Security.insertProviderAt(new P2(), 2);
+        KeyStore ks = KeyStore.getInstance(new File("ks"), (char[])null);
+        System.out.println(ks.getProvider().getName());
+        System.out.println(ks.getType());
+    }
+
+    public static class P1 extends Provider {
+        public P1() {
+            super("P1", "P1", "P1");
+            putService(new Service(this, "KeyStore", "Oops",
+                    K1.class.getName(), null, null));
+        }
+    }
+    public static class P2 extends Provider {
+        public P2() {
+            super("P2", "P2", "P2");
+            putService(new Service(this, "KeyStore", "Oops",
+                    K2.class.getName(), null, null));
+        }
+    }
+
+    public static class K1 extends KeyStoreSpi {
+        public Key engineGetKey(String a, char[] p) { return null; }
+        public Certificate[] engineGetCertificateChain(String a) { return null; }
+        public Certificate engineGetCertificate(String a) { return null; }
+        public Date engineGetCreationDate(String a) { return null; }
+        public void engineSetKeyEntry(String a, Key k, char[] p, Certificate[] c) { }
+        public void engineSetKeyEntry(String a, byte[] k, Certificate[] c) { }
+        public void engineSetCertificateEntry(String a, Certificate c) { }
+        public void engineDeleteEntry(String a) { }
+        public Enumeration<String> engineAliases() { return null; }
+        public boolean engineContainsAlias(String a) { return false; }
+        public int engineSize() { return 0; }
+        public boolean engineIsKeyEntry(String a) { return false; }
+        public boolean engineIsCertificateEntry(String a) { return false; }
+        public String engineGetCertificateAlias(Certificate c) { return null; }
+        public void engineStore(OutputStream stream, char[] password) { }
+        public void engineLoad(InputStream stream, char[] password) { }
+    }
+
+    public static class K2 extends K1 {
+        public boolean engineProbe(InputStream s) {
+            return true;
+        }
+    }
+}

test/jdk/java/security/KeyStore/PBETest.java

@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8006591
+ * @summary Protect keystore entries using stronger PBE algorithms
+ */
+
+import java.io.*;
+import java.security.*;
+import javax.crypto.*;
+import javax.crypto.spec.*;
+
+// Retrieve a keystore entry, protected by the default encryption algorithm.
+// Set the keystore entry, protected by a stronger encryption algorithm.
+
+public class PBETest {
+    private final static String DIR = System.getProperty("test.src", ".");
+    private final static String KEY_PROTECTION_PROPERTY =
+        "keystore.PKCS12.keyProtectionAlgorithm";
+    private static final String[] PBE_ALGOS = {
+        "PBEWithSHA1AndDESede",
+        "PBEWithHmacSHA1AndAES_128",
+        "PBEWithHmacSHA224AndAES_128",
+        "PBEWithHmacSHA256AndAES_128",
+        "PBEWithHmacSHA384AndAES_128",
+        "PBEWithHmacSHA512AndAES_128"
+    };
+    private static final char[] PASSWORD = "passphrase".toCharArray();
+    private static final String KEYSTORE_TYPE = "JKS";
+    private static final String KEYSTORE = DIR + "/keystore.jks";
+    private static final String NEW_KEYSTORE_TYPE = "PKCS12";
+    private static final String ALIAS = "vajra";
+
+    private static final byte[] IV = {
+        0x11,0x12,0x13,0x14,0x15,0x16,0x17,0x18,
+        0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x20
+    };
+    private static final byte[] SALT = {
+        0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08
+    };
+    private static final int ITERATION_COUNT = 1024;
+
+    public static void main(String[] args) throws Exception {
+        for (String algo : PBE_ALGOS) {
+            String filename = algo + ".p12";
+            main0(algo, filename, true);
+            main0(algo, filename, false);
+            Security.setProperty(KEY_PROTECTION_PROPERTY, algo);
+            main0(null, "PBE.p12", false);
+            Security.setProperty(KEY_PROTECTION_PROPERTY, "");
+        }
+        main0(null, "default.p12", false); // default algorithm
+    }
+
+    private static void main0(String algo, String filename, boolean useParams)
+        throws Exception {
+
+        KeyStore keystore = load(KEYSTORE_TYPE, KEYSTORE, PASSWORD);
+        KeyStore.Entry entry =
+            keystore.getEntry(ALIAS,
+                new KeyStore.PasswordProtection(PASSWORD));
+        System.out.println("Retrieved key entry named '" + ALIAS + "'");
+        Key originalKey = null;
+        if (entry instanceof KeyStore.PrivateKeyEntry) {
+            originalKey = ((KeyStore.PrivateKeyEntry) entry).getPrivateKey();
+        } else if (entry instanceof KeyStore.SecretKeyEntry) {
+            originalKey = ((KeyStore.SecretKeyEntry) entry).getSecretKey();
+        }
+
+        // Set entry
+        KeyStore keystore2 = load(NEW_KEYSTORE_TYPE, null, null);
+        if (useParams) {
+            keystore2.setEntry(ALIAS, entry,
+                new KeyStore.PasswordProtection(PASSWORD, algo,
+                    new PBEParameterSpec(SALT, ITERATION_COUNT,
+                        new IvParameterSpec(IV))));
+            System.out.println("Encrypted key entry using: " + algo +
+                " (with PBE parameters)");
+        } else if (algo != null) {
+            keystore2.setEntry(ALIAS, entry,
+                new KeyStore.PasswordProtection(PASSWORD, algo, null));
+            System.out.println("Encrypted key entry using: " + algo +
+                " (without PBE parameters)");
+        } else {
+            keystore2.setEntry(ALIAS, entry,
+                new KeyStore.PasswordProtection(PASSWORD));
+            String prop = Security.getProperty(KEY_PROTECTION_PROPERTY);
+            if (prop == null || prop.isEmpty()) {
+                System.out.println("Encrypted key entry using: " +
+                    "default PKCS12 key protection algorithm");
+            } else {
+                System.out.println("Encrypted key entry using: " +
+                    "keyProtectionAlgorithm=" + prop);
+            }
+        }
+
+        try (FileOutputStream outStream = new FileOutputStream(filename)) {
+            System.out.println("Storing keystore to: " + filename);
+            keystore2.store(outStream, PASSWORD);
+        }
+
+        try {
+            keystore2 = load(NEW_KEYSTORE_TYPE, filename, PASSWORD);
+            entry = keystore2.getEntry(ALIAS,
+                new KeyStore.PasswordProtection(PASSWORD));
+            Key key;
+            if (entry instanceof KeyStore.PrivateKeyEntry) {
+                key = ((KeyStore.PrivateKeyEntry) entry).getPrivateKey();
+            } else if (entry instanceof KeyStore.SecretKeyEntry) {
+                key = ((KeyStore.SecretKeyEntry) entry).getSecretKey();
+            } else {
+                throw new Exception("Failed to retrieve key entry");
+            }
+            if (originalKey.equals(key)) {
+                System.out.println("Retrieved key entry named '" + ALIAS + "'");
+                System.out.println();
+            } else {
+                throw new Exception(
+                    "Failed: recovered key does not match the original key");
+            }
+
+        } finally {
+            new File(filename).delete();
+        }
+    }
+
+    private static KeyStore load(String type, String path, char[] password)
+        throws Exception {
+        KeyStore keystore = KeyStore.getInstance(type);
+
+        if (path != null) {
+
+            try (FileInputStream inStream = new FileInputStream(path)) {
+                System.out.println("Loading keystore from: " + path);
+                keystore.load(inStream, password);
+                System.out.println("Loaded keystore with " + keystore.size() +
+                    " entries");
+            }
+        } else {
+            keystore.load(null, null);
+        }
+
+        return keystore;
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/CheckDefaults.java

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+import java.security.KeyStore;
+import java.security.Security;
+import static java.lang.System.out;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Set up keystore.type secure property and check that
+ * KeyStore.getDefaultType() value is related to property value. Expect a full
+ * match the value 'keystore.type' and the value of the
+ * KeyStore.getDefaultType()
+ * @run  main/othervm CheckDefaults
+ */
+public class CheckDefaults {
+    private static final String DEFAULT_KEY_STORE_TYPE = "pkcs12";
+    private static final String[] KEY_STORE_TYPES = {"jks", "pkcs12", "jceks",
+        "Unregistered_type_of_KS"};
+
+    private void runTest(String[] args) {
+        if (!KeyStore.getDefaultType().
+                equalsIgnoreCase(DEFAULT_KEY_STORE_TYPE)) {
+            throw new RuntimeException(String.format("Default keystore type "
+                    + "Expected '%s' . Actual: '%s' ", DEFAULT_KEY_STORE_TYPE,
+                    KeyStore.getDefaultType()));
+        }
+        for (String ksDefaultType : KEY_STORE_TYPES) {
+            Security.setProperty("keystore.type", ksDefaultType);
+            if (!KeyStore.getDefaultType().equals(ksDefaultType)) {
+                throw new RuntimeException(String.format(
+                        "Keystore default type value: '%s' cannot be set up via"
+                        + " keystore.type "
+                        + "security property, Actual: '%s'",
+                        ksDefaultType, KeyStore.getDefaultType()));
+            }
+        }
+        out.println("Test Passed");
+    }
+
+    public static void main(String[] args) {
+        CheckDefaults checkDefaultsTest = new CheckDefaults();
+        checkDefaultsTest.runTest(args);
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/CheckNullDefault.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+import java.security.KeyStore;
+import static java.lang.System.out;
+
+/**
+ * @test
+ * @bug 8304956
+ * @summary Set keystore.type as null and check that
+ * KeyStore.getDefaultType() returns pkcs12
+ * @run main/othervm
+ *  -Djava.security.properties==${test.src}/java.security CheckDefaults
+ */
+public class CheckNullDefault {
+    public static void main(String[] args) {
+        if (!KeyStore.getDefaultType().
+            equalsIgnoreCase("pkcs12")) {
+            throw new RuntimeException(String.format("Default keystore type "
+                    + "Expected '%s' . Actual: '%s' ", "pkcs12",
+                KeyStore.getDefaultType()));
+        }
+        out.println("Test Passed");
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/ConvertP12Test.java

@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2008, 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import static java.lang.System.out;
+
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.Key;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Enumeration;
+
+/*
+ * @test
+ * @bug 8048619
+ * @author  Bill Situ
+ * @summary Test converting keystore from jceks to P12 and from P12 to other
+ *  (jceks,jks). including following test cases:
+ * Read jceks key store and convert to the p12 key store, then compare entries
+ *  in the two key stores.
+ * Read p12 key store and convert to the jceks key store, then compare entries
+ *  in the two key stores.
+ * Read p12 key store (contains only private key and a self-signed certificate)
+ *  and convert to the jceks key store, then compare entries of two key stores.
+ * Read p12 key store (contains 2 entries) and convert to the jceks key store,
+ *  then compare entries in the two key stores.
+ * Read p12 key store (entry password and key store password are different) and
+ *  convert to the jceks key store, then compare entries in the two key stores.
+ * Read p12 key store and convert to the jks key store, then compare entries
+ *  in the two key stores.
+ * Read p12 key store (contains only private key and a self-signed certificate)
+ *  and convert to the jks key store, then compare entries in the two key stores.
+ * Read p12 key store (contains 2 entries) and convert to the jks key store,
+ *  then compare entries in the two key stores.
+ * Read p12 key store (entry password and key store password are different) and
+ * convert to the jks key store, then compare entries in the two key stores.
+ */
+
+public class ConvertP12Test {
+
+    private static final String SUN_JSSE = "SunJSSE";
+    private static final String SUN_JCE = "SunJCE";
+    private static final String SUN = "SUN";
+    private static final String PKCS12 = "pkcs12";
+    private static final String JCE_KS = "JceKS";
+    private static final String JKS = "JKS";
+
+    public static void main(String args[]) throws Exception {
+
+        ConvertP12Test jstest = new ConvertP12Test();
+
+        jstest.driver("JceksToP12", "keystoreCA.jceks.data", JCE_KS, SUN_JCE,
+                "storepass", "keypass", PKCS12, SUN_JSSE);
+
+        jstest.driver("P12ToJceks_Chain", "ie_jceks_chain.pfx.data", PKCS12,
+                SUN_JSSE, "pass", "pass", JCE_KS, SUN_JCE);
+
+        jstest.driver("P12ToJceks_SelfSigned", "jdk_jceks_selfsigned.p12.data",
+                PKCS12, SUN_JSSE, "pass", "pass", JCE_KS, SUN_JCE);
+
+        jstest.driver("P12ToJceks_TwoEntry", "jdk_jceks_twoentry.p12.data",
+                PKCS12, SUN_JSSE, "pass", "pass", JCE_KS, SUN_JCE);
+
+        jstest.driver("P12ToJceks_TwoPass", "jdk_jceks_twopass.p12.data",
+                PKCS12, SUN_JSSE, "storepass", "keypass", JCE_KS, SUN_JCE);
+
+        jstest.driver("P12ToJks_Chain", "ie_jks_chain.pfx.data", PKCS12,
+                SUN_JSSE, "pass", "pass", JKS, SUN);
+
+        jstest.driver("P12ToJks_SelfSigned", "jdk_jks_selfsigned.p12.data",
+                PKCS12, SUN_JSSE, "pass", "pass", JKS, SUN);
+
+        jstest.driver("P12ToJks_TwoEntry", "jdk_jks_twoentry.p12.data", PKCS12,
+                SUN_JSSE, "pass", "pass", JKS, SUN);
+
+        jstest.driver("P12ToJks_TwoPass", "jdk_jks_twopass.p12.data", PKCS12,
+                SUN_JSSE, "storepass", "keypass", JKS, SUN);
+
+    }
+
+    private void driver(String testCase, String inKeyStore,
+            String inKeyStoreType, String inKeyStoreTypePrv,
+            String inStorePass, String inKeyPass, String outKeyStoreType,
+            String outKeyStorePrv) throws Exception {
+
+        String outStorePass = "pass";
+        String outKeyPass = "pass";
+        KeyStore inputKeyStore, outputKeyStore;
+
+        out.println("Testing " + testCase);
+        String keystorePath = System.getProperty("test.src", ".")
+                + File.separator + "certs" + File.separator + "convertP12";
+        out.println("Output KeyStore : " + inKeyStore + ".out");
+        String outKeyStoreName = inKeyStore + ".out";
+        try (FileOutputStream fout = new FileOutputStream(outKeyStoreName);) {
+            inputKeyStore = KeyStore.getInstance(inKeyStoreType,
+                    inKeyStoreTypePrv);
+
+            // KeyStore have encoded by Base64.getMimeEncoder().encode(),need
+            // decode first.
+            byte[] input = Files.readAllBytes(Paths.get(keystorePath,
+                    inKeyStore));
+            ByteArrayInputStream arrayIn = new ByteArrayInputStream(Base64
+                    .getMimeDecoder().decode(input));
+
+            out.println("Input KeyStore : " + inKeyStore);
+
+            inputKeyStore.load(arrayIn, inStorePass.toCharArray());
+
+            outputKeyStore = KeyStore.getInstance(outKeyStoreType,
+                    outKeyStorePrv);
+            outputKeyStore.load(null, null);
+
+            run(inputKeyStore, outputKeyStore, inKeyPass, outKeyPass);
+
+            outputKeyStore.store(fout, outStorePass.toCharArray());
+
+            // for P12ToJks_TwoEntry test case will test includes each other,
+            // others just test compareKeystore
+            if (testCase.contains("TwoEntry")) {
+
+                compareKeyStore(inputKeyStore, outputKeyStore, inKeyPass,
+                        outKeyPass, 2);
+                compareKeyStore(outputKeyStore, inputKeyStore, outKeyPass,
+                        inKeyPass, 2);
+            } else {
+                compareKeyStore(inputKeyStore, outputKeyStore, inKeyPass,
+                        outKeyPass, 1);
+            }
+            out.println("Test " + testCase + " STATUS: Pass!!");
+        } catch (Exception ex) {
+            out.println("Test " + testCase + " STATUS: failed with exception: "
+                    + ex.getMessage());
+            throw ex;
+        }
+    }
+
+    private void run(KeyStore inputKeyStore, KeyStore outputKeyStore,
+            String inKeyPass, String outKeyPass) throws Exception {
+        Enumeration<String> e = inputKeyStore.aliases();
+        String alias;
+        while (e.hasMoreElements()) {
+            alias = e.nextElement();
+            Certificate[] certs = inputKeyStore.getCertificateChain(alias);
+
+            boolean isCertEntry = inputKeyStore.isCertificateEntry(alias);
+            // Test KeyStore only contain key pair entries.
+            if (isCertEntry == true) {
+                throw new RuntimeException(
+                        "inputKeystore should not be certEntry because test"
+                                + " keystore only contain key pair entries"
+                                + " for alias:" + alias);
+            }
+
+            boolean isKeyEntry = inputKeyStore.isKeyEntry(alias);
+            Key key = null;
+            if (isKeyEntry) {
+                key = inputKeyStore.getKey(alias, inKeyPass.toCharArray());
+            } else {
+                throw new RuntimeException("Entry type unknown for alias:"
+                        + alias);
+            }
+            outputKeyStore.setKeyEntry(alias, key, outKeyPass.toCharArray(),
+                    certs);
+        }
+    }
+
+    private void compareKeyStore(KeyStore a, KeyStore b, String inKeyPass,
+            String outKeyPass, int keyStoreSize) throws Exception {
+        if (a.size() != keyStoreSize || b.size() != keyStoreSize) {
+            throw new RuntimeException("size not match or size not equal to "
+                    + keyStoreSize);
+        }
+
+        Enumeration<String> eA = a.aliases();
+        while (eA.hasMoreElements()) {
+            String aliasA = eA.nextElement();
+
+            if (!b.containsAlias(aliasA)) {
+                throw new RuntimeException("alias not match for alias:"
+                        + aliasA);
+            }
+
+            compareKeyEntry(a, b, inKeyPass, outKeyPass, aliasA);
+        }
+    }
+
+    private void compareKeyEntry(KeyStore a, KeyStore b, String aPass,
+            String bPass, String alias) throws KeyStoreException,
+            UnrecoverableKeyException, NoSuchAlgorithmException {
+        Certificate[] certsA = a.getCertificateChain(alias);
+        Certificate[] certsB = b.getCertificateChain(alias);
+
+        if (!Arrays.equals(certsA, certsB)) {
+            throw new RuntimeException("Certs don't match for alias:" + alias);
+        }
+
+        Key keyA = a.getKey(alias, aPass.toCharArray());
+        Key keyB = b.getKey(alias, bPass.toCharArray());
+
+        if (!keyA.equals(keyB)) {
+            throw new RuntimeException(
+                    "Key don't match for alias:" + alias);
+        }
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/EntryProtectionTest.java

@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+import java.io.File;
+import static java.lang.System.err;
+import java.security.*;
+import java.security.cert.Certificate;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Random;
+import javax.crypto.spec.PBEParameterSpec;
+import jdk.test.lib.RandomFactory;
+import static java.lang.System.out;
+import java.util.Arrays;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Test for feature 'support stronger entry protection'. An entry is
+ * stored to keystore with different PasswordProtection objects which are
+ * specified by different PBE algorithms (use -Dseed=X to set PRNG seed)
+ * @library /test/lib ../
+ * @key randomness
+ * @build jdk.test.lib.RandomFactory
+ * @run main EntryProtectionTest
+ */
+public class EntryProtectionTest {
+    private static final char[] PASSWORD = "passwd".toCharArray();
+    private static final String ALIAS = "testkey";
+    private static final byte[] SALT = new byte[8];
+    private static final int ITERATION_COUNT = 1024;
+    private static final List<KeyStore.PasswordProtection> PASSWORD_PROTECTION
+            = new ArrayList<>();
+    private static final String KEYSTORE_PATH = System.getProperty(
+            "test.classes" + File.separator + "ks.pkcs12",
+            "." + File.separator + "ks.pkcs12");
+
+    private void runTest() throws Exception {
+            KeyStore ksIn = Utils.loadKeyStore(KEYSTORE_PATH,
+                    Utils.KeyStoreType.pkcs12, PASSWORD);
+            KeyStore ksTest = KeyStore
+                    .getInstance(Utils.KeyStoreType.pkcs12.name());
+            ksTest.load(null);
+            Certificate cert = ksIn.getCertificate(ALIAS);
+            Key key = ksIn.getKey(ALIAS, PASSWORD);
+            KeyStore.Entry keyStoreEntry = new KeyStore.PrivateKeyEntry(
+                    (PrivateKey) key, new Certificate[]{cert});
+            for (KeyStore.PasswordProtection passwordAlgorithm :
+                    PASSWORD_PROTECTION) {
+                out.println("Try to use: " +
+                        passwordAlgorithm.getProtectionAlgorithm());
+                ksTest.setEntry(ALIAS, keyStoreEntry, passwordAlgorithm);
+                KeyStore.Entry entryRead = ksTest.getEntry(ALIAS,
+                        new KeyStore.PasswordProtection(PASSWORD));
+                if (!isPrivateKeyEntriesEqual((KeyStore.PrivateKeyEntry)
+                        keyStoreEntry, (KeyStore.PrivateKeyEntry)entryRead)) {
+                    err.println("Original entry in KeyStore: " + keyStoreEntry);
+                    err.println("Enc/Dec entry : " + entryRead);
+                    throw new RuntimeException(
+                            String.format(
+                                    "Decrypted & original enities do "
+                                    + "not match. Algo: %s, Actual: %s, "
+                                    + "Expected: %s",
+                                    passwordAlgorithm.getProtectionAlgorithm(),
+                                    entryRead, keyStoreEntry));
+                }
+                ksTest.deleteEntry(ALIAS);
+            }
+            out.println("Test Passed");
+    }
+
+    public static void main(String args[]) throws Exception {
+        EntryProtectionTest entryProtectionTest = new EntryProtectionTest();
+        entryProtectionTest.setUp();
+        entryProtectionTest.runTest();
+    }
+
+    private void setUp() {
+        out.println("Using KEYSTORE_PATH:"+KEYSTORE_PATH);
+        Utils.createKeyStore(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH, ALIAS);
+        Random rand = RandomFactory.getRandom();
+        rand.nextBytes(SALT);
+        out.print("Salt: ");
+        for (byte b : SALT) {
+            out.format("%02X ", b);
+        }
+        out.println("");
+        PASSWORD_PROTECTION
+                .add(new KeyStore.PasswordProtection(PASSWORD,
+                                "PBEWithMD5AndDES", new PBEParameterSpec(SALT,
+                                        ITERATION_COUNT)));
+        PASSWORD_PROTECTION.add(new KeyStore.PasswordProtection(PASSWORD,
+                "PBEWithSHA1AndDESede", null));
+        PASSWORD_PROTECTION.add(new KeyStore.PasswordProtection(PASSWORD,
+                "PBEWithSHA1AndRC2_40", null));
+        PASSWORD_PROTECTION.add(new KeyStore.PasswordProtection(PASSWORD,
+                "PBEWithSHA1AndRC2_128", null));
+        PASSWORD_PROTECTION.add(new KeyStore.PasswordProtection(PASSWORD,
+                "PBEWithSHA1AndRC4_40", null));
+        PASSWORD_PROTECTION.add(new KeyStore.PasswordProtection(PASSWORD,
+                "PBEWithSHA1AndRC4_128", null));
+    }
+
+    /**
+     * Checks whether given two KeyStore.PrivateKeyEntry parameters are equal
+     * The KeyStore.PrivateKeyEntry fields like {privateKey, certificateChain[]}
+     * are checked for equality and another field Set<attributes> is not checked
+     * as default implementation adds few PKCS12 attributes during read
+     * operation
+     * @param  first
+     *         parameter is of type KeyStore.PrivateKeyEntry
+     * @param  second
+     *         parameter is of type KeyStore.PrivateKeyEntry
+     * @return boolean
+     *         true when both the KeyStore.PrivateKeyEntry fields are equal
+    */
+    boolean isPrivateKeyEntriesEqual(KeyStore.PrivateKeyEntry first,
+            KeyStore.PrivateKeyEntry second) {
+        //compare privateKey
+        if (!Arrays.equals(first.getPrivateKey().getEncoded(),
+                second.getPrivateKey().getEncoded())) {
+            err.println("Mismatch found in privateKey!");
+            return false;
+        }
+        //compare certificateChain[]
+        if (!Arrays.equals(first.getCertificateChain(),
+                second.getCertificateChain())) {
+            err.println("Mismatch found in certificate chain!");
+            return false;
+        }
+        return true;
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/KeytoolReaderP12Test.java

@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.StandardOpenOption;
+import java.util.Base64;
+import jdk.test.lib.process.OutputAnalyzer;
+import static java.lang.System.out;
+import java.nio.file.Paths;
+import java.util.List;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Test for PKCS12 keystore list , export commands. Refer README for
+ * keystore files information
+ * @library ../
+ * @library /test/lib
+ * @run main KeytoolReaderP12Test
+ */
+public class KeytoolReaderP12Test {
+    private static final String WORKING_DIRECTORY = System.getProperty(
+            "test.classes", "."+ File.separator);
+    //private static final String KS_PASSWD = "pass";
+    private static final String KS_PASSWD = "storepass";
+    private static final String CERT_CHAIN_PASSWD = "password";
+    private static final String SOURCE_DIRECTORY =
+            System.getProperty("test.src", "." + File.separator);
+
+    public static void main(String[] args) throws Exception {
+        List<String> expectedValues = null;
+        out.println("Self signed test");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "api_private_key.p12_expected.data"));
+        readTest("api_private_key.p12.data", KS_PASSWD, expectedValues);
+        out.println("Self signed test Passed");
+
+        out.println("private key with selfsigned cert, key pair not match");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "api_private_key_not_match.p12_expected.data"));
+        readTest("api_private_key_not_match.p12.data", KS_PASSWD,
+                expectedValues);
+        out.println("private key with selfsigned cert, key pair "
+                + "not match passed");
+
+        out.println("cert chain test");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "api_cert_chain.p12_expected.data"));
+        readTest("api_cert_chain.p12.data", CERT_CHAIN_PASSWD, expectedValues);
+        out.println("cert chain test passed");
+
+        out.println("IE self test");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "ie_self.pfx.pem"));
+        exportTest("ie_self.pfx.data", "pkcs12testenduser1",
+                KS_PASSWD, expectedValues);
+        out.println("IE self test passed");
+
+        out.println("IE chain test");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "ie_chain.pfx.pem"));
+        exportTest("ie_chain.pfx.data", "servercert",
+                CERT_CHAIN_PASSWD, expectedValues);
+        out.println("IE chain test passed");
+
+        out.println("Netscape self");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "netscape_self.p12.pem"));
+        exportTest("netscape_self.p12.data", "pkcs12testenduser1",
+                KS_PASSWD, expectedValues);
+        out.println("Netscape self passed");
+
+        out.println("Mozilla self test");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "mozilla_self.p12.pem"));
+        exportTest("mozilla_self.p12.data", "pkcs12testenduser1",
+                KS_PASSWD, expectedValues);
+        out.println("Mozilla self test passed");
+
+        out.println("Openssl test");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "openssl.p12.pem"));
+        exportTest("openssl.p12.data", "servercert", CERT_CHAIN_PASSWD, expectedValues);
+        out.println("openssl test passed");
+
+        out.println("with different keystore and entrykey password");
+        expectedValues = Files.readAllLines(Paths.get(SOURCE_DIRECTORY,
+                "api_two_pass.p12_expected.data"));
+        readTest("api_two_pass.p12.data", KS_PASSWD,
+                expectedValues);
+        out.println("two pass test passed");
+    }
+
+    private static void readTest(String name, String password,
+            List<String> expectedValues)
+            throws IOException {
+        convertToPFX(name);
+        final String[] command = new String[]{"-debug", "-list", "-v",
+            "-keystore", WORKING_DIRECTORY + File.separator + name,
+            "-storetype", "pkcs12", "-storepass", password};
+        runAndValidate(command, expectedValues);
+    }
+
+    private static void exportTest(String name, String alias,
+            String password, List<String> expectedValues)
+            throws IOException {
+        convertToPFX(name);
+        final String[] command = new String[]{"-debug", "-export", "-alias",
+            alias, "-keystore", WORKING_DIRECTORY + File.separator + name,
+            "-storepass", password, "-storetype", "pkcs12", "-rfc"};
+        runAndValidate(command, expectedValues);
+    }
+
+    private static void runAndValidate(String[] command,
+            List<String> expectedValues) throws IOException {
+        OutputAnalyzer output = Utils.executeKeytoolCommand(command);
+        if (expectedValues != null) {
+            expectedValues.stream().forEach(line -> {
+                output.shouldContain(line);
+            });
+        }
+    }
+
+    /**
+     * Decodes the base64 encoded keystore and writes into new file
+     * @param name base64 encoded keystore name
+     */
+    private static void convertToPFX(String name) throws IOException{
+        File base64File = new File(SOURCE_DIRECTORY, name);
+        File pkcs12File = new File(WORKING_DIRECTORY, name);
+        byte[] input = Files.readAllBytes(base64File.toPath());
+        Files.write(pkcs12File.toPath(), Base64.getMimeDecoder().
+                decode(input), StandardOpenOption.CREATE);
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/KeytoolWriteP12Test.java

@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import jdk.test.lib.process.OutputAnalyzer;
+import static java.lang.System.out;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Tests for creating pkcs12 keystore with various algorithms
+ * @library ../
+ * @library /test/lib
+ * @run main KeytoolWriteP12Test
+ */
+public class KeytoolWriteP12Test {
+    private static final String ALIAS = "pkcs12testCA";
+    private static final Utils.KeyStoreType PKCS12 = Utils.KeyStoreType.pkcs12;
+    private static final int FAILED_EXIT_CODE = 1;
+    private static final String CERT_FILE_NAME = "cert.data";
+    private static final String DNAME = "CN=PKCS12 Test CA, OU=Security SQE, "
+            + "O=JavaSoft, C=US";
+    private static final String WORKING_DIRECTORY = System.
+            getProperty("test.classes", "." + File.separator);
+    private enum Algorithm {
+        DSA, RSA, ECC
+    };
+    private void run() {
+        out.println("Running DSA Test");
+        keytoolListTest("kt_DSA.p12", Algorithm.DSA);
+        out.println("DSA Test passed");
+
+        out.println("Running RSA Test");
+        final String rsaKeyStoreName = "kt_RSA_MD5.p12";
+        keytoolListTest(rsaKeyStoreName, Algorithm.RSA);
+        out.println("RSA Test passed");
+
+        out.println("Running RSA and Signing Algorithm SHA1withRSA Test");
+        keytoolListTest("kt_RSA_SHA1.p12", Algorithm.RSA,
+                "-sigalg", "SHA1withRSA");
+        out.println("RSA and Signing Algorithm SHA1withRSA Test Passed");
+
+        out.println("Running Keysize 256 Test");
+        keytoolListNegativeTest("kt_DSA_256.p12", Algorithm.DSA, "-keysize",
+                "256");
+        out.println("Keysize 256 Test Passed");
+
+        out.println("Running Keysize 1023 Test");
+        keytoolListTest("kt_RSA_MD5_1023.p12", Algorithm.RSA, "-keysize",
+                "1023");
+        out.println("Keysize 1023 Test Passed");
+        out.println("Running Export certificate Test");
+        exportTest(rsaKeyStoreName);
+        out.println("Export certificate Test Passed");
+    }
+
+    private void exportTest(String keyStore) {
+        final String keyStoreName = WORKING_DIRECTORY + File.separator
+                + keyStore;
+        deleteKeyStoreFile(keyStoreName);
+        Utils.createKeyStore(DNAME, PKCS12, keyStore, ALIAS,
+                Algorithm.RSA.name());
+        final String certFilePath = WORKING_DIRECTORY + File.separator
+                + CERT_FILE_NAME;
+        Utils.exportCert(PKCS12, keyStore,
+                ALIAS, certFilePath);
+        final String[] command = new String[]{"-debug", "-printcert", "-v",
+            "-file", certFilePath};
+        Utils.executeKeytoolCommand(command);
+    }
+
+    private void keytoolListTest(String keyStore, Algorithm algorithm,
+            String ...optionalArgs) {
+        final String keyStoreName = WORKING_DIRECTORY + File.separator
+                + keyStore;
+        final String[] command = new String[]{"-debug", "-list", "-v", "-alias",
+            ALIAS, "-keystore", keyStoreName, "-storetype", "pkcs12",
+            "-storepass", Utils.DEFAULT_PASSWD};
+        deleteKeyStoreFile(keyStoreName);
+        Utils.createKeyStore(DNAME, PKCS12, keyStoreName, ALIAS,
+                algorithm.name(), optionalArgs);
+        OutputAnalyzer output = Utils.executeKeytoolCommand(command);
+        output.shouldContain(DNAME);
+    }
+
+    private void keytoolListNegativeTest(String keyStore, Algorithm algorithm,
+            String... optionalArgs) {
+        final String keyStoreName = WORKING_DIRECTORY  + File.separator
+                + keyStore;
+        deleteKeyStoreFile(keyStoreName);
+        Utils.createKeyStore(DNAME, PKCS12, keyStoreName, ALIAS,
+                algorithm.name(), optionalArgs, FAILED_EXIT_CODE);
+    }
+
+    public static void main(String[] args) {
+        KeytoolWriteP12Test test = new KeytoolWriteP12Test();
+        test.run();
+        out.println("Test Passed");
+    }
+
+    private void deleteKeyStoreFile(String fileName) {
+        File file = new File(fileName);
+        if (file.exists()) {
+            file.delete();
+        }
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/MetadataEmptyTest.java

@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.security.Key;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
+import java.io.IOException;
+import java.security.cert.CertificateException;
+import static java.lang.System.out;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Entry's attribute set should be empty
+ * @library ../
+ * @library /test/lib
+ * @run main MetadataEmptyTest
+ */
+public class MetadataEmptyTest {
+    private static final char[] PASSWORD = "passwd".toCharArray();
+    private static final String ALIAS = "testkey";
+    private static final String KEYSTORE_PATH = System.getProperty(
+            "test.classes" + File.separator + "ks.pkcs12",
+            "." + File.separator + "ks.pkcs12");
+
+    private void runTest() throws IOException, KeyStoreException,
+            NoSuchAlgorithmException, CertificateException,
+            UnrecoverableKeyException {
+        KeyStore ks = Utils.loadKeyStore(KEYSTORE_PATH,
+                Utils.KeyStoreType.pkcs12, PASSWORD);
+        Key key = ks.getKey(ALIAS, PASSWORD);
+        Certificate cert = ks
+                .getCertificate(ALIAS);
+        KeyStore.Entry entry = new KeyStore.PrivateKeyEntry(
+                (PrivateKey) key,
+                new Certificate[]{cert});
+        if (!entry.getAttributes().isEmpty()) {
+            throw new RuntimeException("Entry's attributes set "
+                    + "must be empty");
+        }
+        out.println("Test Passed");
+    }
+
+    public static void main(String[] args) throws Exception{
+        MetadataEmptyTest test = new MetadataEmptyTest();
+        test.setUp();
+        test.runTest();
+    }
+
+    private void setUp() {
+        Utils.createKeyStore(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH, ALIAS);
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/MetadataStoreLoadTest.java

@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.Key;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PKCS12Attribute;
+import java.security.PrivateKey;
+import java.security.UnrecoverableEntryException;
+import java.security.cert.Certificate;
+import java.util.Arrays;
+import java.util.Set;
+import static java.lang.System.out;
+import java.util.HashSet;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Test store metadata attributes to PKCS12 keystore.
+ * @library ../
+ * @library /test/lib
+ * @run main MetadataStoreLoadTest
+ */
+public class MetadataStoreLoadTest {
+    private static final char[] PASSWORD = "passwd".toCharArray();
+    private static final char[] KEY_PASSWORD = "keypasswd".toCharArray();
+    private static final String ALIAS = "testkey_metadata";
+    private static final String KEYSTORE = "ks.pkcs12";
+    private static final String KESTORE_NEW = "ks-attr.pkcs12";
+    private static final int MAX_HUGE_SIZE = 2000000;
+    private static final String WORKING_DIRECTORY = System.getProperty(
+            "test.classes", "." + File.separator);
+    private static final String KEYSTORE_PATH = WORKING_DIRECTORY
+            + File.separator + KEYSTORE;
+    private static KeyStore.Entry.Attribute[] ATTR_SET;
+
+    private void runTest() throws GeneralSecurityException,
+            UnrecoverableEntryException, NoSuchAlgorithmException,
+            KeyStoreException, IOException {
+        storeAttrs();
+        checkAttrs();
+    }
+
+    private void storeAttrs() throws UnrecoverableEntryException,
+            GeneralSecurityException, NoSuchAlgorithmException,
+            KeyStoreException, IOException {
+        KeyStore ksIn = Utils.loadKeyStore(KEYSTORE_PATH,
+                Utils.KeyStoreType.pkcs12, PASSWORD);
+        KeyStore ksAttr = KeyStore
+                .getInstance(Utils.KeyStoreType.pkcs12.name());
+        ksAttr.load(null);
+        Key key = ksIn.getKey(ALIAS, PASSWORD);
+        Certificate cert = ksIn.getCertificate(ALIAS);
+        Set<KeyStore.Entry.Attribute> attrs =
+                new HashSet<>(Arrays.asList(ATTR_SET));
+        KeyStore.Entry e = new KeyStore.PrivateKeyEntry((PrivateKey) key,
+                new Certificate[]{cert}, attrs);
+        ksAttr.setEntry(ALIAS, e, new KeyStore.PasswordProtection(
+                KEY_PASSWORD));
+
+        out.println("Attributes before store:");
+        e.getAttributes().stream().forEach((attr) -> {
+            out.println(attr.getName() + ", '" + attr.getValue() + "'");
+        });
+        Utils.saveKeyStore(ksAttr, WORKING_DIRECTORY + File.separator
+                + KESTORE_NEW, PASSWORD);
+    }
+
+    private void checkAttrs() throws UnrecoverableEntryException,
+            GeneralSecurityException, NoSuchAlgorithmException,
+            KeyStoreException, IOException {
+        KeyStore ks = Utils.loadKeyStore(WORKING_DIRECTORY
+                + File.separator
+                + KESTORE_NEW, Utils.KeyStoreType.pkcs12, PASSWORD);
+        KeyStore.Entry keyStoreEntry = ks.getEntry(ALIAS,
+                new KeyStore.PasswordProtection(KEY_PASSWORD));
+        out.println("Attributes after store:");
+        //print attribute values
+        keyStoreEntry.getAttributes().stream().forEach((attr) -> {
+            out.println(attr.getName() + ", '" + attr.getValue() + "'");
+        });
+        Arrays.stream(ATTR_SET).forEach((attr) -> {
+            if (!keyStoreEntry.getAttributes().contains(attr)) {
+                throw new RuntimeException("Entry doesn't contain attribute: ("
+                        + attr.getName() + ", '" + attr.getValue() + "')");
+            }
+        });
+    }
+
+    public static void main(String[] args) throws Exception {
+        MetadataStoreLoadTest test = new MetadataStoreLoadTest();
+        test.setUp();
+        test.runTest();
+        out.println("Test Passed");
+    }
+
+    private void setUp() {
+        Utils.createKeyStore(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH, ALIAS);
+        final String allCharsString = "`1234567890-=qwertyuiop[]asdfghjkl;'\\zx"
+                + "cvbnm,./!@#$%^&*()_+QWERTYUIOP{}ASDFGHJKL:|>ZXCVBNM<>?\"";
+        StringBuilder sbPrintable = new StringBuilder();
+        while (sbPrintable.length() < MAX_HUGE_SIZE) {
+            sbPrintable.append(allCharsString);
+        }
+        final String hugePrintable = sbPrintable.toString();
+        final String binaryString = "00:11:22:33:44:55:66:77:88:99:AA:BB:DD:"
+                + "EE:FF:";
+        StringBuilder sbBinary = new StringBuilder();
+        sbBinary.append(binaryString);
+        while (sbBinary.length() < MAX_HUGE_SIZE) {
+            sbBinary.append(":").append(binaryString);
+        }
+        sbBinary.insert(0, "[").append("]");
+        final String hugeBinary = sbBinary.toString();
+        ATTR_SET = new PKCS12Attribute[5];
+        ATTR_SET[0] = new PKCS12Attribute("1.2.840.113549.1.9.1",
+                "Test email addres attr <test@oracle.com>");
+        ATTR_SET[1] = new PKCS12Attribute("1.2.110.1", "not registered attr");
+        ATTR_SET[2] = new PKCS12Attribute("1.2.110.2", hugePrintable);
+        ATTR_SET[3] = new PKCS12Attribute("1.2.110.3", hugeBinary);
+        ATTR_SET[4] = new PKCS12Attribute("1.2.110.2", " ");
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/README

@@ -0,0 +1,28 @@
+The test KeytoolReaderP12Test.java depends on keystore data files and validates 
+with output generated by keystore list/export commands
+
+KeyStore File                      storetype  aliasname  keyalg  SignatureAlgorithm
+------                             ------     ------     ------  ---
+api_private_key.p12.data           pkcs12     pkcs12testenduser1    RSA 1024	MD5withRSA
+api_private_key_not_match.p12.data pkcs12     pkcs12testca          RSA 2048	SHA1withRSA
+api_cert_chain.p12.data		   pkcs12     pkcs12testenduser1    RSA 1024	MD5withRSA
+api_two_pass.p12.data              pkcs12     pkcs12testca          RSA 2048	SHA1withRSA
+netscape_self.p12.data		   pkcs12     pkcs12testenduser1    RSA 1023 	MD5withRSA
+mozilla_self.p12.data		   pkcs12     pkcs12testenduser1    RSA 1023 	MD5withRSA
+ie_self.pfx.data		   pkcs12     a3aa3db3-3ec2-4d8b-8cf1-4d3c54afe386  RSA 1023 MD5withRSA
+ie_chain.pfx.data		   pkcs12     4e3053da-ff8e-46d2-b6d1-c38e431dea1f  RSA 1023 MD5withRSA
+
+Following keystore commands were used 	
+1. Generate keystore and along with keypair
+<JAVA-HOME>/bin/keytool -genkey -v -alias pkcs12test -keyalg "RSA" -keysize 2048 
+-sigalg "SHA1withRSA" -dname "cn=PKCS12 Test CA, ou=Security SQE, o=JavaSoft, 
+c=US" -validity 7300 -keypass storepass -keystore ks-pkcs.data -storepass 
+storepass -storetype pkcs12
+
+2. Export certificate 
+<JAVA-HOME>/bin/keytool -export -alias pkcs12test -keystore ks-pkcs.data 
+-storetype pkcs12 -storepass storepass -file pkcs12testCA.cer.data
+
+3. Import certificate
+<JAVA-HOME>/bin/keytool -import -alias pkcs12test -keystore ks-pkcs.data 
+-storepass storepass -file pkcs12testCA.cer.data

test/jdk/java/security/KeyStore/PKCS12/ReadP12Test.java

@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2003, 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import static java.lang.System.out;
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.Key;
+import java.security.KeyStore;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.util.Base64;
+import java.util.Enumeration;
+
+/*
+ * @test
+ * @bug 8048617
+ * @author  Bill Situ
+ * @summary Read different types p12 key store to Check the read related APIs.
+ *  including following test cases:
+ * ReadP12_IE_Chain: Read p12 key store (contains private key and associated
+ *  certificate chain) from IE.
+ * ReadP12_IE_Self: Read p12 key store (contains only private key and
+ *  self-signed certificate) from IE.
+ * ReadP12_JDK_Chain: Read p12 key store (contains private key and associated
+ *  certificate chain) from JDK
+ * ReadP12_JDK_Self: Read p12 key store (contains only private key and
+ *  self-signed certificate) from JDK.
+ * ReadP12_Mozilla_Self: Read p12 key store (contains only private key and
+ *  self-signed certificate) from Mozilla.
+ * ReadP12_Mozilla_Chain: Read p12 key store (contains private key and
+ *  associated certificate chain) from Mozilla.
+ * ReadP12_Mozilla_TwoEntries: Read p12 key store (contains 2 entries) from
+ *  Mozilla.
+ * ReadP12_Netscape_Chain: Read p12 key store (contains private key and
+ *  associated certificate chain) from Netscape.
+ * ReadP12_Netscape_Self: Read p12 key store (contains only private key and
+ *  self-signed certificate) from Netscape.
+ * ReadP12_Netscape_TwoEntries: Read p12 key store (contains 2 entries) from
+ *  Netscape.
+ * ReadP12_OpenSSL: Read p12 key store from OpenSSL.
+ */
+
+public class ReadP12Test {
+
+    private final static String IN_KEYSTORE_TYPE = "pkcs12";
+    private final static String IN_STORE_PASS = "pass";
+
+    public static void main(String args[]) throws Exception {
+
+        ReadP12Test jstest = new ReadP12Test();
+        String testCase = "";
+        try {
+            testCase = "ReadP12_IE_Chain";
+            jstest.readTest("ie_chain.pfx.data");
+
+            testCase = "ReadP12_IE_Self";
+            jstest.readTest("ie_self.pfx.data");
+
+            testCase = "ReadP12_JDK_Chain";
+            jstest.readTest("jdk_chain.p12.data");
+
+            testCase = "ReadP12_JDK_Self";
+            jstest.readTest("jdk_self.p12.data");
+
+            testCase = "ReadP12_Mozilla_Chain";
+            jstest.readTest("mozilla_chain.p12.data");
+
+            testCase = "ReadP12_Mozilla_Self";
+            jstest.readTest("mozilla_self.p12.data");
+
+            testCase = "ReadP12_Mozilla_TwoEntries";
+            jstest.readTest("mozilla_twoentries.p12.data");
+
+            testCase = "ReadP12_Netscape_Chain";
+            jstest.readTest("netscape_chain.p12.data");
+
+            testCase = "ReadP12_Netscape_Self";
+            jstest.readTest("netscape_self.p12.data");
+
+            testCase = "ReadP12_Netscape_TwoEntries";
+            jstest.readTest("netscape_twoentries.p12.data");
+
+            testCase = "ReadP12_openssl";
+            jstest.readTest("openssl.p12.data");
+
+        } catch (Exception e) {
+            System.err.println(testCase + ": failed with execption: "
+                    + e.getMessage());
+            throw e;
+
+        }
+        out.println(testCase + ": Pass!!");
+    }
+
+    private void readTest(String inKeyStore) throws Exception {
+
+        KeyStore inputKeyStore;
+
+        // Initialize KeyStore
+        String dir = System.getProperty("test.src", ".");
+        String keystorePath = dir + File.separator + "certs" + File.separator
+                + "readP12";
+        inputKeyStore = KeyStore.getInstance(IN_KEYSTORE_TYPE);
+        // KeyStore have encoded by Base64.getMimeEncoder().encode(),need decode
+        // first.
+        byte[] input = Files.readAllBytes(Paths.get(keystorePath, inKeyStore));
+        ByteArrayInputStream arrayIn = new ByteArrayInputStream(Base64
+                .getMimeDecoder().decode(input));
+        inputKeyStore.load(arrayIn, IN_STORE_PASS.toCharArray());
+        out.println("Initialize KeyStore : " + inKeyStore + " success");
+
+        out.println("getProvider : " + inputKeyStore.getProvider());
+        out.println("getType : " + inputKeyStore.getType());
+        out.println("getDefaultType : " + KeyStore.getDefaultType());
+
+        int idx = 0;
+        Enumeration<String> e = inputKeyStore.aliases();
+        String alias;
+        while (e.hasMoreElements()) {
+            alias = e.nextElement();
+            out.println("Alias " + idx + " : " + alias);
+            if (inputKeyStore.containsAlias(alias) == false) {
+                throw new RuntimeException("Alias not found");
+            }
+
+            out.println("getCreationDate : "
+                    + inputKeyStore.getCreationDate(alias));
+
+            X509Certificate cert = (X509Certificate) inputKeyStore
+                    .getCertificate(alias);
+            out.println("getCertificate : " + cert.getSubjectDN());
+            String retAlias = inputKeyStore.getCertificateAlias(cert);
+            if (!retAlias.equals(alias)) {
+                throw new RuntimeException("Alias mismatch");
+            }
+            out.println("getCertificateAlias : " + retAlias);
+
+            Certificate[] certs = inputKeyStore.getCertificateChain(alias);
+            for (int i = 0; i < certs.length; i++) {
+                out.println("getCertificateChain " + i + " : "
+                        + ((X509Certificate) certs[i]).getSubjectDN());
+            }
+
+            boolean isCertEntry = inputKeyStore.isCertificateEntry(alias);
+            // test KeyStore only contain key pair entries.
+            if (isCertEntry == true) {
+                throw new RuntimeException(
+                        "inputKeystore should not be certEntry because test keystore only contain key pair entries.");
+            }
+
+            boolean isKeyEntry = inputKeyStore.isKeyEntry(alias);
+            if (isKeyEntry) {
+                Key key = inputKeyStore.getKey(alias,
+                        IN_STORE_PASS.toCharArray());
+                out.println("Key : " + key.toString());
+            } else {
+                throw new RuntimeException("Entry type unknown\n");
+            }
+            idx++;
+        }
+
+        int size = inputKeyStore.size();
+        if (idx != size) {
+            throw new RuntimeException("Size not match");
+        }
+
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/StoreTrustedCertAPITest.java

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import static java.lang.System.err;
+import static java.lang.System.out;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Test imports certificate from file to PKCS12 keystore store it as
+ * trusted certificate Check import errors (must be not errors) & check keystore
+ * content after import
+ * @library ../
+ * @library /test/lib
+ * @run main StoreTrustedCertAPITest
+ */
+public class StoreTrustedCertAPITest {
+    private static final char[] PASSWORD = "passwd".toCharArray();
+    private static final String ALIAS = "testkey_stcapi";
+    private static final String WORKING_DIRECTORY = System.getProperty(
+            "test.classes", "." + File.separator);
+    private static final String CERT_PATH = WORKING_DIRECTORY + File.separator
+            + "cert.data";
+    private static final String KEYSTORE_PATH = WORKING_DIRECTORY
+            + File.separator + "ks.pkcs12";
+
+    /**
+     * Test logic (environment has set up)
+     */
+    private void runTest() throws FileNotFoundException, CertificateException,
+            KeyStoreException, IOException, NoSuchAlgorithmException {
+        Certificate cert;
+        CertificateFactory cf;
+        try (FileInputStream fi = new FileInputStream(CERT_PATH)) {
+            cf = CertificateFactory.getInstance("X.509");
+            cert = cf.generateCertificate(fi);
+            KeyStore ks = KeyStore.getInstance(
+                    Utils.KeyStoreType.pkcs12.name());
+            ks.load(null, null);
+            ks.setCertificateEntry(ALIAS, cert);
+            Utils.saveKeyStore(ks, KEYSTORE_PATH, PASSWORD);
+            ks = Utils.loadKeyStore(KEYSTORE_PATH, Utils.KeyStoreType.pkcs12,
+                    PASSWORD);
+            final Certificate ksCert = ks.getCertificate(ALIAS);
+            if (!ksCert.equals(cert)) {
+                err.println("Orig cert: " + cert.toString());
+                err.println("Cert from keystore: " + ksCert.toString());
+                throw new RuntimeException("Certificates don't match");
+            }
+        }
+    }
+
+    public static void main(String[] args) throws Exception {
+        StoreTrustedCertAPITest test = new StoreTrustedCertAPITest();
+        test.setUp();
+        test.runTest();
+        out.println("Test Passed");
+    }
+
+    private void setUp() {
+        Utils.createKeyStore(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH, ALIAS);
+        Utils.exportCert(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH,
+                ALIAS, CERT_PATH);
+        new File(KEYSTORE_PATH).delete();
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/StoreTrustedCertKeytool.java

@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import jdk.test.lib.process.OutputAnalyzer;
+import static java.lang.System.out;
+
+/**
+ * @test
+ * @bug 8048830
+ * @summary Tests keytool command imports certificate , list keystore, print
+ * certificate and import password help.
+ * @library ../
+ * @library /test/lib
+ * @run main StoreTrustedCertKeytool
+ */
+public class StoreTrustedCertKeytool {
+    private static final String PASSWORD = "passwd";
+    private static final String ALIAS = "testkey_stckey";
+    private static final String FILE_SEPARATOR = File.separator;
+    private static final String WORKING_DIRECTORY = System.getProperty(
+            "test.classes", "." + FILE_SEPARATOR);
+    private static final String CERT_PATH = WORKING_DIRECTORY
+            + FILE_SEPARATOR
+            + "cert.data";
+    private static final String KEYSTORE_PATH = WORKING_DIRECTORY
+            + FILE_SEPARATOR + "ks.pkcs12";
+
+    protected void run() throws IOException, KeyStoreException,
+            NoSuchAlgorithmException, CertificateException {
+        setUp();
+        importCert();
+        out.println("Import Cert test passed");
+        listCerts();
+        out.println("listCerts test passed");
+        printCert();
+        out.println("print cert test passed");
+        helpImportPassword();
+        out.println("help import test passed");
+    }
+
+    private void importCert() {
+        final String[] command = new String[]{"-debug", "-importcert",
+            "-alias", ALIAS, "-file", CERT_PATH, "-noprompt", "-keystore",
+            KEYSTORE_PATH, "-storetype", "pkcs12", "-storepass", PASSWORD};
+        // If the keystore exists delete it.
+        File keystoreFile = new File(KEYSTORE_PATH);
+        if (keystoreFile.exists()) {
+            keystoreFile.delete();
+        }
+        Utils.executeKeytoolCommand(command);
+    }
+
+    private void listCerts() throws IOException, KeyStoreException,
+            NoSuchAlgorithmException, CertificateException {
+        final String[] command = new String[]{"-debug", "-list", "-v",
+            "-alias", ALIAS, "-keystore", KEYSTORE_PATH, "-storetype", "pkcs12",
+            "-storepass", PASSWORD};
+        OutputAnalyzer output = Utils.executeKeytoolCommand(command);
+        if (output == null) {
+            throw new RuntimeException("Keystore print fails");
+        }
+        X509Certificate ksCert = null;
+        final KeyStore ks = Utils.loadKeyStore(KEYSTORE_PATH,
+                Utils.KeyStoreType.pkcs12, PASSWORD.toCharArray());
+        ksCert = (X509Certificate) ks.getCertificate(ALIAS);
+
+        if (ksCert == null) {
+            throw new RuntimeException("Certificate " + ALIAS
+                    + " not found in Keystore " + KEYSTORE_PATH);
+        }
+        String serialNumber = ksCert.getSerialNumber().toString(16);
+        output.shouldContain(serialNumber);
+    }
+
+    private void printCert() {
+        final String[] command = new String[]{"-debug", "-printcert",
+            "-file", CERT_PATH};
+        Utils.executeKeytoolCommand(command);
+
+    }
+
+    private void helpImportPassword() {
+        final String[] command = new String[]{"-debug", "-help",
+            "-importpassword"};
+        Utils.executeKeytoolCommand(command);
+    }
+
+    public static void main(String[] args) throws Exception {
+        final StoreTrustedCertKeytool test = new StoreTrustedCertKeytool();
+        test.run();
+        out.println("Test Passed");
+    }
+
+    private void setUp() {
+        Utils.createKeyStore(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH, ALIAS);
+        Utils.exportCert(Utils.KeyStoreType.pkcs12, KEYSTORE_PATH, ALIAS,
+                CERT_PATH);
+        new File(KEYSTORE_PATH).delete();
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/UnmodifiableAttributes.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8278744
+ * @summary KeyStore:getAttributes() not returning unmodifiable Set
+ * @library /test/lib
+ */
+
+import jdk.test.lib.SecurityTools;
+import jdk.test.lib.Utils;
+
+import java.io.File;
+import java.security.KeyStore;
+
+public class UnmodifiableAttributes {
+    public static final void main(String[] args) throws Exception {
+
+        var oneAttr = new KeyStore.Entry.Attribute() {
+            @Override
+            public String getName() {
+                return "1.2.3";
+            }
+
+            @Override
+            public String getValue() {
+                return "testVal";
+            }
+        };
+        char[] pass = "changeit".toCharArray();
+
+        SecurityTools.keytool("-keystore ks -storepass changeit -genkeypair -alias a -dname CN=A -keyalg EC")
+                .shouldHaveExitValue(0);
+
+        KeyStore ks = KeyStore.getInstance(new File("ks"), pass);
+
+        var attrs = ks.getAttributes("a");
+        Utils.runAndCheckException(() -> attrs.add(oneAttr), UnsupportedOperationException.class);
+
+        var attrs2 = ks.getEntry("a", new KeyStore.PasswordProtection(pass)).getAttributes();
+        Utils.runAndCheckException(() -> attrs2.add(oneAttr), UnsupportedOperationException.class);
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/Utils.java

@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2012, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.util.Arrays;
+import java.util.List;
+import jdk.test.lib.process.ProcessTools;
+import jdk.test.lib.process.OutputAnalyzer;
+import jdk.test.lib.JDKToolFinder;
+import static java.lang.System.out;
+import java.util.ArrayList;
+
+/**
+ * Helper class for creating keystore and executing keytool commands
+ */
+public class Utils {
+    public enum KeyStoreType {
+        jks, pkcs12;
+    }
+    public static final String DEFAULT_DNAME
+            = "CN=TestKey, T=FuncTestCertKey, O=Oracle, OU=JDKSQE, C=US";
+    public static final String DEFAULT_PASSWD = "passwd";
+    public static final String RSA = "rsa";
+    public static final String JAVA_HOME = System.getProperty("java.home");
+    public static final String KEYTOOL = "keytool";
+    private static final int SUCCESS_EXIT_CODE = 0;
+
+    public static OutputAnalyzer executeKeytoolCommand(String[] command) {
+        return executeKeytoolCommand(command, SUCCESS_EXIT_CODE);
+    }
+
+    public static OutputAnalyzer executeKeytoolCommand(String[] command,
+            int exitCode) {
+        String[] keytoolCmd = new String[command.length + 3];
+        OutputAnalyzer output = null;
+        try {
+            keytoolCmd[0] = JDKToolFinder.getJDKTool(KEYTOOL);
+            // Ensure the keytool process is always ran under English locale
+            keytoolCmd[1] = "-J-Duser.language=en";
+            keytoolCmd[2] = "-J-Duser.country=US";
+            System.arraycopy(command, 0, keytoolCmd, 3, command.length);
+            output = ProcessTools.executeCommand(keytoolCmd);
+            output.shouldHaveExitValue(exitCode);
+            out.println("Executed keytool command sucessfully:"
+                    + Arrays.toString(keytoolCmd));
+        } catch (Throwable e) {
+            e.printStackTrace(System.err);
+            throw new RuntimeException("Keytool Command execution failed : "
+                    + Arrays.toString(keytoolCmd), e);
+        }
+        return output;
+    }
+
+    public static void createKeyStore(KeyStoreType type, String name,
+            String alias) {
+        createKeyStore(DEFAULT_DNAME, type, name, alias, RSA);
+    }
+
+    public static void createKeyStore(String dName, KeyStoreType type,
+            String name, String alias, String algorithm,
+            String... optionalArgs) {
+        createKeyStore(dName, type, name, alias, algorithm, optionalArgs,
+                SUCCESS_EXIT_CODE);
+    }
+
+    public static void createKeyStore(String dName, KeyStoreType type,
+            String name, String alias, String algorithm,
+            String[] optionalArgs, int exitCode) {
+        String[] command = new String[]{"-debug", "-genkeypair", "-alias",
+            alias, "-keystore", name, "-dname", dName, "-storepass",
+            DEFAULT_PASSWD, "-keypass", DEFAULT_PASSWD, "-validity", "7300",
+            "-keyalg", algorithm, "-storetype", type.name()};
+        if (optionalArgs != null && optionalArgs.length > 0) {
+            List<String> commandArgs = new ArrayList<>(Arrays.asList(command));
+            List<String> temp = Arrays.asList(optionalArgs);
+            commandArgs.addAll(temp);
+            if (!commandArgs.contains(("-keysize"))) {
+                commandArgs.add("-keysize");
+                commandArgs.add("1024");
+            }
+            command = commandArgs.toArray(new String[commandArgs.size()]);
+        }
+        executeKeytoolCommand(command, exitCode);
+    }
+
+    public static void exportCert(KeyStoreType type, String name,
+            String alias, String cert) {
+        String[] command = {"-debug", "-exportcert", "-keystore", name,
+            "-storetype", type.name(), "-storepass", DEFAULT_PASSWD, "-alias",
+            alias,"-file",cert,"-noprompt"};
+        executeKeytoolCommand(command);
+    }
+
+    public static KeyStore loadKeyStore(String file, KeyStoreType type,
+            char[] passwd)
+            throws IOException, KeyStoreException,
+            NoSuchAlgorithmException, CertificateException {
+        KeyStore ks = KeyStore.getInstance(type.name());
+        try (FileInputStream fin = new FileInputStream(file)) {
+            ks.load(fin, passwd);
+        }
+        return ks;
+    }
+
+    public static void saveKeyStore(KeyStore ks, String file, char[] passwd)
+            throws IOException, KeyStoreException, NoSuchAlgorithmException,
+            CertificateException {
+        try (FileOutputStream fout = new FileOutputStream(file)) {
+            ks.store(fout, passwd);
+        }
+    }
+}

test/jdk/java/security/KeyStore/PKCS12/WriteP12Test.java

@@ -0,0 +1,364 @@
+/*
+ * Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import static java.lang.System.out;
+
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.*;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Enumeration;
+
+/*
+ * @test
+ * @bug 8048618
+ * @summary Write different types p12 key store to Check the write related
+ *  APIs.
+ * @run main WriteP12Test
+ * @enablePreview
+ */
+
+public class WriteP12Test {
+
+    private static final String IN_KEYSTORE_TYPE = "jks";
+    private static final String IN_KEYSTORE_PRV = "SUN";
+
+    private static final String IN_KEYSTORE_ENDUSER = "keystoreEU.jks.data";
+    private static final String IN_KEYSTORE_CA = "keystoreCA.jks.data";
+    private static final String OUT_KEYSTORE = "outKeyStore.p12";
+
+    private static final String IN_STORE_PASS = "storepass";
+    private static final String IN_KEY_PASS = "keypass";
+
+    private static final String CERT_PATH = System.getProperty("test.src", ".")
+            + File.separator + "certs" + File.separator + "writeP12"
+            + File.separator;
+
+    private static final String CA_CERT_STR = "-----BEGIN CERTIFICATE-----\n"
+            + "MIIDFzCCAf8CBD8+0nAwDQYJKoZIhvcNAQEFBQAwUDELMAkGA1UEBhMCV\n"
+            + "VMxETAPBgNVBAoTCEphdmFTb2Z0MRUwEwYDVQQLEwxTZWN1cml0eSBTUU\n"
+            + "UxFzAVBgNVBAMTDlBLQ1MxMiBUZXN0IENBMB4XDTAzMDgxNzAwNTUxMlo\n"
+            + "XDTEzMDgxNDAwNTUxMlowUDELMAkGA1UEBhMCVVMxETAPBgNVBAoTCEph\n"
+            + "dmFTb2Z0MRUwEwYDVQQLEwxTZWN1cml0eSBTUUUxFzAVBgNVBAMTDlBLQ\n"
+            + "1MxMiBUZXN0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQ\n"
+            + "EAk7Sh+K/yGsmJacZnjfkZfuWxGNJCPW0q69exwoRP+eBHMQwG00yi9aL\n"
+            + "SsZAqNpJSCDvpgySOAUmBd+f8WFhHqJfRVREVfv3mradDKZCjhqtsUI7I\n"
+            + "wRTYYy9clFkeeK4dHaxbuFMPpUu7yQfwSTXgvOA/UJ4kJuGtaYAdTJI4e\n"
+            + "f1mUASo6+dea0UZA/FHCuV7O6z3hr5VHlyhJL2/o/8M5tGBTBISODJSnn\n"
+            + "GNBvtQLNHnWYvs470UAE2BtuCGYh1V/3HAH1tRirS3MBBcb1XnIkiiXR3\n"
+            + "tjaBSB+XhoCfuG8KtInXXFaAnvKfY9mYFw6VJt9JYQpY2VDC7281/Pbz0\n"
+            + "dQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBzXZ8zHWrnC8/E+N/n2Czhx\n"
+            + "i18YQc2LPWBDLYTTxoFEazWmYLv1k/JT7Nta1qu1quvxXJ4uV1XHbd9NF\n"
+            + "AJWKwtFQEpfv4o6I7qWUPoxnfA+jyqKXxv27z25tzt+Y4xOEhqvO03G0Q\n"
+            + "imhkiNt9MF7L69y2U0/U73+uFNGzdAEDiI9EibvICiOnr1TeQ5GekK3Yb\n"
+            + "k5qe3lviMZPkkSXepTJI8m0AiXCji+eXj97jVLeH+RxeBchBY+uELrqUr\n"
+            + "sVOVWh7IBCqC/V7FqUTkmD1IFlzkkinatpl42s1MbhJId2yQkzaeBRc\n"
+            + "suE63bDEtuRWp9ynMO3QA4Yu85uBRWGzQ1Di\n"
+            + "-----END CERTIFICATE-----";
+    private static final String LEAD_CERT = "-----BEGIN CERTIFICATE-----\n"
+            + "MIICwDCCAaigAwIBAgIEPz7S1jANBgkqhkiG9w0BAQQFADBQMQswCQYDV\n"
+            + "QQGEwJVUzERMA8GA1UEChMISmF2YVNvZnQxFTATBgNVBAsTDFNlY3VyaX\n"
+            + "R5IFNRRTEXMBUGA1UEAxMOUEtDUzEyIFRlc3QgQ0EwHhcNMDAwODA5MDc\n"
+            + "wMDAwWhcNMTAwODA3MDcwMDAwWjBSMQswCQYDVQQGEwJVUzERMA8GA1UE\n"
+            + "ChMISmF2YVNvZnQxFTATBgNVBAsTDFNlY3VyaXR5IFNRRTEZMBcGA1UEA\n"
+            + "xMQUEtDUzEyIFRlc3QgTGVhZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgY\n"
+            + "kCgYEAzq9X2USz/WjDhT+jUyZWqB5h4A33tS11YqH5qYvqjTXjcUI6gOp\n"
+            + "moXMafDG9RHRlIccvp51xLp7Ap3WMrv411lWBttqtZi5c1/DEC1cEM/Sl\n"
+            + "PCk1r2zFbkJu7QKieXeMcrjZEo6LcBHMwQjIpI+up9cr3VjuyqG/olQkU\n"
+            + "mXVuS0CAwEAAaMkMCIwDwYDVR0PAQH/BAUDAweAADAPBgNVHRMBAf8EBT\n"
+            + "ADAQH/MA0GCSqGSIb3DQEBBAUAA4IBAQBhbuim98TWmtv9vSldRE7RvQ8\n"
+            + "FlS0TyZVO7kcSNtfCUE4R76J1ElN74Koc5pQnUtduLeQJs2ao/mEcCZsE\n"
+            + "zVcwI3mSZrSzPhc8s7w5gOQA4TUwVLSSjKgBCaZ7R3+qJ3QeqPJ5O6sFz\n"
+            + "pvBYkgSa4MWptK41jbmT8cwZQJXFCi8WxFFJ+p97F1Ppm3LgmYmtiUP4M\n"
+            + "ZQwOBvpTZWXU0WrqFXpzWQx0mg4SX19fZm4nLcJAerCEUphf8ILagtpQM\n"
+            + "EErT3/jg6mfCdT3Rj055QXPfF4OiRFevPF5a1fZgrCePCukRQZcd7s8K5\n"
+            + "OBIaryuM0MdFtlzxi6XWeUNpVFFHURcy\n"
+            + "-----END CERTIFICATE-----";
+    private static final String END_CERT = "-----BEGIN CERTIFICATE-----\n"
+            + "MIICNjCCAZ+gAwIBAgIEPz7WtzANBgkqhkiG9w0BAQQFADBSMQswCQYDV\n"
+            + "QQGEwJVUzERMA8GA1UEChMISmF2YVNvZnQxFTATBgNVBAsTDFNlY3VyaX\n"
+            + "R5IFNRRTEZMBcGA1UEAxMQUEtDUzEyIFRlc3QgTGVhZDAeFw0wMDA4MDk\n"
+            + "wNzAwMDBaFw0xMDA4MDcwNzAwMDBaMFgxCzAJBgNVBAYTAlVTMREwDwYD\n"
+            + "VQQKEwhKYXZhU29mdDEVMBMGA1UECxMMU2VjdXJpdHkgU1FFMR8wHQYDV\n"
+            + "QQDExZQS0NTMTIgVGVzdCBFbmQgVXNlciAxMIGfMA0GCSqGSIb3DQEBAQ\n"
+            + "UAA4GNADCBiQKBgQDIKomSYomDzH/V63eDQEG7od0DLcnnVZ81pbWhDss\n"
+            + "8gHV2m8pADdRqdihBmnSQEaMW4D3uZ4sFE1LtkQls6hjd7SdOsG5Y24L8\n"
+            + "15jot9a2JcB73H8H0VKirrObL5BZdt7BtASPDnYtW4Spt++YjDoJFxyF0\n"
+            + "HchkavzXaVTlexakwIDAQABoxMwETAPBgNVHQ8BAf8EBQMDB4AAMA0GCS\n"
+            + "qGSIb3DQEBBAUAA4GBAIFA3JXEmb9AXn3RD7t+Mn6DoyVDIy5jsn6xOKT\n"
+            + "JV25I0obpDUzgw4QaAMmM0ZvusOmZ2wZNS8MtyTUgdANyakbzn5SdxbTy\n"
+            + "TLEqQsFbX8UVC38fx5ZM6ExA5YSAvgmXudZpOVC0ATccoZS3JFU8CxSfW\n"
+            + "+Q3IC2MLh+QTg3hUJ5b\n-----END CERTIFICATE-----";
+
+    private final Certificate testerCert;
+    private final Certificate testLeadCert;
+    private final Certificate caCert;
+
+    WriteP12Test() {
+        PEMDecoder pemDecoder = PEMDecoder.of();
+        caCert = pemDecoder.decode(CA_CERT_STR, X509Certificate.class);
+        testLeadCert = pemDecoder.decode(LEAD_CERT, X509Certificate.class);
+        testerCert = pemDecoder.decode(END_CERT, X509Certificate.class);
+    }
+
+    public static void main(String[] args) throws UnrecoverableKeyException,
+            KeyStoreException, NoSuchProviderException,
+            NoSuchAlgorithmException, IOException, CertificateException {
+        WriteP12Test jstest = new WriteP12Test();
+        out.println("test WriteP12CertChain");
+        /*
+         * WriteP12CertChain: This test creates a p12 keystore contains one
+         * entry with private key and a certificate chains contains three
+         * certificates in the order of user->lead->ca. This case expects to
+         * pass.
+         */
+        jstest.test(new Certificate[] { jstest.testerCert, jstest.testLeadCert,
+                jstest.caCert }, IN_KEYSTORE_ENDUSER, "pkcs12testenduser1",
+                "pass", "pass");
+
+        /*
+         * WriteP12CertChainBad: same as WriteP12CertChain but chains order is
+         * user-ca-lead, the order is wrong so expects to fail.
+         */
+        out.println("test WriteP12CertChainBad");
+        try {
+            jstest.test(new Certificate[] { jstest.testerCert, jstest.caCert,
+                    jstest.testLeadCert }, IN_KEYSTORE_ENDUSER,
+                    "pkcs12testenduser1", "pass", "pass");
+            throw new RuntimeException(
+                    " Certificate chain is not valid, test should not pass."
+                            + " Test failed.");
+        } catch (KeyStoreException e) {
+            e.printStackTrace();
+            out.println(" Certificate chain is not valid,exception is"
+                    + " expected. Test passed.");
+        }
+        /*
+         * WriteP12PrivateKey:This test creates a p12 contains a self-signed
+         * cert and private key,expects no exception
+         */
+        out.println("test WriteP12PrivateKey");
+        jstest.test(null, IN_KEYSTORE_ENDUSER, "pkcs12testenduser1", "pass",
+                "pass");
+
+        /*
+         * WriteP12TwoEntry: This test creates a p12 keystore with different
+         * storepass and keypass, and contains two entries.
+         */
+        out.println("test WriteP12TwoEntry");
+        jstest.testTwoEntry(IN_KEYSTORE_ENDUSER, IN_KEYSTORE_CA,
+                "pkcs12testenduser1", "pass", "pass");
+        /*
+         * WriteP12TwoPass: This test creates a p12 keystore with different
+         * storepass and keypass, and contains one entry with private key and a
+         * certificate
+         */
+        out.println("test WriteP12TwoPass");
+        jstest.test(null, IN_KEYSTORE_CA, "pkcs12testCA", "storepass",
+                "keypass");
+    }
+
+    private void test(Certificate certs[], String inKeyStorePath,
+            String userAlias, String outStorePass, String outKeyPass)
+            throws KeyStoreException, NoSuchProviderException, IOException,
+            CertificateException, UnrecoverableKeyException,
+            NoSuchAlgorithmException {
+        // init output key store
+        KeyStore outputKeyStore = KeyStore.getInstance("pkcs12", "SunJSSE");
+        outputKeyStore.load(null, null);
+        try (FileOutputStream fout = new FileOutputStream(OUT_KEYSTORE)) {
+            // KeyStore have encoded by Base64.getMimeEncoder().encode(),need
+            // decode first.
+            byte[] input = Files.readAllBytes(Paths.get(CERT_PATH,
+                    inKeyStorePath));
+            ByteArrayInputStream arrayIn = new ByteArrayInputStream(Base64
+                    .getMimeDecoder().decode(input));
+            // input key store
+            KeyStore inputKeyStore = KeyStore.getInstance(IN_KEYSTORE_TYPE,
+                    IN_KEYSTORE_PRV);
+            inputKeyStore.load(arrayIn, IN_STORE_PASS.toCharArray());
+            // add key/certificate to output key store
+            Key key = inputKeyStore
+                    .getKey(userAlias, IN_KEY_PASS.toCharArray());
+            out.println("Input Key Algorithm " + key.getAlgorithm());
+            out.println("====Input Certs=====");
+            if (certs == null) {
+                certs = new Certificate[] { inputKeyStore
+                        .getCertificate(userAlias) };
+            }
+            for (Certificate cert : certs) {
+                out.println(((X509Certificate) cert).getSubjectDN());
+            }
+            outputKeyStore.setKeyEntry(userAlias, key,
+                    outKeyPass.toCharArray(), certs);
+            Certificate retCerts[] = outputKeyStore
+                    .getCertificateChain(userAlias);
+            out.println("====Output Certs=====");
+            for (Certificate retCert : retCerts) {
+                out.println(((X509Certificate) retCert).getSubjectDN());
+            }
+            out.println("====Output Key Algorithm=====");
+            Key outKey = outputKeyStore.getKey(userAlias,
+                    outKeyPass.toCharArray());
+            out.println(outKey.getAlgorithm());
+
+            if (!key.equals(outKey)) {
+                throw new RuntimeException("key don't match");
+            }
+            if (!Arrays.equals(certs, retCerts)) {
+                throw new RuntimeException("certs don't match");
+            }
+            // save output
+            outputKeyStore.store(fout, outStorePass.toCharArray());
+            // test output
+            testKeyStore(outputKeyStore, outKeyPass.toCharArray());
+        }
+    }
+
+    private void testTwoEntry(String inKeyStoreOnePath,
+            String inKeyStoreTwoPath, String userAlias, String outStorePass,
+            String outKeyPass) throws KeyStoreException,
+            NoSuchProviderException, NoSuchAlgorithmException,
+            CertificateException, IOException, UnrecoverableKeyException {
+        // initial KeyStore
+        KeyStore outputKeyStore = KeyStore.getInstance("pkcs12", "SunJSSE");
+        try (FileOutputStream fout = new FileOutputStream(OUT_KEYSTORE);) {
+            outputKeyStore.load(null, null);
+            KeyStore inputKeyStoreOne, inputKeyStoreTwo;
+            inputKeyStoreOne = KeyStore.getInstance(IN_KEYSTORE_TYPE,
+                    IN_KEYSTORE_PRV);
+            // KeyStore have encoded by Base64.getMimeEncoder().encode(),need
+            // decode first.
+            byte[] inputBytes = Files.readAllBytes(Paths.get(CERT_PATH,
+                    inKeyStoreOnePath));
+            ByteArrayInputStream arrayIn = new ByteArrayInputStream(Base64
+                    .getMimeDecoder().decode(inputBytes));
+            // input key store
+            inputKeyStoreOne.load(arrayIn, IN_STORE_PASS.toCharArray());
+
+            inputBytes = Files.readAllBytes(Paths.get(CERT_PATH,
+                    inKeyStoreTwoPath));
+            arrayIn = new ByteArrayInputStream(Base64.getMimeDecoder().decode(
+                    inputBytes));
+            inputKeyStoreTwo = KeyStore.getInstance(IN_KEYSTORE_TYPE,
+                    IN_KEYSTORE_PRV);
+            inputKeyStoreTwo.load(arrayIn, IN_STORE_PASS.toCharArray());
+
+            // add key/certificate to output key store
+            out.println("====First Entry=====");
+            Key inputKey = inputKeyStoreOne.getKey(userAlias,
+                    IN_KEY_PASS.toCharArray());
+            Certificate cert = inputKeyStoreOne.getCertificate(userAlias);
+            Certificate certs[] = new Certificate[1];
+            certs[0] = cert;
+
+            out.println("====Input1 Key=====");
+            out.println(inputKey.getAlgorithm());
+            out.println("====Input1 Certs=====");
+            out.println("Certificate :");
+            out.println(((X509Certificate) cert).getSubjectDN());
+            outputKeyStore.setKeyEntry("USER", inputKey,
+                    outKeyPass.toCharArray(), certs);
+            out.println("====Second Entry=====");
+            String caAlias = "pkcs12testca";
+            inputKey = inputKeyStoreTwo.getKey(caAlias,
+                    IN_KEY_PASS.toCharArray());
+            cert = inputKeyStoreTwo.getCertificate(caAlias);
+            certs[0] = cert;
+            out.println("====Input2 Key=====");
+            out.println(inputKey.getAlgorithm());
+            out.println("====Input2 Certs=====");
+            out.println("Certificate :");
+            out.println(((X509Certificate) cert).getSubjectDN());
+            outputKeyStore.setKeyEntry("CA", inputKey,
+                    outKeyPass.toCharArray(), certs);
+            // save output
+            outputKeyStore.store(fout, outStorePass.toCharArray());
+            // test output
+            testKeyStore(outputKeyStore, outKeyPass.toCharArray());
+        }
+    }
+
+    private void testKeyStore(KeyStore inputKeyStore, char[] keypass)
+            throws KeyStoreException, UnrecoverableKeyException,
+            NoSuchAlgorithmException {
+        out.println("========== Key Store ==========");
+        out.println("getProvider : " + inputKeyStore.getProvider());
+        out.println("getType : " + inputKeyStore.getType());
+        out.println("getDefaultType : " + KeyStore.getDefaultType());
+
+        int idx = 0;
+        Enumeration<String> e = inputKeyStore.aliases();
+        String alias;
+        while (e.hasMoreElements()) {
+            alias = e.nextElement();
+            if (!inputKeyStore.containsAlias(alias)) {
+                throw new RuntimeException("Alias not found");
+            }
+            out.println("Alias " + idx + " : " + alias);
+            out.println("getCreationDate : "
+                    + inputKeyStore.getCreationDate(alias));
+            X509Certificate cert = (X509Certificate) inputKeyStore
+                    .getCertificate(alias);
+            out.println("getCertificate : " + cert.getSubjectDN());
+            String retAlias = inputKeyStore.getCertificateAlias(cert);
+            if (!retAlias.equals(alias)) {
+                throw new RuntimeException("Alias mismatch, actually "
+                        + retAlias + ", expected " + alias);
+            }
+            out.println("getCertificateAlias : " + retAlias);
+            Certificate[] certs = inputKeyStore.getCertificateChain(alias);
+            int i = 0;
+            for (Certificate certification : certs) {
+                out.println("getCertificateChain " + i
+                        + ((X509Certificate) certification).getSubjectDN());
+                i++;
+            }
+            if (inputKeyStore.isCertificateEntry(alias)) {
+                throw new RuntimeException(
+                        "inputKeystore should not be certEntry because this"
+                                + " keystore only contain key pair entries.");
+            }
+            if (!inputKeyStore.isKeyEntry(alias)) {
+                throw new RuntimeException("Entry type unknown.");
+            }
+            idx++;
+        }
+        int size = inputKeyStore.size();
+        if (idx != size) {
+            throw new RuntimeException("Size not match, actually " + idx
+                    + ", expected " + size);
+        }
+    }
+
+}

test/jdk/java/security/KeyStore/PKCS12/api_cert_chain.p12.data

@@ -0,0 +1,76 @@
+MIIQ6AIBAzCCEKIGCSqGSIb3DQEHAaCCEJMEghCPMIIQizCCBXAGCSqGSIb3DQEHAaCCBWEEggVd
+MIIFWTCCBVUGCyqGSIb3DQEMCgECoIIE+jCCBPYwKAYKKoZIhvcNAQwBAzAaBBSKdWqt6IsXyQA9
+6SNtYnk7vaT/CQICBAAEggTIv5XR91OsI7r831ltprYhtOfAhl3TFKj+cqnohJF1xm60K5dQN5BZ
+enfVw4YPbCTR16+zTiGyHJ/MFELwOrOogPdSQBTuy1PtUZOfskD/EKFQaCVSQ1omNlgOWqVh0dhF
+TMjw6KLaTfhwx2Qw3aLIjhy7rvS5SEsUbGZ/IvJ7ym+DHzFuP8oQFfISUkNxh7wOqk4BSsY1Yh9H
+JbK7Y7JtWReDTbAtuACQSPO0Z7RSWKC2y29cG6x3gIiB8iKTNrPKc6m0wb48RKipzF6r35GQRMoS
+rsordIc22RS/KYFfU4W9LAdV+/vJBuZazc+3MgcOXYUWDaMpAG697aim1yDjudcVnPoUdzdWQvAj
+Z7dHqeplZ8h4Ur+dKH3EeWoipXBXhVI0i9hFbOU+36OZ96LUjlRfaAI3NXVMEa9+kATwDHh9cqnQ
+1zkbVPCXBY6Y6+wnq5o0mpES++MCc8zELiFYZOJl6UWBE/D16QAv+6Qd/JHmRaZfNt+vNxKm1ltm
+nvdyWcO4FlF9F5cC66AS3NcdZ94GNkRBW964+yaUCFHCeVGSfwxqox++akNOyfrw9lP8a24usPLj
+ScueTLGCftprwUGLb9g/zRhPWBHrYELbUplER+KQeWnX84OqyAZXNnBUFhrH8CBJAPDIVCpZj7ti
+Z23eQoplPpL+z/CYKqx1BTk+E82+Z3cXXRhgiguXHqJhf8mR+3ZGsNsS0r23AnHQGJVvh09wbb02
+o1fAJpOkw34GGoLwqstakkO1/nKO2ln2g7UTdkzcGp9GCrhbxAmZ0jXjPy5RFG1m4yEhjAJ/lnRm
+3bwCb3z1mBjtrRO9hnb4iQBzwpvctHlVzAUh77JTbUzsu7TxrranUq2+Z1MWjqsymoPjDxct0GK0
+WrWV5iwVTIB73CW7IcKbAKVxsus9kRjbLaLxkfio6HGiYz2e+30CJX8sB5DPLBjfAZQiWMkq0k3T
+SfAKPRSlX7okdrXpfON57naUPw6biIcbDQovH7sMDSP58VLiGI7CNUuj5rhGu9O6Jhc6n5/krhjI
+W7xUkXZmZPq2yww1OSSD3LF4K7Uu6ukZMQU5NfUOVeeAkq+4RMns/nZdQd3JhP0CyuF4vLrEWq8n
+6WD+Sta3ZvCxbLPs9xylnlqevmq0zUhxbY7gzObEMGH1YpZT/nSjHpAbt0bcwFIiFncCC0t9/d07
+REJjWvG7J0GB9cNb4aNbE05fCx0tlipyNu2GASwT8fw0tPXrcdaHxL+1+/fDdLlsnrODN+Hvx2GC
+oixNMf1NSC1M0evf/8tqPDwwUBcKdFumILwEeWHwOP7Tx3/2eRfSPP3e6iGDYv0KrzHzWV2uyoXj
+bTwfRHs4W+71v91dtrKH8Q+IRKxkiSKdT0KnpDkGlnFwK88TAZso6L1agTshdtjvwNAJ/yaIN1S7
+FBBKcM2/rc3SJwNTmjsHrX3C8VvenO6rAxBvn151pzMjCY9eijJwnUKHEB8V3wSP+eSM/INL1swA
+BPIJba5Jg5Zhch4SpV8B5rjxAz+qkiLlGOxbsPeyfv3jzINZhkBqRtBA3gLxJjPgfPlu2s3U+HBa
+iHm0/K6VlSztjs4Ez30tfgym6vbWv/rrRXNfUqWumNqC5LXyDbVy7MarS5iKMUgwIwYJKoZIhvcN
+AQkUMRYeFABzAGUAcgB2AGUAcgBjAGUAcgB0MCEGCSqGSIb3DQEJFTEUBBJUaW1lIDE0MzI2OTE3
+MzM4NTgwggsTBgkqhkiG9w0BBwagggsEMIILAAIBADCCCvkGCSqGSIb3DQEHATAoBgoqhkiG9w0B
+DAEGMBoEFMrHJAy5G2zs/2U91Kv84axmE50HAgIEAICCCsDf0VQQ5aHERkv1me9S5cr3KQ73vg0h
+gawyFpFcMRGhzwMggy460MuwHIJk9aQ9rlvGi7FNWsPdBrwpJzyU6LFHUl5w/L94hjULrHeSaJ3T
+oltDs8jMK+I7Bx3B96kc5GvYzOlaq3OtRbITPs47a4qA7/TTAJxYC5pgTXiulu4lZ/scaHnBQc2N
+wX6ZFSKMz38lzEllA+ndnhgLNrL7yozrVFslFu0XrDcZC8ga4tm59rn/Dzmyz+hPcK+JKv7nq5gt
+MTGOGwtmaWUh/kSKPNETWVasa7UDlYexSwSadNlDSxWCHXEXb3YXOVvLDbnVB8OmWChBlw78vz/9
+UmeTpaCvH3SbgulOzW1TgsV4R7oTkib/Ck2R1XBPOssDg56VSeRrsd1pVy1GKxUsD/T5tih7wK1I
+IiLPrAh488GELpPadKjsv/990OSbv0q72V4kJWXn6m9RsQVGaOV2QiEjQPWSCq0FEglD8ikpg44X
+HpdCf5hL87iY1z0zONG8OP0IMEEJn091wfegCJZu5XsvT9PFaBm4mjMol1Hr1ZT/w6Qzfc/AmKn2
+serI/uAzOoMWGOEtzpof8M+DFD1saMCRG9Lf4A6fkub2968ZMbiSsdIu2YJefcOMWtmcW277l1Pz
+EjNlLXV40bfv/0tnBlbD2dYfGS2iCi4eMsWEWbV2kBq9gie24+NsDSlGXZjd7x9F0D7xUKGlXnR/
+4NzEilOURjEvxJloqd88K4xM1ZUELm/OYZwIkOmDZdqR1/8Wh82TYW5Mq4NKUbfltTOcvLE0fM5N
+VGyio8qGEVzgLWOGnh7V73QMBidu3cTWKf/OYYp13ywF0CxsGRVZmskFa3uH0C2pAoWnx13Plmo8
+lLtDFtxQ+u9ZBn8dZDGDD4gY2YSYj08/5MBWZQ5EWVLwn9A6xNGQMhFUuFhjmKCuulScaJ6v9aW4
+QBg5SfWzfuYD1G922wx7/TtQFBVR4NIKxTOroIjSpI+lYriNDa3c1UYRa+DY8suC90Wz90sbR37T
+QGOenU/QCSavPIiVijQzQbXz4eEMhddIwoCHTtkn4NgUO+pn4zMl9jCrwwMCSG1t2DZ1L6y67q4Q
+UnI0mU/O8cqglykl5Rz9G2TraHMv5SMGyHgi/jKyfGfAZriopPHWsXXNs85okMoM8j3YCFsM7EJ9
+l4We6J4euWK9WM7YboiSgKltJGXUgTU0l2HYN17ihF3sY3PaBiLdrNARM9blkzAhdhx0Q3NNFn3N
+7g0PniTkvW07aZoemdN/yric2grhC5P3rkuaw0j/AwTDC68ReJbOmdn7Gmv+4RSIXN9DIM/JV0Dd
+Xn06zLhnl9mim5hLtB1+f0E4oSz1MOOh1qoajm/lpr4o7zyHjb3v8mKrTMXvYO4PiQZ5HKWgvbB3
+iMCvdn859bv5X5ckz2SVtpnTjYTemICmEPRk7hRb/DZJkMptlhG2uFIq1ZUSDwVMGrrnRkEwlyLT
+f7wU5C2KoNGVgGhF9W6w/RBzYyTFVrsCTxpR9M9Jy875JnCmOBYUQLoDno+4qR00a70R2AdG7c3q
+gCZQBLzKqEp+gu0YUPGZzda1i8RhSF6c0w2A7ToynDf9gTbKSsyV1iblTm1UhjG/lXtU/9rzOMth
+7ZCrvd1EZGbmn2SP+CsQzoGMh9T0j+FygWx1u/yYO0kRXCjcyzOVq+p+XraDwxiI+GNcqNkrVKUW
+kIJO6ajXZg0cNekZyhiR3vLdY5EOBVWahvTnWFrEPpNt6tavVHyQ+AJP5t3VLq16AkBGgICYAdnG
+zKUgim96I0xNd37EKTmIlBccpNc0uVLgGEzuQiONBBcZPUwD6y4EvJnLmEaOdgRYjcaO8aeuIX/U
+VEC4zQEXI99ghQ7TWuNNOwyR+kyKQQsER5GRct9fzv6qMk0Xei914IdbL7DAy2pSfyaYNNlk339H
+/ji5lQPG1y8qQAw6sDtQPt0LcHg3bMX5Q/r1/LmlpML7rOUz1QwVH7QdHrHWjGvC1kjrmGtZjB7j
+XwQMItY3n/J1/vBfeuSk3sgWeHBYxgmnIjhqMVEoTSTUyelfrOte9N+5fomUWqnujl6rmqHl62oO
+695wUiKq6BVpXQtJEhqauQYAQ+DoGn3Klbmd5iHaqG5PU68wtEQPtSvXG6RPtteUi/H2jpnaG/Z+
+6HVQejCGJrZ4h1C/afq7WnCg5ZM8dy9zE02+CtqTq1hEiXF5mF6rhpKgxJZLlWk8wq0zP47ahnI+
+0VyAljgH5CW5BOwGrZdV8LHPbk+gVhqqBYIw/05HACbO4K32rEEUuvK+DSYQ0wxY8ufa1QttqQnv
+YRQ3XU+M4reL3pDJwPg+3LGP7jcIEqUY+trGeWbhASAETsLUURYuIkAydPKkEvb1rFPJGfiuMAVi
+PhSSTvDSrV8FZR9NNTr7zeHAbbJWArKi0hcv67noStYzBQT++SuiD5stp9Ym4DCE6/sAIR7Sa/1Y
+rhViLtpHp06WzkXi5lSVBCpJjaWKznmQp580gyAjjOx3mRqkEwx440yJq0LfqTdF8jiV2IZhjiT3
+MjdanLQOlldjGL64SpIKCQ0FzQcnB+sNbTtkYSRR9x4ImNYFGQpQtXimbAJAlaS5R4bOLbOygO/C
+mUDjpo1NkTIyAe/YzALpbCyJqaEOPm5Yp+1C6EQfb+DUxv2MyUWNuKw0xvFWhy4TuCCsrzIfQLYi
+2UxpILq8zr8ZhPUGv6KnN4j+jTo92A3DvtBbTLdRLf1n6hfAhWAOBmGu7c8N0kmfNcDJuWtvsG08
+1+xqLNni149FrNDzMjLwMg2YwaHJuwdKZsMcRtEfmGi2uAsTthsq6MxMHZPBFqNaNwrcaN7+PEK1
+c21PW/X6+kATvCRpKJxlChyZE5yEanvsIwpFB9IRmyEZIyYnCIcFl08Mbaw9jGdlxg32VdjIdQTY
+LVQ/8NOQGuz8RJepxoBQQ4dveiWJTPeEY879EC+3U8NgA84O3YZKfNxE4uSbjeGKu4tvVp5DoByW
+H7ZZWKAScltteuKFpP4ME6gGwvgF122HNzfrwztjcooIGfsxRvRSNerbAVjyZbBy3jC/3m3pOmqy
+kJfzhbVqEesBRCJKaCXVHZRSoziSqlwtMgbU+tPYGMERJT727cIFFKhqLILybZbc6LKI/SV852TD
+JXQ420HZX76GTSEWURDsu8glvYuGVosvBdg/63lVf8z15vJiaFbJEQDR7dHAquTAsynB2PVUErhJ
+sNz4kuQRbRoD6vS07fM2avNTLouZUX3bpwugyumgl2H0lvxLWXnXelFHnIc7NzdEqx6oS1YZBgq3
+7U21OG5t9hA02eZZT+LrcAWH1NUV2fFWps60WHKdCKcIN7w/vy/D8dDr1jdOppdubN35oR5ZOwob
+HYjk/KepGNTDeH8el2SX9yhjj5a0aTtMTdy/DvpAN7u9Xaq0bRH1lZZyE0n4F1MysND8sWwQPTH8
+uJoD4msqelGrx81lThyhwwk/8+2AWGG0sU9l0sK4xMmeMCPtdGdg9C4g5m08mHoa/etbOj+7spqf
+MG4Gq1hLOygsHwFRRQe3eRi4BSoE7HvgdyP84qVnLnc4g0RDLhFdDgyBLGTYRqpCX8iZA4Nf4uRJ
+pteB+CANzKjx9HqxBO/jGtOwFBg0eSXBU4d4CI6MoAS4NxUjlqhIGEKJBwJ78jPsCq2JMD0wITAJ
+BgUrDgMCGgUABBTxMWXHZ4F5ADtYXqKlpD5cMihu7wQUsiXIcUR/3TChw09nR5rrIaFsN+MCAgQA

test/jdk/java/security/KeyStore/PKCS12/api_cert_chain.p12_expected.data

@@ -0,0 +1,7 @@
+SHA1: 09:F1:08:B1:B3:28:22:23:22:F7:5F:6D:4A:8D:0E:0A:5E:6D:56:FB
+SHA256: AD:57:47:67:20:96:49:86:53:E4:10:EF:BD:4D:D2:B0:81:C0:B0:BB:62:AE:BE:47:80:DC:00:F8:E3:E7:66:B5
+SHA1: 2B:CE:0C:E1:35:B9:9D:FE:5A:6E:25:88:01:F7:E9:E5:7B:89:17:42
+SHA256: 65:F3:0A:64:F2:52:B2:4E:F8:76:C5:D0:6D:53:7C:E8:00:AE:F4:95:3C:CC:CB:01:6B:22:AF:46:36:50:CF:FF
+SHA1: 7D:48:4D:1C:F8:55:E8:79:6A:B0:19:E1:26:4F:AC:FD:57:6B:38:A0
+SHA256: 0A:14:3F:88:8D:C2:D6:97:3E:02:0F:5F:17:E3:D9:FE:CF:93:10:2C:3C:8D:81:AC:06:2F:32:39:4D:0E:CB:6A
+Alias name: servercert

test/jdk/java/security/KeyStore/PKCS12/api_private_key.p12.data

@@ -0,0 +1,31 @@
+MIIGyAIBAzCCBoIGCSqGSIb3DQEHAaCCBnMEggZvMIIGazCCAzgGCSqGSIb3DQEHAaCCAykEggMl
+MIIDITCCAx0GCyqGSIb3DQEMCgECoIICsjCCAq4wKAYKKoZIhvcNAQwBAzAaBBTyKTFVy4z9Rja3
+Gd3aw4Eb49XnKQICBAAEggKAOFjH3xr57gTXK1A1jBzdxnY7ZaHVqeFrjAcouBC3DV+yR6x2bxNJ
+oEythXOYnC6flZu3NTbGkCd8AjGsUPgIy03SeRrQE8eKhhV981FOWuG1uHpa3wN1e3aCpaH7xvcG
+d+5cS2UUWd2ejrM5hc3GeQ+rGCGdguXEGWwznAYITlv8f81Cv0BliTlZCwHN06uJMMVLDhUlUwD7
++aVHHNjpSl/jZqtEFdrsQy4KFPJy9lvDW9oaQ/EGerWM5gTpvhJ2NFj1h/912BdFvsPMsniE7XPU
+z4M5vxiIagqJ1qZ+vxrHOMq7JPUj9r6LrM2/6nPq/LJxbn0PK5TIBHThmFLKyAw5A70rnyJzmwDf
+AIPSNu/OjORD04VVyDLZNKDM1rkSKA9Ot50lDfqv2z2n/8sVsv5kETNV0lEIslDM2ML3IF5LKmUi
+ErAqHZAA/iXcyAA63M62imBhSvnQdHp3XCE+YtgDqbKVCbRQDg7hcvVzWfEw1Q4ogCS/KG/cb5lJ
+/zWdlXXcNjdrOY0qh6rLc3+s1OjEHkvnFBIs7ljHBqGTNkUPdpLFhrzOtt9B/5vDdzAKisZmTmnM
+yN673KkQ/6dvY7SZLOnYOHOtyBuWN1h+28mN1nWYvuGLFHrtnuaxB0dMFD4sK1LsXYatd4q9+XUv
+/Kj4wQLVphz1bHWzpMSFioe/eLNlsCIwgshWuqKO9c+SLC69HnbdWUgG2iZzZpwOBCI9/4eR+WFW
+o3xFHeVUGSWFuMC+7vSNNvRWIeKBY9B+7QI2iKBTI5aXHC+UUTI1UbVBeEgS0Hp8eRZVgy3wCO7v
+Pt3QKH6NYkWXtQvOfX49d+x7pJzxqWqTqkeWjSQ8gTFYMDMGCSqGSIb3DQEJFDEmHiQAcABrAGMA
+cwAxADIAdABlAHMAdABlAG4AZAB1AHMAZQByADEwIQYJKoZIhvcNAQkVMRQEElRpbWUgMTQzMjY5
+OTg3NjU2ODCCAysGCSqGSIb3DQEHBqCCAxwwggMYAgEAMIIDEQYJKoZIhvcNAQcBMCgGCiqGSIb3
+DQEMAQYwGgQUIgsA0/PkplOYdNScW5OpBIVNLUkCAgQAgIIC2KY5LHfrfcdnYEuai+kP1qLfj0yP
+BDfSvwFyrx8aCFClmbVzHebM05tJfNpHWqDYzwTlVk+WtaXOnyrMP/1HWm6jNe3Id7WKHxlk7HIb
+FWbYdjy4/uHnyPeAIgFIltd1RdxXt5VDwTSAY4lwSwaEA+vvkycVfckzhmbUylclfy4HVNf/3d3e
+61VlLUbitSbnKX281Eek89yfKlB5YxQd0jHdXbdBNTB1eUM9s+Anm7p3emDMa1XR0N+lTehKLAyp
+znOe3ynqL1OxAiLH/4uv3EI4Ah3b09rB+JJ0+sAVRo1olMr2Q5lkQdMWxGBwIFHf1LI+JH05QWkx
+6a8niEfvQceybkgz+e9UPkdKNcX3UYV07rYIHnd3kg5lbsEotN1OdcMPgewg5OC3LbHG8wAlxyfR
+L+WAyFoA7QnFpNhBgstOx6jclTbSpMzjGKBCKb1tsKD6N9wNEKbluJetyQDAnQ7JjNsTpspYM8d6
+pUiX0t7PpaoBM8/sN3o1s5wp+c3jxCVUHGzKGymavx8ItKWKNQJCZdwvZPWjsjIytc8A0k3nVvK8
+qPUlXEj6raWGxnbWV5AUpQwu8SzysyfGHt/7dF9Scc+8uSA8FKGpqOczWktiwe6m8nYwGZAg9D/7
+ynXr8xq4N4LgsM3JlnHf8vIntPaoo8bNSIQCZV6FK7x84A1tnD1vQrZuzSdyW5G7L/FqaomRoaj2
+BCyeoxpgvldNp0TIR1rNsNAwLmur5+r/Qk5TslWtV1fEXpBQDKgboB7lzocAugi1+OPywEqyLQL/
+EjinsMKp+IxzKAFLEJTZF+VGaVHNhDo7UqZI0psp/SqX9lQZkuuQKK9zNrbaLnAHfcijHRKa0mH4
+lkvA3Xp3tdmatCzO3eHd/el2U9zGxQk66B4yJHZTuIS7ipMKrPQWfkRqVi9qqOwpgr9YAIvYrVAw
+4Ke6//xG/zeNpMf3iwq0a2MECex7/ZZuMD0wITAJBgUrDgMCGgUABBR+Gn1klUGKLNrlz1zvINy9
+OAbKhQQUbyJhmiLytWdKpRT8ywMAn/VMTkgCAgQA

test/jdk/java/security/KeyStore/PKCS12/api_private_key.p12_expected.data

@@ -0,0 +1,3 @@
+SHA1: 48:22:E2:C2:47:9F:75:E3:52:56:9C:20:37:DF:03:7F:CD:9F:87:38
+SHA256: 9B:DF:B9:EC:DB:3E:EF:BD:61:8F:C3:62:BD:3E:95:FE:E5:B6:A3:F9:94:3D:8D:C1:AE:E9:44:86:25:FA:C1:1B
+Alias name: pkcs12testenduser1

test/jdk/java/security/KeyStore/PKCS12/api_private_key_not_match.p12.data

@@ -0,0 +1,21 @@
+MIIEpAIBAzCCBF4GCSqGSIb3DQEHAaCCBE8EggRLMIIERzCCBEMGCSqGSIb3DQEHBqCCBDQwggQw
+AgEAMIIEKQYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUgIXKrki/1oMI4cCRpYWa/iQtL0cC
+AgQAgIID8L1nh0C0Gmm9/AbAYbiwBJeb5oCAHa5E6BXJO9DP+m7774lUoQFuAmHJRoqr9hRzJulD
+FfdkmRO9JdCs1tRgmnik66ybBb2wqr9gsAhPHFhDWuYIQTJcYqYlBTS8hbg5stDYWCeyaqK3+Zyp
+bV3nHZtCe0AO+Rd3derZ3qhluPhc2FWX05fIomTZNiJsbi5wp95ejH4tGX5OdQoWXBjDzlrxopUd
+pmdmHfJvRRTEtMr45VPfuHOkAX8Fe2tPFUgkE2tUalUth90AuPXVlMm5Ne+OdKcj+V2EN2s5JxA6
+28H1IL753Hov3R80/+Rzn+NIN/BCwLfHyTFa4Ur7Z2dyOJHvM5qeaz580RR8MwsEjqSpmXiyVhQW
+3LNuziqs21woC7ueDW7TLiLhHp2Mt8BqFyfUYqBoS29lchRTHZbWTN2h66xycXlzbUCGIOHDXPXB
+mqgxQWIltgluel+9Uf//D5yzIkXbtnW9dkMwKkybctAUs9VN8V44UBxv4+noSxepUs0iG+07c5Uu
+dfvzwYtnKqKUrtTT8tA/MBNd4P1paYJR2Angx5tInyNKp8TwOaSrFUfg9stMYMh2fbWHLJFS9RDz
+P7BDkrBgEO7jDu3O/XyyXzgUQRcQBv/Mw7sCFQ8BBMFzwf/dc6q277w+DJmwz2ex23iXQXQi/b6Y
+iHbPwYHVwURWpVAq3P36pCTYjnUpPHMgRKo/9Iy+tL39H46SyGqBFlriM4jDEu7dbi7n1MuMxRYD
+zocSkdsnlsJUBOhHLFFYIUIqx6jOgnOESKPWbG9XIHCTZJYnpasmP/VidrQMljzC7c3piePsI03D
+8NcJq+BqCRrX+7Z5vPAU022hMryQqHesgnx0T0dWXaCyabzjjjOaWvacxRRCiJ4+EFZqAahMNQp/
+XTNlpW1eI0oQ3YBlJl5FWuwhk6YuoNSoi8ya1wp42rFnTwXIG8enfa0wyx/ORAvfypW4wcohsCdP
+oRjc9foQsdcjxv2e1yMn9TlgjTOemY81mFfaSMa+4OIhSgLnIYI96QztrY9n8WHJer1hxVdKrb+8
+Mhf2vcNEToVF9ypst1C7fXSeOKdAYlNDskPAAm3prcuLMf1dzceIADr+4JOYxzdz6lLvjR+tpAHo
+zWO1xh73P+p+Bo82wxnoWCopqOUCEoAYhsy+JBGZNM4AHvPAo4g0Sett3qixZhvbmw9kzKsiFAjf
+wQHYPUfl0O02HvBizHK7dRDqJ94G/djGBhqfe34P0hKrCzW+n0u5nFmkFEdk50LpsTu0z3AaaaNh
+E6485FDeW3R3/67pGXglNJHBWPsl2AYFimUTzxQqOfoCzBiw9St7hNvuCJBv5jA9MCEwCQYFKw4D
+AhoFAAQUczIrgX5A0QTP7tpYDiY3MaSbEM8EFAprSM643ml+k9DGSQKZ7MG0UEhKAgIEAA==

test/jdk/java/security/KeyStore/PKCS12/api_private_key_not_match.p12_expected.data

@@ -0,0 +1,3 @@
+SHA1: 2B:CE:0C:E1:35:B9:9D:FE:5A:6E:25:88:01:F7:E9:E5:7B:89:17:42
+SHA256: 65:F3:0A:64:F2:52:B2:4E:F8:76:C5:D0:6D:53:7C:E8:00:AE:F4:95:3C:CC:CB:01:6B:22:AF:46:36:50:CF:FF
+Alias name: pkcs12testenduser1

test/jdk/java/security/KeyStore/PKCS12/api_two_pass.p12.data

@@ -0,0 +1,46 @@
+MIIKGAIBAzCCCdIGCSqGSIb3DQEHAaCCCcMEggm/MIIJuzCCBYAGCSqGSIb3DQEHAaCCBXEEggVt
+MIIFaTCCBWUGCyqGSIb3DQEMCgECoIIE+jCCBPYwKAYKKoZIhvcNAQwBAzAaBBRXawh3kWXVQuH9
+IwNiyygBmKxSAAICBAAEggTINY1+d2I8JZk2edT/FddM9FOQ/jchyf+SE4a0eKQae4Hby2LrL+AG
+/+6MmRyvKOQYVthtxEAqoqUxsEPc35vr0xtiv/em42AUI5abfAnh8tTrgoCY4Zc3Gk/m7iS0XKQJ
+Eg/uiA2C6UbrS0soIjpBkNKxmh45L9hBtkOQkwRC2SqXPQy5g9ezwyPFWm3KsbdyMwnyJs2dMEnE
+p2D2BrdSfJwEZjDFLRFszQDLYvLgJcWzt8Zl3vdgVB6MDVGtT8Zdsa5cyxnplCQU+tWxP1U0uODn
+4uyM3PPujLwgwBl6EvCtR1ddcz8k4YMrIp0h1UbEGUibg7kaBmZ79xeZ94FWU0ulxW7sXX3YBSPH
+Nf4KM1fHshdAbwKZD2cR9yGG1fta/HnZN8y5YuQ9iNsAF+sJZATOysqa4/L8cst0Y1KpuirFkctp
+sVykTqCqiwOhSzQ0plMXG0rABhSX/Poapsl7ghY9jgK4d/zX1XJ34BQv896AjEQSBUs1NbybzNiK
+AzxV11JF/Mxdp29a8Y2tTr5NQVpnIEMlvxTwJgx662MPTlPyNUTxFWJfx/WkhI8VQzz3lqRhvOD4
+IvkKw91+BK5BrdSclrJ0P6R6Rak5zaXFMY3eveCQ1HQyU4Az84+xPw9NP9xO+5DQxRPbMDLZYLm/
+nMkwJAf/fXpto/2JeXkMPahuG6Qgr3dP53uEFwukQOsY6CG7/I/fumhZ5MoR63ez3WiNrAQXhQL8
+73+gkcWHHqmO4BB+3hkEjIfBf3v/o3VXrTIxmaEbMeQTb+FncoiimSmUP2NtFaty5tZaGE7AnznC
+RZT1q2fFckiKSjF3lRrgtnC7NIqfbSVKpa87W0TEkLMjrgZyj68c3aczXzJf0HHBSNJdHCufkv8V
+shDdqMuhmyo3ieJzjGnZ8eTIH7Dtm2LfgmlhDvid4HaCBvDLV3SEvY6w5YjwrA1a3/4I18tH0NJR
+MizgwzDspvvRHEjB1j4T8Vx/4uhmajlhWO6HOdLlkMB/fDZ1nr5D7Hl+S/530+Dq3ZUav+dwkiKg
+DpBYZgr4ETCY5tkeh8okfCboG76yb3nJNnZhO84EjZFnKECtZzdJL0viKclHPJnN358Zq0qP5hua
+CQN4hE3E5wsOaZC8eISWze8v4jTdedyq3Q3H+hE23oZ7vf7nXMzDbLAQzYZN/ISicWCUFufgLGXp
+crbze2dGmEVIYuGa8E/cHyKcNOJp3ISRVhGVxoPwdhniyXmqDqPLZ9C2HcPqHtrcuUchsTuLykx9
+B2LEnVKpWTTHahZ9aiT6g7s3WUMrlF1iHds9Tc5+YujlP1u3RiK1sg88SuTvwcBYw2fmQilk+JL1
+q5tIdTIwEVuX27GwugtDt4QJJnaEs2tjShXiIY2tPTSobYXIPDTKZJzxzZkbp8KUvNXg2zIVxcQC
+ztIdowkkoHpb/wpU9YdlgViDNk48o2fZRZ1HIOtmvilbSrOzj4yENz7i5jIhjspAOWB1/9fnAQzx
+rhgJfDhqtgVTuDoxxyAyagw8PXoNY5EaJlNzbd4tqpI9AS6r1w3GMBCH9sfMXJcNfBYb75XyKQHr
+LTiNysRBQmER5V8wxGVAq1Ktho+Tc/8gLoBHzoLkp04nlI5b+T7KjJDfsM4hMVgwMwYJKoZIhvcN
+AQkUMSYeJABwAGsAYwBzADEAMgB0AGUAcwB0AGUAbgBkAHUAcwBlAHIAMTAhBgkqhkiG9w0BCRUx
+FAQSVGltZSAxNDMyNzA4NzIxMDI1MIIEMwYJKoZIhvcNAQcGoIIEJDCCBCACAQAwggQZBgkqhkiG
+9w0BBwEwKAYKKoZIhvcNAQwBBjAaBBT1VlQaPNujgukJkTei7jHX1tc9BwICBACAggPgOU7D0OxN
+PwhrndRcfMpbu7smH2BiyXS390t8futsdTc0gX4Ekc9Sd2leVcEDnwf6GdqfFLKK8q3a0gFQPIbD
+y6DyD5CWhoouLo9DmfMqeETxeTSF9M3uJGoLdm1MUCCo0zJ39XrNxFQhgjPFWGYOQsZ894plqN3r
+tb0Gy5IOL3xZ6V5Bzv7/JckMYyV5Jd86GyUDKYcjHwUMTELMoKeANN0t3DCdbp/YmPCmKBiPtYRm
+MW/dp8l/5Wi+dBLxIJmd+IrWYgKcPBBsgny1FmiNpdAdRWUyCZvfzKpAITwgBrOwCZI071NMZ2+H
+LbUacBVEbKSRJuKbkd3cFNWe/tBOPCptlqer1biVt8gBx1K1UXA24kcvFex/AgXOE0vgBYv1R/++
+OPgV/Q2YBtANHTne+a9zzxVu6ZNnRFVKdkOUoWagF9I3rc0jNQSEt3CnbdbCbEhtpoDWYE7V4i0f
+JQf+avcyz3Eeb29m1e6foOeCGuiB9lfAHCLHadEhGUcpTJJ0A5JFLA+ua3MFBOtvrkq5mGQSQ2mT
+CH0t+sHoQbx/2+TTHvU2LAPVXhIum+yIWU5rIxDMJXDKSrEy7CKJEDsoJn3IyJNVZSysgYPJrlzT
+3zIdCG2xlQJ4O1hDqjBVgj//e+WDlt3Bz22zAOien/OjjF0UyE6gfyqaDgBozzaPDN+2bgaoglgj
+A9cDzJ/jAXNejXc99jKfpvECpbQev3GTqRRbs3kcEsZv1QW+HZj9beOKMxWIZWn/RqmEcFw8nk+2
+qvCkkXvJRYnvp5prH9V9l3THURR0TURHyeV1FQChOZOikfWmcEpg5xwmmDH7ji07/DsM+gn4d3rZ
+0ioGRovKy/WlQXOtkQJ/+y9huYiRXUDBMFY1pWjHdV1JOM8CzUAcS6143BpWC6wotPTBsyis/RmL
+8z5B44M1d0HkjgcFDQNHm2xR4W9uuCcrxkicU2e5GzO5bUDaBv7rnwBj7Fy/AiVhFCreJO6cVAFR
+kIyeLBrJGzlemscTbymrYsg2BydoxRXWU4wRmgZQQyRgQTxHZeNYtn5mpvV5D7m3HNCGxoYj46L2
+6P+FFoByASwSQpKrn6OnH42xmAs7HT/flOhz4e3cD1UuUcfqqITaOWSrX22Ew88JqzbLDgN/K5Eo
+TIMvtPSwihL4NLJpzG1HbuhnzmOiYtI3/IVhrDQ5dPYTUy+U1hasE1NTLM3xvdTBebksygbj3IMu
+wiW+reRdF5l0Pz9tz63MFu1FbKNrKEkg8Vw4cDEtnvpJRIO2VbVgZpdKhhMC7Z0T3xP9hEa8crv6
+/8qd5uY9mvY3RSKO0IdJSgkwPTAhMAkGBSsOAwIaBQAEFKSVvKysZX3JB3K2WGS6czUVRXZeBBTO
++FjQ0fq7d/D+Ilu6e2EBG1y/ngICBAA=

test/jdk/java/security/KeyStore/PKCS12/api_two_pass.p12_expected.data

@@ -0,0 +1,3 @@
+SHA1: 77:90:EC:65:C5:0C:FD:F2:1E:B0:3A:BD:43:21:1A:C6:FD:18:8C:AB
+SHA256: 8E:C8:49:82:B8:4B:89:8E:61:2D:CD:F6:D6:34:96:04:91:6F:1B:08:F5:CD:BD:23:ED:94:22:5A:B4:7A:39:DD
+Alias name: pkcs12testenduser1

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/ie_jceks_chain.pfx.data

@@ -0,0 +1,61 @@
+MIINXgIBAzCCDRoGCSqGSIb3DQEHAaCCDQsEgg0HMIINAzCCA7wGCSqGSIb3DQEHAaCCA60EggOp
+MIIDpTCCA6EGCyqGSIb3DQEMCgECoIICtjCCArIwHAYKKoZIhvcNAQwBAzAOBAipOP0AVsizDgIC
+B9AEggKQIP/YI9/C2WYbIWxKuqXMD8WPCvqj1fhHmZJ0epCzgEdOR7GT/h2Fy4/wxrthPkj4JqkS
+akQog3pjOFtj9D8QtkOw/b761qsyj17TYlQS9C6qVhcddMA+Ca2NcDhKlYofQMNTuYPXkXlpCh5R
+CNFgQ+PLVZwNZjqoitjv0RLQqBudhTmJSvfDlW2w+CpbziEeRNzn0pX0/Ts7KxykDscOmUCGHKic
+b6FqHoioElcmBp7ae3zdXuvI1x/1Y435qju2yODPpMXEZbdsD5iL07RZyL2vm6lfQbLc37TszDBx
+ZZJ7ja5F4V/j/6/AVLkcqfZxFOnXz5Ki9rQblYJbkkTpJAyiNqi8Gx+zgPGtLWvV6KRD0zmxo6q/
+OmdjKz4v9aG7MDSXenoy6tPAOvAQcQYaksvFZs1FjorJJpFzasfTUfy94JzrHUzRSPzNRDANHG/6
+TgxC1FMNw+iQUY9L8j4xrWsr2JN5tAgYcWz1qZrp4cx0he9cbQeqYcjv7ZvIQbIe2zxdvxh7WByy
+r8hNMe3RkMOM2yuP85JuWipq+9jt4/CrimKljN1ULPw+V9FZzY8kKcEiSPD+KXdJNkrMr77/lUJz
+PGNYpFBFb4natmi31ZBH2VomTeKPpeanN/ghWojft1mGd1s1nD4NelrWATMVquH2Cq6nhKLRHi4c
+KbQsMo+ftLvkDHHtpYenjGHbwEFfowkwn9slsZqmPEATV6caHNITCBbhQmvvhqPDPPViV+u1M1c7
+vwf/ol7IjBlubwzBJAg6f5GW0tMNHxfg5E7O27AyREyvexk0IVakzIwUuP2anPTjPW0vyeePLtiG
+TXNoUe+5UIzpshnLmSlerhVGoB+HBM1yoaaJHay7sdyQbVUxgdcwEwYJKoZIhvcNAQkVMQYEBAEA
+AAAwWwYJKoZIhvcNAQkUMU4eTAB7ADcAMQA5AEIAQgA4ADkANAAtADMANQA2ADEALQA0AEMAMAA0
+AC0AOQBCADIAMAAtADMAOQBCAEMARAAzADQANwAzADUAMQAwAH0wYwYJKwYBBAGCNxEBMVYeVABN
+AGkAYwByAG8AcwBvAGYAdAAgAEIAYQBzAGUAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAA
+UAByAG8AdgBpAGQAZQByACAAdgAxAC4AMDCCCT8GCSqGSIb3DQEHBqCCCTAwggksAgEAMIIJJQYJ
+KoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIEmpyonjQeMACAgfQgIII+Pr+GLKaSN1U1soCnWsw
+4kRoDxPPLNbzv/K+lsbGVk9vXjv5aBTi55FMCXvA5kGvdnQYrQ1KfIZmFVh3PnFQn/J6LVrpLbHC
+/D27wvnOMausJA7uJi6wgkUCkQmXn7kesWhr+bBI9Ci7uyOUxdY53Yg43OQtZbWvQjGe6GiVRqWm
+8NANuZ3c1IT2TmJw5xfvvE4tcHK0d75ApvTa43CkKmUY5A4SyNY4SUVdl9Cx50LEHcqGwV+uVGzy
+kdO0+bgXI66FPKriuqPfayeTmL8T9PimwhOfY38OqtTKHwJ7E817i/B8ULpkRO67uYYJpeK4cIz1
+0rDW/JPG8BqN47Rej8rCpmY1F4hOuFzYA3PAh50YlI2wD2vSSqVPMUe/AtsL+u2Nxl/EidWp/8EL
+l8rBgYJjSl+YjSRV22C/ZwDu/8oV3LeCuwL2SaO1r1tww3WuRAFcCctsemP84YI27Q8Z54P6wM8c
+kjYH9F3oT9bHUAfJUm2d6d3wd+iGbrrxdkLrD5tEQB16K8RAbhPPfrM5rcRlh+Zvn068H/Kc9rEa
+sfJD7ygUBZJ5MSsr4zP4koMZ0xjxAaXRUsURsF13772XL3zfTCVd5fV3wIpJsoXugZTOQ6hjAmeN
+yGMZDn14GyxvwLbGFB0Yx8GAIRDxBvDXkYOqEMocmNwZo+uxPew1H4PMkWMm/yh4Y4V/H9Jmyd3v
+aD2BWVyx7PIJ4cet3RdydHrKSNVBzwrO+y5HKZc7V7aRM0kZgdAJh9eDTlYk6B+ZHd1EawYRlIfl
+f4JydqRkRaya7FOfQ3mLgrz6bdde720XZVWqe9bbsBucbYAJsYvklYYYutnsx1Ri9UYYAbRDy920
+Z6iO1EGF5wcUc0nifXObYJ2x0ldlQskUdThPjZBl2Mk4F9oxS6W5j2llm1hS/vGnFtykQ5NMaxzi
+Jkhi1Mjm/KZJUo2xJai1gtHwBOnlocXZYqJQECabBayA7rLH3pFUhU/Wqkycz4m8dUVXLNHiMIEd
+3sc0QASMF56kqXtzph2zbXBbCD8afyt8WjMzZvO4lEGNM8xi/7C6h45QsdGZgqkHrYBJbSHfrU05
+ZvNpV8YcfhkzX6gNtZU5XDDBPgkYn41sEt3aVRHvRAqc+uhczQ8svVhPUsriWnKk2bfw8iAn1xex
+5huB52uVPRfuL7wJxyV1Rk8WhK10xCzFDnJtRUAJ6UtuezrMOh28NPULQnLIx1kF00+uflY5vAHM
+rAf92+NqORZUflKVidqHYmF7bdeNGw3qshaK/0+3grs6rQeQAvxiTdmG+sBP9poBIeeHo2OzcACB
+wTuerZiYlzL7mAUegdiPD+wOa2yfGF+WG2vM9npO+a1ZWsoWceAxpLOyubBVfLyc7lfCo7ma70Vd
+Kl/o7VevEqLIz5ZkaCoupWk7nDKDMG73vGXqJwaYjd8teOw66aELd2WI4cAoFTvPayxMKHD8hf4n
+78riWe2XomUzafZLoMhj5vfYsiwwL3F5O/KUtTOXNNDDVuAwByiCfN65LIjU/Dhn8t6Izkox/Tnl
+9kPqNxqJAxFtARCFo9Xpgba761dTBmUF9J+Krg6B53NEv+0qvJY3w1H8Fnop9S+eEs6/4qUMmgO4
+wrm3aEaLY4XWGejuxUEQ9+3/cxK1YTJIpBeK8Q1/yPgj2mq62RRGcyDPEMbcbFcsI4MKlGggcpHV
+H8hv1XPLbrMi56lax3dB/EkJzJ+5IEnYd0NkXclyQm4d7KUy6LG5I2Quwt0J50dxbqmfR0gWwGsY
+nsT4Kk71NiUyU9AWl46EOZIzONN4Vnm0qq3oNJ5e8VpKTb2g80m5ouw+tPiDA/IA3Vu3VKLT589j
+5IQrNYhrizZnEApqPAQwBiN6D+0BLgsNeQDUn56emMj1ETDgfjukqAQjlGUvAr/VV/+eFHvkqwJU
+Hy6Xzd36Cq4/sYKYVU7OFzh6Ts9gCvblZxbFI1yNimEvwZ/bINKAemQLoji3s1UIs5X+BYqKZpI5
+nZsjbIHLafNjfPoMKUlpQa27jFc4s4GQ9WLBDRnVIuzqpdmdslxc2Q+dwzbT+zFoAAe5VzA+ABxv
+cjPYCBVpys4hYH1p3uwUq/hKkR7QgPE2c25qIHl+6VVS9dgaQ4XnHtVZjFzDk8u5YNenHx8E3lx4
+Ebe3mNjsM51X16ERkGC7X+w4Ko89wvb7jnnOheC0W5ICZQgphdasjff259yEJuhfk62r6bhZH2Um
+2IkUACGxKaEzh55Z5P2rcaSjAwIeWnLHDCPSOJ819/4XQEtPfbZs9eymDwNOg13kZhadSQF8+zht
+0Tko/9k41bNaT2ZqogskrIF9oltpofddqOa5IcE2d13T2IuDkV8/whV87P8Dg6fmFYpFCHN7zsks
+X+IHrRIt7gILXPwecu2LfUZxdH/Cr5WbfMzTnsWWSB7/Z9MLrlEISHM4zC7DlkbRSD7LyXyI4weh
+HNelf0uLtYRhXku5BkJUyysIYDpSHHxsMJ04Th+RZ7s8seoLBeAn7gbsj3B/JUOxIaEx8+W3bjb1
+wq6cc+KqLnvcO2BDvH30PfeQo7YjTNr4wcEoUFZXwhTL5owVc4GKtlfl/YxBXs2E6r6l43svlay6
+vCq58xTvWzzRtzvb6oh6qnoMP2xc8YTdpKma64TBmnFOVE/eGXZxVyk19TXwrokqUliutqhM6acv
+x87+Yru+uXTbUpMA0MuW0Ch6uvcwxmM1hq5vHDVBTAfGuXsdQMapKoqseFUfza7N2eSgU8oaJCGQ
+rmhvDn+MNzh2VyLOnPBwJ+sUnHM7XOnz/rCD99uRhhssEwZ5Xij+FG3EeTYyntGp6Z7ODIazLHM8
+81QtQDrJg2EDJ5RZHHrPbyUQDCkGpLZNOOoJkAD7I0VZRC3jJb8lTMXdKQjCd39F842+FXTSvOv9
+lmEOFH4AEyI6CokzFQCD0TXhTaG9wtzaE2q41eEKF45J5vyQxrNabZXeovNIVZryK+N8ep28M084
+vXp7uJm0bg5NunK6vTIqsxenQZWvXay8EwYLbAm8crDxK5sbW4tZtNeVxPE6ekCbifdxdgm0671w
+rt4wOzAfMAcGBSsOAwIaBBT1C0A3jyKtjUTFASRSO852mKBZQQQUqy721AxhZ26s5Tsue4OHTjEB
+CxwCAgfQ

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/ie_jks_chain.pfx.data

@@ -0,0 +1,61 @@
+MIINXgIBAzCCDRoGCSqGSIb3DQEHAaCCDQsEgg0HMIINAzCCA7wGCSqGSIb3DQEHAaCCA60EggOp
+MIIDpTCCA6EGCyqGSIb3DQEMCgECoIICtjCCArIwHAYKKoZIhvcNAQwBAzAOBAipOP0AVsizDgIC
+B9AEggKQIP/YI9/C2WYbIWxKuqXMD8WPCvqj1fhHmZJ0epCzgEdOR7GT/h2Fy4/wxrthPkj4JqkS
+akQog3pjOFtj9D8QtkOw/b761qsyj17TYlQS9C6qVhcddMA+Ca2NcDhKlYofQMNTuYPXkXlpCh5R
+CNFgQ+PLVZwNZjqoitjv0RLQqBudhTmJSvfDlW2w+CpbziEeRNzn0pX0/Ts7KxykDscOmUCGHKic
+b6FqHoioElcmBp7ae3zdXuvI1x/1Y435qju2yODPpMXEZbdsD5iL07RZyL2vm6lfQbLc37TszDBx
+ZZJ7ja5F4V/j/6/AVLkcqfZxFOnXz5Ki9rQblYJbkkTpJAyiNqi8Gx+zgPGtLWvV6KRD0zmxo6q/
+OmdjKz4v9aG7MDSXenoy6tPAOvAQcQYaksvFZs1FjorJJpFzasfTUfy94JzrHUzRSPzNRDANHG/6
+TgxC1FMNw+iQUY9L8j4xrWsr2JN5tAgYcWz1qZrp4cx0he9cbQeqYcjv7ZvIQbIe2zxdvxh7WByy
+r8hNMe3RkMOM2yuP85JuWipq+9jt4/CrimKljN1ULPw+V9FZzY8kKcEiSPD+KXdJNkrMr77/lUJz
+PGNYpFBFb4natmi31ZBH2VomTeKPpeanN/ghWojft1mGd1s1nD4NelrWATMVquH2Cq6nhKLRHi4c
+KbQsMo+ftLvkDHHtpYenjGHbwEFfowkwn9slsZqmPEATV6caHNITCBbhQmvvhqPDPPViV+u1M1c7
+vwf/ol7IjBlubwzBJAg6f5GW0tMNHxfg5E7O27AyREyvexk0IVakzIwUuP2anPTjPW0vyeePLtiG
+TXNoUe+5UIzpshnLmSlerhVGoB+HBM1yoaaJHay7sdyQbVUxgdcwEwYJKoZIhvcNAQkVMQYEBAEA
+AAAwWwYJKoZIhvcNAQkUMU4eTAB7ADcAMQA5AEIAQgA4ADkANAAtADMANQA2ADEALQA0AEMAMAA0
+AC0AOQBCADIAMAAtADMAOQBCAEMARAAzADQANwAzADUAMQAwAH0wYwYJKwYBBAGCNxEBMVYeVABN
+AGkAYwByAG8AcwBvAGYAdAAgAEIAYQBzAGUAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAA
+UAByAG8AdgBpAGQAZQByACAAdgAxAC4AMDCCCT8GCSqGSIb3DQEHBqCCCTAwggksAgEAMIIJJQYJ
+KoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIEmpyonjQeMACAgfQgIII+Pr+GLKaSN1U1soCnWsw
+4kRoDxPPLNbzv/K+lsbGVk9vXjv5aBTi55FMCXvA5kGvdnQYrQ1KfIZmFVh3PnFQn/J6LVrpLbHC
+/D27wvnOMausJA7uJi6wgkUCkQmXn7kesWhr+bBI9Ci7uyOUxdY53Yg43OQtZbWvQjGe6GiVRqWm
+8NANuZ3c1IT2TmJw5xfvvE4tcHK0d75ApvTa43CkKmUY5A4SyNY4SUVdl9Cx50LEHcqGwV+uVGzy
+kdO0+bgXI66FPKriuqPfayeTmL8T9PimwhOfY38OqtTKHwJ7E817i/B8ULpkRO67uYYJpeK4cIz1
+0rDW/JPG8BqN47Rej8rCpmY1F4hOuFzYA3PAh50YlI2wD2vSSqVPMUe/AtsL+u2Nxl/EidWp/8EL
+l8rBgYJjSl+YjSRV22C/ZwDu/8oV3LeCuwL2SaO1r1tww3WuRAFcCctsemP84YI27Q8Z54P6wM8c
+kjYH9F3oT9bHUAfJUm2d6d3wd+iGbrrxdkLrD5tEQB16K8RAbhPPfrM5rcRlh+Zvn068H/Kc9rEa
+sfJD7ygUBZJ5MSsr4zP4koMZ0xjxAaXRUsURsF13772XL3zfTCVd5fV3wIpJsoXugZTOQ6hjAmeN
+yGMZDn14GyxvwLbGFB0Yx8GAIRDxBvDXkYOqEMocmNwZo+uxPew1H4PMkWMm/yh4Y4V/H9Jmyd3v
+aD2BWVyx7PIJ4cet3RdydHrKSNVBzwrO+y5HKZc7V7aRM0kZgdAJh9eDTlYk6B+ZHd1EawYRlIfl
+f4JydqRkRaya7FOfQ3mLgrz6bdde720XZVWqe9bbsBucbYAJsYvklYYYutnsx1Ri9UYYAbRDy920
+Z6iO1EGF5wcUc0nifXObYJ2x0ldlQskUdThPjZBl2Mk4F9oxS6W5j2llm1hS/vGnFtykQ5NMaxzi
+Jkhi1Mjm/KZJUo2xJai1gtHwBOnlocXZYqJQECabBayA7rLH3pFUhU/Wqkycz4m8dUVXLNHiMIEd
+3sc0QASMF56kqXtzph2zbXBbCD8afyt8WjMzZvO4lEGNM8xi/7C6h45QsdGZgqkHrYBJbSHfrU05
+ZvNpV8YcfhkzX6gNtZU5XDDBPgkYn41sEt3aVRHvRAqc+uhczQ8svVhPUsriWnKk2bfw8iAn1xex
+5huB52uVPRfuL7wJxyV1Rk8WhK10xCzFDnJtRUAJ6UtuezrMOh28NPULQnLIx1kF00+uflY5vAHM
+rAf92+NqORZUflKVidqHYmF7bdeNGw3qshaK/0+3grs6rQeQAvxiTdmG+sBP9poBIeeHo2OzcACB
+wTuerZiYlzL7mAUegdiPD+wOa2yfGF+WG2vM9npO+a1ZWsoWceAxpLOyubBVfLyc7lfCo7ma70Vd
+Kl/o7VevEqLIz5ZkaCoupWk7nDKDMG73vGXqJwaYjd8teOw66aELd2WI4cAoFTvPayxMKHD8hf4n
+78riWe2XomUzafZLoMhj5vfYsiwwL3F5O/KUtTOXNNDDVuAwByiCfN65LIjU/Dhn8t6Izkox/Tnl
+9kPqNxqJAxFtARCFo9Xpgba761dTBmUF9J+Krg6B53NEv+0qvJY3w1H8Fnop9S+eEs6/4qUMmgO4
+wrm3aEaLY4XWGejuxUEQ9+3/cxK1YTJIpBeK8Q1/yPgj2mq62RRGcyDPEMbcbFcsI4MKlGggcpHV
+H8hv1XPLbrMi56lax3dB/EkJzJ+5IEnYd0NkXclyQm4d7KUy6LG5I2Quwt0J50dxbqmfR0gWwGsY
+nsT4Kk71NiUyU9AWl46EOZIzONN4Vnm0qq3oNJ5e8VpKTb2g80m5ouw+tPiDA/IA3Vu3VKLT589j
+5IQrNYhrizZnEApqPAQwBiN6D+0BLgsNeQDUn56emMj1ETDgfjukqAQjlGUvAr/VV/+eFHvkqwJU
+Hy6Xzd36Cq4/sYKYVU7OFzh6Ts9gCvblZxbFI1yNimEvwZ/bINKAemQLoji3s1UIs5X+BYqKZpI5
+nZsjbIHLafNjfPoMKUlpQa27jFc4s4GQ9WLBDRnVIuzqpdmdslxc2Q+dwzbT+zFoAAe5VzA+ABxv
+cjPYCBVpys4hYH1p3uwUq/hKkR7QgPE2c25qIHl+6VVS9dgaQ4XnHtVZjFzDk8u5YNenHx8E3lx4
+Ebe3mNjsM51X16ERkGC7X+w4Ko89wvb7jnnOheC0W5ICZQgphdasjff259yEJuhfk62r6bhZH2Um
+2IkUACGxKaEzh55Z5P2rcaSjAwIeWnLHDCPSOJ819/4XQEtPfbZs9eymDwNOg13kZhadSQF8+zht
+0Tko/9k41bNaT2ZqogskrIF9oltpofddqOa5IcE2d13T2IuDkV8/whV87P8Dg6fmFYpFCHN7zsks
+X+IHrRIt7gILXPwecu2LfUZxdH/Cr5WbfMzTnsWWSB7/Z9MLrlEISHM4zC7DlkbRSD7LyXyI4weh
+HNelf0uLtYRhXku5BkJUyysIYDpSHHxsMJ04Th+RZ7s8seoLBeAn7gbsj3B/JUOxIaEx8+W3bjb1
+wq6cc+KqLnvcO2BDvH30PfeQo7YjTNr4wcEoUFZXwhTL5owVc4GKtlfl/YxBXs2E6r6l43svlay6
+vCq58xTvWzzRtzvb6oh6qnoMP2xc8YTdpKma64TBmnFOVE/eGXZxVyk19TXwrokqUliutqhM6acv
+x87+Yru+uXTbUpMA0MuW0Ch6uvcwxmM1hq5vHDVBTAfGuXsdQMapKoqseFUfza7N2eSgU8oaJCGQ
+rmhvDn+MNzh2VyLOnPBwJ+sUnHM7XOnz/rCD99uRhhssEwZ5Xij+FG3EeTYyntGp6Z7ODIazLHM8
+81QtQDrJg2EDJ5RZHHrPbyUQDCkGpLZNOOoJkAD7I0VZRC3jJb8lTMXdKQjCd39F842+FXTSvOv9
+lmEOFH4AEyI6CokzFQCD0TXhTaG9wtzaE2q41eEKF45J5vyQxrNabZXeovNIVZryK+N8ep28M084
+vXp7uJm0bg5NunK6vTIqsxenQZWvXay8EwYLbAm8crDxK5sbW4tZtNeVxPE6ekCbifdxdgm0671w
+rt4wOzAfMAcGBSsOAwIaBBT1C0A3jyKtjUTFASRSO852mKBZQQQUqy721AxhZ26s5Tsue4OHTjEB
+CxwCAgfQ

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/jdk_jceks_selfsigned.p12.data

@@ -0,0 +1,30 @@
+MIIGqgIBAzCCBmQGCSqGSIb3DQEHAaCCBlUEggZRMIIGTTCCAwsGCSqGSIb3DQEHBqCCAvwwggL4
+AgEAMIIC8QYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUUP4hegRsRe3D47D9wFdtUJPjXWoC
+AgQAgIICuFyN2uPW1mb8YCey7P23VZcfAkgCViro1vkX2cMaqEQSUe182bGeGjCDMUM1ld8XYqCO
+kMMuCeff20A9En52Wpm0zhuvcaaKxFR9Mn9X2/bNJr0Oig+P7SGTO/gDI+Z7RkhjJWra6V2Pipf2
+dDBYB5dTqiSsdBEZfxPUvXr9NXfYqM+sLwv6ewTVcS9dcK39fKVPBgDS8g3KGaoFSoQkEOMm62wA
+Yh8dbkJ2VFphCCKNYtLW0Z2dIRjhfLHpfiin48cyscsHNF/Q5PwqZRCQ8hLgvDdeAglueAkufgRy
+dKEKfOsdBKpUcVbnKE1zcWg/EK5oNadC14BlBFitVtL9bSgvxURV+ht+jdQKSfsvIVseW8TiqFLF
+RAtxB+Ve0CdWGhcdlDSt7QAxlr8pXrvHwOqlBDv31uueivLI20sfXrvxhSRm5mfUuYZQGith2VGy
+4nGDbHGN/Wp2gRS/FZR8mvKgQVZOshBKKaYxmOBxAtAPnkpKdcHhZ3ZMmTuQ4gWIDcQG4QkCTtpu
+kcnEdPT8MturNaN+PHTG0La0zlX92+kqj5rnpNzBfsBNILkCTqs6Y5Ltknt+wmYQokMhoLPKVMl1
+uuV2PyQioC6v7fold64k9RK2t9aiCgK/NOVaG7imS/1LhFTYeoMiji/pkxb4dL7rSkOUup+v7e9D
+ltP8hf2rLRz/QjQcps5+9wnkLPf/af/zffYZqnrb4JhBzya6Y837ctq9G9ZwBhQR0eOKuQsoDE62
+FMBTmvztspjdc2r7I+7/bcZoxDA1GVq6x+ILvsHxPkYbpK+YimtDzdFmly4QZ5t4ePBN6JoSkQnt
+M2SW3A24K5xY8fBppPnFbfIhitReM24sVFW5K1bx8UmnyY47vYaQNFQy7fw1q3IaizXTguB93Dgq
+M8h4ZUUBQqIX88H792fjYoemXzCCAzoGCSqGSIb3DQEHAaCCAysEggMnMIIDIzCCAx8GCyqGSIb3
+DQEMCgECoIICsjCCAq4wKAYKKoZIhvcNAQwBAzAaBBTCjW7ZwDP3oZ7PWO/Y+KkqVWjAZgICBAAE
+ggKAYqCnxT6KcqqKgzicaVUOn4xxf3jyOTpLwmExI6pPXE7Q6/8iCnikVuVYgb4PynUlxeI8TGqr
+N9rQXZF0c3JJ/jDULWpW7xUqw6DjWUyO964+eEd8FJK8IpOaCVk96tCSVFVIqHCJbeQwuSsa9Hcq
+kLY6xtkGbgCJxYmXGsd+KsasrkybJakFQO1Di0iCzABpoLF80/OYoZJsoFZp4mhKuERoa0zW3K9G
+fZXzrcFN2vcYRZdi6RT2/R9sxUMA1bOdiP4pKvEiT1QrFfjoz0a4tRbL6JEYuPVq4+xKF63p/edl
+zFTmrz2nqwC4L1VTpl4kgfIqeaw8vhPYGp7hV/Ve8h0tQDElH/oCsdpaZIPMnzwpKjpyPUpZDhjA
+aF1I0CtYz9Tx7Wcslaz6Lq9WQGDNUWggxorkoQRQVs14Jmnhy71qA8mY3CZIzpFffl5CGfhyGIcb
+om1vSkZnOK5afCudxUXowZBVpys7MotOLjXOO3QjMnmkuTMIeD5gCZx5jek1t/wMyrI7PZdHrZRE
+EJfUlRSRq6ffeePLgJHR0f+EkODSnlk1/lRXj4qooG1AlKlLNJxxSWqBcOBGriopGnCdVj9cQkL+
+c0SbEOD1nXoduV6GwYlRvzjyF661z1HdbyiaBL50Hj0sbhSRn/wuTZE9Z2aEwLFoMtZaGTYtjbMi
+ttB5y7PeGZVA718C4CPynyCQNI7tsKwPLuAYTI5z6P6I59YzjcoiQMTxML5W7R2ZXASqZB0vraP9
+rOm3URCG/bzjQKIeAiX9I5VMvvq0pRuCVBaqR0KlDPy+WZoVwkWQRnNzXj87x9T3phLRkFwxSpSs
+VlvGCExDnw4INW2u2ZkDqTFaMDMGCSqGSIb3DQEJFDEmHiQAcABrAGMAcwAxADIAdABlAHMAdABl
+AG4AZAB1AHMAZQByADEwIwYJKoZIhvcNAQkVMRYEFOYIZ9PqvN6hlfl6g8GMzQo7XZj3MD0wITAJ
+BgUrDgMCGgUABBQtKrQijA4rEmoRg0DR9g4gUVdjzgQULlm+rQqDvJ7th6v7HBOlOlMwoJECAgQA

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/jdk_jceks_twoentry.p12.data

@@ -0,0 +1,69 @@
+MIIPUQIBAzCCDwsGCSqGSIb3DQEHAaCCDvwEgg74MIIO9DCCBoMGCSqGSIb3DQEHBqCCBnQwggZw
+AgEAMIIGaQYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUaHSG4jhu/7OMwM9JSl+8BZkXS30C
+AgQAgIIGMJfHzGw/x2vtIsN91neZbEGRQyrmItZnrHIjaNtTaJDyxrd5Qp0aGxNrVzUZxxBlqntn
+sVzTKvtH5YsRBJjKrx+kX39Avmh8UWDKi+iPIwjpqdIrk5D9DEg+zjn7OFwL5kS/wwErTFbes/t/
+fobuWxJZjEqzbQNimbkdh05jCQTCHozz+VoBvkeEyssmZGrghgi5iLBH9Yrlb85YsQSfcO91Dl2/
+LmtnCaMKDQ81cwofRyptbihVelIRSUxLkskOiogscBzJM68ihvNSsd8QaeS0WPbfw7Tic3nVLpUd
+wxcaVud8b4OAxxyGL8rRnWzlAsZy5udKv/790DyaOmqlA3n4wAayJII8pRtKhXsHhoA5I8+quJS4
+t/Uq/n35lWpczI/5mKWAXEC+LdScVyGC+vXxhcfB+EO5UgfLnus524UbwBA9MLV6jlByUZO8Vj6t
+cPcnRaKfxlMcfOPGLuzLJh7/NwOGnSZTtdHqEwQkV7GPV3qgZxHX2r+LWIQ1ZNuoCBBgF+neL9MN
+J/wKwXQQtfyRIPA1do8HM1SpujvTlG/ABOiTr0ZDuRW+AkMC4acxbV7G2Cllx84dRJiIQlTUgJy8
+NYMJGAGH5gpJezdNQD6wimRiEGIs1yIne2Wc9dPE9y1zKjpbeeXoeepWGM2rYZMJVJSufq0rRKr/
+3C5+TyBu0zLigiMrNAhqakPLV4ma3ktpgtigcLAa1eS2USpy/eJboGbRqUFobFYuQk9td4yfdmJM
+0sIpeRomy3SWypnJ79NOewgOJKba4Ye65kVHNz2jAFL5R4z7ll4Iqn5h/ylIi6RqMMMWf0hBr9yD
+bV5qjuwZGltv1zqTJ8cPjUWMk+UmbZXcsA9W7CnVdGPoWYCT0SW7IkUYQSs0QW7VTReA16KDSoEL
+3ZRIGl7KeDqGVm6ZH8zIE0lOVFY0R/2XuIcPc2DNV3UWs0Puous+j5kQgPjF1YD1r9VT6DeMPECZ
+HzBJl6a4yvKjm8hXyCnYPnxbeAZJUXOmka/ST1KVUHM499/Lii8/emHTFC/28WkiaLHOUtCegJgx
+Kp/eq4RAqYbHe5oUdS9xBaxZX97T0o10udqT6BKep6K/rBKHJxXp3SMuCtBIrcswlojIMc2p9fwF
+WVKSZz0zT8rhyepHI5j+IJoTauGYRD46AqSA+6EXWm0bO0oEtBuFCOVeBZJrJMseNxVLfGJOZYtZ
++9ixo9m1+WBV1kGxp1RAnTWAidd15G5sxZ9qhKK9iO63hiWFGmuOiWUb2kUpBOjtM/IRDhU/Q7y5
+gvbnhVbTZR7hr+gWyIkpfOBQG42SMwTuqImGpY4yFc7H6NZSYead6Fp4GfUmLLlDG72d6Ue4N+c8
+K3DTZYL47LFdXyvMNSuumRQLx+MGQ+DYzZ56uoM9R7B+34Joe8BeJa7bg0vA3Mj9CbZ3+yvYk8TL
+UU60BRda1AHwiSoRrLqgeJBZh+cyQB7e7EPcTO//iTPpFVJ8yst9IGn34AndyYULaPpnljMCiUhu
+X+zVATaxDMGwc++/95VHdeGRLhb+C5qeSqcPrIdV8XKCd53lgrAoZD1a9nym/mkCLQd+zjm+IE5y
+pnxccn/LoFrBm8yf0A35rm+A4Gl8gPSq2GYwu7zfEjXFiAlYrCsc5trQ9YNSGOzbD2BMAn5xxrob
+pQliw72xBt43e/VYCWwnLpgKqOfPfX18moDRK/kGeMPe/xtZ4rOiXbm9SEuT0pIFIaoMmilEuEI1
+bP2QC/GN1DgBMlV+FRAhWJ+X/NjHjB/TKBMsESyp3ShhCOum112eqoOxk0O4Ob6LVA6Ay6YPtoVX
+WhFjebHif5UtTtqd0u9jIU0J9UURkViLEzYN7/3FLIrlmntW35KhEYwCW8FhuXfFfbMHunw+zNoj
+ioaJtktg4TqRAXEFrSLIFy3VrsMCnNol100/EU+fqLtJfB9tvAx5pjYzUa2mfFiaoSliBRYHFy/N
+BzaXJ2DpFSd+RRbUsrLju3+vljTqtFEkhHFhMG4lgYxTAscqcoUAYfecGGhqL/wYDzh8V1WBDBGq
+9UsABqQd4EoqUX01/Driawft4mozRmxtWnTmrvXSRPT4CJp7zCZeQMPrlMKS6+gXDU5MljCCCGkG
+CSqGSIb3DQEHAaCCCFoEgghWMIIIUjCCBUcGCyqGSIb3DQEMCgECoIIE+jCCBPYwKAYKKoZIhvcN
+AQwBAzAaBBQ4eGcrDBrmIvtj/pYR8qK0Qn77ggICBAAEggTIttxjYbbyyDe0ikO7pUOYY2lCBLGX
+Z3Mx54Jg9fYmSCGv7aWubwkixV+tlfWjRfGrpaMLNfJXzcbkvso/H0Fyk1oVWLkhT9DrPWRjMYWn
+aZo91EKMvuu77RPzXuEVzNc5dSj01qEURgokH7WUh7Hrsp6Ssuuud+d6a6tCAwiCjLKZQiLuZ1h/
+uGalDjtM2yJVo2bZWt6puFt/H8AMLdf8HCREQ0Cddg2PG4EyQiUuzIQEk6IddPKhguWR350YCeoU
+Ywx4vU6eVFYZY0DX889rXDi++b975GKoWGd74Kkt+CXrOIuXHCzmeILFouc1Uh/wwIYkgT0ClDnQ
+749jKxcFG9tMkqE46POK8BLiy9V2FioKviumdiHVAMOah/sH7Ykf9QY1Qr//fHmaWRz1j966jaow
+L9pdQ4v98qRSa7EUJ70AD/wK5Xajtyh6QnzW/OPq9HGIBhcy+PjP95S0MV5TG7OIXBVwgw86wp0E
+ycpc2Yr0LmNQP4PJGaN0ECQm5/n886tmyv6KAMlxrzziasYymUNhY4ima12rjVN9wcNxq8Sghq4k
+minW3dO4mAfU9gbvZJ1RqPFswBFm5n24zJKjzrO2qlu7tLx6Vkck3vJI3UuGWWxUBsVoHd5m1ZZP
+5qrJHeEXvQuxXlyKaY7cNhk0yR7EDYC5SpUroTvVzWe1xYpoQ3ZyDKxCQ23l6jaovHJ3kQz450z0
+W59wD1078JlpTwYHsx4TBilabTcZku02uz8PZrFdPl2uJgtkgY0YyrQfYDK88+BvGWl23mbpRCbb
+9pO4dxFW0lqJ112EOXECbDmkCvh43NWvr0VqsJUM3xWsKKb9xpaNLSpcK32/BL+ZTQg7ec5/xx4Y
+FN4yHTd6YSDzKYHQI252CMImL0HIAC7qOOCftRDEswv6xKIn6TEykCyr08RcTsnjfjzH7HIsjhxa
+anv+xXosLZfCN9/RiRXfUb2ayRF2fdQsTNepp3ECiZlhMxfKO7aSwXnQzFyB+F8axEOFBLMEmJxC
+7ugz5qDqUOqiR1UNQfpz8fWXGZ4e+GLr3PblVR+CyGCDibZedaeDVXGG3yx2/V7DsYUehJSDz2DB
+C8KwWMHetjDlAOXbaKcZ1QhS7upnZhTCwF90JllIZtfKPS4VP9uyFecMc0Ocoq1zdB954nzX2Iyy
+t4l8+WWHH1Zb4EY6eLNNy1/wUvngGXqyrUDAocZKk/G8Hy7UPXrSWo9hGRiAm86WeokJjMKHgOH9
+lFg7/B1YHl2rW+E1JCAu2xAEJM9HB2+x8OFL/VBoxQLHr/flgGwCkOD62Oy/psUSL0ZQ+hM7qElW
+y3+KlS01t4icC99/r4oyA9poAx0EVfSvffi3Nb3Et2ryYRG7kmjMoxvDVpmrAKopnePSE+GAjEbG
+FIOli1ewzkOjcLZrdfTpONWfUKJB3Y6AOi7aV4N+wlrMrgAtlHSuDZ4csr1SnHctqpas37CkMg23
+KCILn2XktsGXN5AyCmPcmZI48w+8uO4OTxOdK2qIbXrlNaL1bFlHTt9riehDyHD+5LR4zB4XL080
+IA9XkbyR5OxdWlcShjPboOvGxMZeoTwmTYE23kCgh0zx0jLhb3bo3jnu6K76h3oPaRikYA5KBob3
+L51vXtrFMTowEwYJKoZIhvcNAQkUMQYeBABjAGEwIwYJKoZIhvcNAQkVMRYEFAxeTobq6DehjSbi
+ylxISkcqQqH6MIIDAwYLKoZIhvcNAQwKAQKgggKyMIICrjAoBgoqhkiG9w0BDAEDMBoEFAZ8kRRQ
+C5cLg1CRiF+Lgzkl9aD/AgIEAASCAoA2KwrF2adzCcInax9pPRso6j4h2KcNgrdsxCWhz+DWBRCw
+pOD6uitzCdyeLEMXN95Roqf/XxHZ6n/VKov0U8vgvKEU4RSeHsUQ6DqjrL7HpEhbM/lhfHj0vaWc
+tQQCTslHdwl4hWajN44Yv79zMHjA75/n4JAOvtnsyQrF0+44/yA5lFYLZyY4ndbyqzAPo0ZQD6PO
+bT8uyH/KbUAi5Etri47ibD1++EDltb45ctO8xA0rFIV25tL/AOG/YajgLC/7QBLTNgvMZ7F2rV9y
+qYmNCTdIDzaUIWg4+0qidqVeCPbrHHkqhti4LwOIQhBXesSTuBl1xafwzDeFQpADUe5Hc4+TtJGj
+gUT2gBR9dGJI6Wj5MRM/WGT/78UgbpYxG1Q7cZ6quILuzZjWQD+guHSCrhIK42dulowx1aTaela/
+XYcR+cRiQtLcmr/0FHfr99d0hJ2BSQIp9IhCsAkU+W7Py39jTcgU/HepzvpsLuPOxI+JL1Rb0llq
++uKaw9jCAy8yIGgplEXg5mhSPXXSDO8k+9CL5rpJvUjQSnLrhLKo2i22p/LIEK6S2uVnD6EdRMYo
+J/Vpx2ujqkPZfM/xsbAh04frXLGa2uAISDig+DH1RWlB5jNLRVbfgZA5/PjZyt6gz4lJigpXAVv1
+Z13EbEKrbv+CIUJOC+spz8YMH/37YkTW382gWrZkBgmQvZ6Gu5EeeFOIxXRNPseHyg+aY5vjQVyg
+V9RAg2sUDwh4u8JANq45dKEFUZfD8EqhVKyd4DuJ38AkxM5SQblQ8eygx0/bAVYzwN8ZRwxDB7Ii
+VD+LPthBp147NBgBw0ssNJYQ4GB4gBc7x3UXnyau5aDO9n6KMT4wFwYJKoZIhvcNAQkUMQoeCAB1
+AHMAZQByMCMGCSqGSIb3DQEJFTEWBBTuNf6QntPPWXHkQhWW+uEJ8d85XTA9MCEwCQYFKw4DAhoF
+AAQUk5iGX7naSu9IN6Kw+sU5Gk319ygEFAwa1WFGcSE0mhaX1jNiYWZtqQnSAgIEAA==

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/jdk_jceks_twopass.p12.data

@@ -0,0 +1,45 @@
+MIIJzgIBAzCCCYgGCSqGSIb3DQEHAaCCCXkEggl1MIIJcTCCA/MGCSqGSIb3DQEHBqCCA+QwggPg
+AgEAMIID2QYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUt/45tX+NVmWByhUTxlYXZtkG23wC
+AgQAgIIDoHK05qRAikt4Qf2pBGjBl1KH28QZEqGHygCfUpdGyou10RMbkeJ254HBhdRGQrkhLva9
+RPC2TDQuFY3RWqy/we6TvhWyq6T2rW7wPysAL7Me9sJLVvekpWXOpLz0iye+/4qaJZCFsftnUKMA
+FttOkAfVr5DvfZjJYCF4AXnlFi2s5Vz0cSEyiOarrnXpGv0cnhVBkWUu09Afhvk9WnLoggYUIBeg
+w5d/RRj7qM5db1GzYAO+ZXaMGwoASbnZMjFv/drJFqvifToOkn3DHX+nGF55ra5JNBbzOckGplWH
+HCqqirmbguGLGf1RLoPcphWC12jQgEOnvoc+u+lC0+R967wFWhgGmC49UuCUVJSlkEl8hqwCYYb/
+T5pGW5K9sMHzzlPFMbCN3YlG9F9Upb9jFduOXXDi2SddyX3kFTRc5Q1CRea1fSm7mFdKIPr4W99j
+hWT4RJTVZzbsWTh/kNUSNgP+cgKGxthqaLvgiMnOeoT3uldQ3thvSrzJKrZWi0ykk8/sV4hpMwbn
+k3N24yDZB+FL1Buw+MmJ5PQdCxEoZa/Q6JahqWP/Kz/LSjOOgk4WdrJGx4cUwnrqCIgnHK+FAVD6
+ibdW2LG5w67FjMIGPS0nuFyZ/pwKO2jbgRU3CpB2XVwBhUZmHXgaJH7A68jGYSaJWc5ViGcJyeRU
+S06FeViECnRu71P32NelWArbZ0XlKXKAwHse+kWUi8xuttgXas2KQ8Nz5sRjv78vqpC9tjDSkGUk
+uLhJwRagJHLXltOYbXgH3CAhXhk6yTo45ytgwOV9GWs6RCOVZaMM942yMwQ2RR33MsF+N1NFI5bQ
+5PYkGy0zGsvjqlT9iNE+u9ZcUMKp5EHI2BLrs6+41gYaaMTddB/bfyTcf0XIhAqeiOlz53YgbolO
+i6DudU4lWyvz01T7zcl+J95s03qf7yaCGkAhetNg19ETxmxQSF5yBLZPns0CA9M1RzeM7qelj7by
+3OqF8lxl6H//ZBuPxRNNuub7PwctPULDieYNWZA8kAn22utOVlCBsZHZ/CTUQCRM/gVm3QQjSUMw
+oyK4Ijf2LywzHVuyCkPXAKSHrxyk8ecTwSWDmzER5uqgevBK47oOXy+nuxkC9tkeLg4ZqeWrRUGS
+p8iIDNTaIrlVJ5g6s7hOgHDsPFh2sw5tGg4QkWw9SWcKkySCg7jg2Nh+0dTMzTG+yFBx4qbG5D9t
+P4rtstIGeyZvjEW4DEiS0WCZe6SFcFgwggV2BgkqhkiG9w0BBwGgggVnBIIFYzCCBV8wggVbBgsq
+hkiG9w0BDAoBAqCCBPowggT2MCgGCiqGSIb3DQEMAQMwGgQUadAw0f3PDGS5mrzMd1JZRDeJ10AC
+AgQABIIEyLWepBjU2whnDqOcH8u6Cc/+RAjsz/laSR9SkSOsd1Kn13DEFvfTiwcvkphQyOFK3w/L
+cv/ZocA9Br5FQdMcgmUladwokZP/0f9TR3iacf7GVAI7J3DEXiN9fRpljG/oU/+YoHEjo1i8rqEK
+U1AhJ/+t8ABZfrK8nnu6mD0vJDdgslQeky5bqzYHyvf4C1YKYXZIhG6Xcl1aCR3NAZxmhlBeYZeW
+0doiPeHj0GImWoA4ExMrNkNTDwcDXEpPzpdSWuM4DuoaWFrcFJG9PFFrN3/Rs1gu1UP+ZtkGoBNA
++RxehNGCLMFuPgFvnQYRvnYhuYTB/mvbkOyfUSiRr3CpdblH2nmdsQBwUUOh7Vp7uv8pJwoFui4A
+09T7AG4sK1YwUU/d80cZoNh52LdEBddNWrVINPxi4Pb5id0bvvr/CbjZCPwPqrFw6wNAmWolDac6
+kibaFQku3aWX3W6zW+J+zM2TCpMIGcWsiMNgBsrHL54FET2QUk5E406AGiNrMTMB3yHDV+C94KU/
+LPSEzuTUXmpWQcYrjr02afkmkwgSysQq3IQA8LuMzapGf7fuA/RxSILuPcWw7lCWy4HmVn4uiKLo
+tGyxfWrnXZG/9tMCnm2hxpbmP2BYbYck/vgDCxDhOmptHM7wUjs3ujhFmwp5x0A9BAU8WKuJFdPC
+aZ8hjkgvPaVwtFhEScELSQh6iwfHftAS0jb1NfvsaPou3a4KQ63pvMuF4Qx7b5Cq4L2aBqhvgRqp
+kinAJfAVr4vRuI199KnADlH9YGmOdrOVJ07ru9dtisH4t+zo7j8lqqcqhUstjUVcmFf6LlYPKsOG
+yPsaMTg3DfIYhpWlV2rd9DXBBzNgz4KW6CEujxCSBLP3VSQQgA5xRBROPw/uBq6isBBkuWZZy9z3
+GS0J/YtZY99Q9BfK7n+vythB3aciecySnoWYS1UB6m2b+F4xMmab2P8GhzzFsyUmAzNy1mQHGdYe
+eHBKA1CunIvICiv95XRAplBSIh3KHEeaCwbKVhNJYmf/xTmRBiTtVEgLKpxSQMVh+Lax6rmvVMcu
+cb3klVE1n9DILVAkuW3uxScLDS1wQyGWdGu1/2vU3yojus/kw868+gMzvszc704XDviwgQblYe27
+eOdpRB8oOK63o/dY5cDSdEYhjYEVlOZ3eriZ/FYW5WHAbR7PuM1EYfVUy/5XGLylDutaA/0klfu4
+Lhs4Sptdt7DifBI6R1LAcXu7REbu/r+Xhxnj6ik27oMitYO2PG3slnBEzj37Hc9EOGvBbuB3Fn28
+oRs6tAFilysj8hrJnHVFbA9OiNa8sdFj797n4lvlYv2ZMMUvJpg0hjInkTG0vkRhQbzszd0URUK0
+hpGVADFlwsfAWKoNAO2YoBmNIILSs8Sgogf5yuRvZBZPKRxQffGp9UjRpe2TiM2EZfHhgruyvnR4
+GfZfY3oHCtWA3DmQZYfQtwqeo4N4gA0Kwr34VGSFDMJxmEIuwWZYRL1sZXyGUZjZWYhtrp25vUn5
+uXrzhsi4IuDbAV5QlBi3NAC1uRfcZrn9OhGT/Q7LK8M4z2WL7gui5ULq+a4OvDFdcLdej/obWRip
+X20CW/bWzctM2dLUFWwP0xdv9wHAMDpnrOHVWF5gRaWjFjFOMCcGCSqGSIb3DQEJFDEaHhgAcABr
+AGMAcwAxADIAdABlAHMAdABjAGEwIwYJKoZIhvcNAQkVMRYEFAxeTobq6DehjSbiylxISkcqQqH6
+MD0wITAJBgUrDgMCGgUABBReCaXcoIK8JTMwigEZzYPfmYG2TwQUZCjIEn2XZ9poivqAwEKWWmB6
+1QoCAgQA

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/jdk_jks_selfsigned.p12.data

@@ -0,0 +1,45 @@
+MIIJzgIBAzCCCYgGCSqGSIb3DQEHAaCCCXkEggl1MIIJcTCCA/MGCSqGSIb3DQEHBqCCA+QwggPg
+AgEAMIID2QYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUdVPZ1PqmiHSzutary6nkrMZutmAC
+AgQAgIIDoEk+DNlnRZfSrsiS+4naiYEBlkWcbxVIxDlsUhkj/GzhyAl/NzgHT31YhGBPADFWxLsf
+dMykYBWbnErvqAb2Ej/2q3l+gXehZ8PxjeXYwQ7uuXunwxrq8AayX5ofZyKw8RwDRsUYvIm89CRN
+FWIwXThrRWHAMaQ+ySINhspOeq2liuracnzzeG4EoZyE4bmONMMbsOJOTOnQZsc3Hw+SC7+vIV/x
+QnQQHY9bhsG8nxBfLLxd+JKerXRAeobkeufYHm/Q0iFpRtVad0FkMyWViyBjlEaTUyCXvZ1f27Ub
+hzPPdMj9mew6flpJorqemMKFaIMiBFgNvT69BNto9n2tgoU2mGkM0r9pqT51F/TsdbVouhmcqi+9
+NWjJVO2bTvh3s/Q3I5Y5zFt0JaqznVVUMQMfR97RNdBWJmdWjTFaDmQwau2zaKboeDsDpgl7cpko
+t57ifS5+1XSy7Vwh3H+eTaIrmMeNPpnAFbfUMIx2MHMqzG3tQg4zXn6L0+os2BkyLvjllxWZ8ElG
+tNz0xJMde8afhnRRwLO489Pv5ZM6IW+SLVVuNHMICpALQUxKHHrVy75YbqGoD/cmfvHgGcTZBAL+
+TCCtppdexzH4k4cB1/o+rI0ksKyhIPpNoLRnrKZTxEJ8MWYXvPkXJhgaz27fxAdVX/tkaSDSgz8M
+tp9WgUUx3oet3vjLsMUQguUTdYfB0nSpZ33F5ZNXysxLsUYH+zYwcCyQi2s5/CI0tO/SA6onQOFP
+Pt5ESInsucCJgTGAmY31r23BgvUGV0PCbj8oePAErgb9se5TqPyRMeDa7iPhB44Pm93bxr5BS3ua
+zTBzbgsPQNAmlNAg9LKWj+a7NU5s6Rv2y3pAH1y9YPih9nlGOoeTlAn7J2Um4zfrCP2GWpR09ODt
+ZqElzhbES+3sr15G8u86G0n9j9m1NI8+SlSKj8cvsTfM5DAOGWyJ91YF+GtVg3kGQCHA9J6i6FTt
+dPdO5eVoKLck61vGHd3n6xkmZtkTI4Rxr1rJvNFzwjiFadIKAy7PffLVlqUucgHW1kF9poTBg3h3
+2Ia489bsahYdg77xEzuIvVIziOyqdYDpOSq7BKCHaVnglRBStPUMh9uA6xZOFOgbJPGNfJMy4LdL
+PbHVXTZ40iqgq1tLBl/8y+HUsFqanBpiuEa6taZ1Da2AYp+Nij8/x/DL+7/P9h0r0ehFvY6DUjcR
+pFLIchLAG1HeqK9yt5ivQJG+f35oU5cwggV2BgkqhkiG9w0BBwGgggVnBIIFYzCCBV8wggVbBgsq
+hkiG9w0BDAoBAqCCBPowggT2MCgGCiqGSIb3DQEMAQMwGgQUUF+8eSim66TyIYKiuOA1HaaiWxsC
+AgQABIIEyHbI0EKVq0rIxePLGQ1E8v8mMIFS1DdygYqZk1DGnROuF7tvDJLZypL56RQ7WSgFHG36
+z7nUteL1VL/eDtVNgPQYE5wM1M9wlMFJjPeIe67DcnHq/1DXPMHF0bCeuPRNxvh5qYQ5Spk962pN
+JHhxoxZgU8Po2uWC2+YfAbOV3se4BlAWQtxRE5dklsTr2BuydagNzC71crRDqIrhP5DzrzaXVkWJ
+MJq7iqfX/C7Zwc2Sm10/dCaS+7O11I5cz96ChUJv2CDT6lMvQ/QHvSd4+igKGUemYQgi5LpFUFG8
+0iqUxhJ5BWHT7A/a9L2TXzxg8PfBlUbSRAejG5Bg9IFuec/0GIvPV9UtnXU+vDQI/3XMZG38uQLC
+Ro+eIClTYUG0mw84XxfiYNNkIbT1CTDNNpXV07sEm+YzSEhmHjuc3y61WkBlCvbyxDEZDTEM2YuO
+ZdxUnuy7QdI/87uvyyI3TSWSmKYdPqcjvJ1puhfvg0cDJTDArDTuqM7RilH6Wig/tRQSxFxVBKo3
+Pok6ZZSeXyyTm6S//mEdU2GRFh6PXj0Tw5XRa3KfgxMXL7lbHcOsP/qk8dGBiIA/LaodPFLfcWQR
+aSerAlzmFpXt7+Tm2v4HKTF+C9iPv2bj4RmINQ4PtAgpPfbIv7PCksyVlUWzi8l6FZwn6CDO347f
+yXxaZIeAtMUn6IxmPMm2JZyJE1iJqrj6YVhGbRxAdAQ8I+vSLQ7upcju1Gysv8w3jO/MoJzsRkV5
+3GYbq06rkG2gAmk1A0fjAP9oVLvyMYXRcrKd/4aKdK4xJkUAxB+UlPp998ESqqZ9hWfU6YM3TCig
+7rp79lHJW3aM31uljLjWtWbJ/+Xr/H7Vu24PDjuN8SQL+IMWSP3yaApHSQ7YGNXmtoDID/Wc8PHT
+T/1LL84MGmwIp6bXbvkDgEWB8nO7mm2V9y5GozOzgk5fQlH+1/6WjZG6iD/knTkMDXv86m4P/23/
+YfUM3CbWVcstp2NjV1Kdc5ouylhrBe74ZIS7Wup53w6nLJ3LYi2uidyO2p/dxbT6QeE09Prrh0lo
+2gkOPh32F0utu6Ugo6Q3DiriOpY97wpPJnBIVTeg6Er1A03lbtoqTMqIjLmQoWu01POZuTcyrG2w
+JE356t2ULKtwpUUc7Sf7tho2DC4GR1bqF0xT4Hv47pD3RaAx4WRRRVE68EgtzrIlsY26nayH5iDA
+ncm0+i3k7DHLXm6EhcoIgjvEwEehN9Boc2BbuGrduI5/LN8vUtKhVloejh8Hr8X5z9qvHsUq3Thj
+9VcLBp2HOgnwBrVodhrowE0W2fZ4+OA7GfWw+lVFuCZW4C/V3Ubj6iyh6V/Y8wofZlM1Y0H5tKE3
+0fUio/bUxwyRM9OZBin5j528FRvCZH7PsAjqxztW/VRJ9TDP0+gFFdJMhAfiekXqpSpRjPhTaSnw
++0srFo9NGWMsYq5DsfKHbaoilaXu5TUp31+GlvohouLe0ETzOQApknHKYpnBtLy5E+WzjKv8DCLX
+Hs7VpbSIDtzEK1l2F1T+4HVDBD2snXp1F37ytZpn6J5Fuze8LrJcLXjahLUGwXcBDB+LbVYuMJCH
+yN9zYhSEv4PbiRq8GoqCW+Cw9R3eW87jRdPwWFewx+5MLzFOMCcGCSqGSIb3DQEJFDEaHhgAcABr
+AGMAcwAxADIAdABlAHMAdABjAGEwIwYJKoZIhvcNAQkVMRYEFAxeTobq6DehjSbiylxISkcqQqH6
+MD0wITAJBgUrDgMCGgUABBTTmQMHbBSL6ICCYs/pyZ2E/j2QsQQUKqdbNdUe1p8Hmn8PmLHFQxRr
+xp4CAgQA

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/jdk_jks_twoentry.p12.data

@@ -0,0 +1,69 @@
+MIIPUQIBAzCCDwsGCSqGSIb3DQEHAaCCDvwEgg74MIIO9DCCBoMGCSqGSIb3DQEHBqCCBnQwggZw
+AgEAMIIGaQYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUaHSG4jhu/7OMwM9JSl+8BZkXS30C
+AgQAgIIGMJfHzGw/x2vtIsN91neZbEGRQyrmItZnrHIjaNtTaJDyxrd5Qp0aGxNrVzUZxxBlqntn
+sVzTKvtH5YsRBJjKrx+kX39Avmh8UWDKi+iPIwjpqdIrk5D9DEg+zjn7OFwL5kS/wwErTFbes/t/
+fobuWxJZjEqzbQNimbkdh05jCQTCHozz+VoBvkeEyssmZGrghgi5iLBH9Yrlb85YsQSfcO91Dl2/
+LmtnCaMKDQ81cwofRyptbihVelIRSUxLkskOiogscBzJM68ihvNSsd8QaeS0WPbfw7Tic3nVLpUd
+wxcaVud8b4OAxxyGL8rRnWzlAsZy5udKv/790DyaOmqlA3n4wAayJII8pRtKhXsHhoA5I8+quJS4
+t/Uq/n35lWpczI/5mKWAXEC+LdScVyGC+vXxhcfB+EO5UgfLnus524UbwBA9MLV6jlByUZO8Vj6t
+cPcnRaKfxlMcfOPGLuzLJh7/NwOGnSZTtdHqEwQkV7GPV3qgZxHX2r+LWIQ1ZNuoCBBgF+neL9MN
+J/wKwXQQtfyRIPA1do8HM1SpujvTlG/ABOiTr0ZDuRW+AkMC4acxbV7G2Cllx84dRJiIQlTUgJy8
+NYMJGAGH5gpJezdNQD6wimRiEGIs1yIne2Wc9dPE9y1zKjpbeeXoeepWGM2rYZMJVJSufq0rRKr/
+3C5+TyBu0zLigiMrNAhqakPLV4ma3ktpgtigcLAa1eS2USpy/eJboGbRqUFobFYuQk9td4yfdmJM
+0sIpeRomy3SWypnJ79NOewgOJKba4Ye65kVHNz2jAFL5R4z7ll4Iqn5h/ylIi6RqMMMWf0hBr9yD
+bV5qjuwZGltv1zqTJ8cPjUWMk+UmbZXcsA9W7CnVdGPoWYCT0SW7IkUYQSs0QW7VTReA16KDSoEL
+3ZRIGl7KeDqGVm6ZH8zIE0lOVFY0R/2XuIcPc2DNV3UWs0Puous+j5kQgPjF1YD1r9VT6DeMPECZ
+HzBJl6a4yvKjm8hXyCnYPnxbeAZJUXOmka/ST1KVUHM499/Lii8/emHTFC/28WkiaLHOUtCegJgx
+Kp/eq4RAqYbHe5oUdS9xBaxZX97T0o10udqT6BKep6K/rBKHJxXp3SMuCtBIrcswlojIMc2p9fwF
+WVKSZz0zT8rhyepHI5j+IJoTauGYRD46AqSA+6EXWm0bO0oEtBuFCOVeBZJrJMseNxVLfGJOZYtZ
++9ixo9m1+WBV1kGxp1RAnTWAidd15G5sxZ9qhKK9iO63hiWFGmuOiWUb2kUpBOjtM/IRDhU/Q7y5
+gvbnhVbTZR7hr+gWyIkpfOBQG42SMwTuqImGpY4yFc7H6NZSYead6Fp4GfUmLLlDG72d6Ue4N+c8
+K3DTZYL47LFdXyvMNSuumRQLx+MGQ+DYzZ56uoM9R7B+34Joe8BeJa7bg0vA3Mj9CbZ3+yvYk8TL
+UU60BRda1AHwiSoRrLqgeJBZh+cyQB7e7EPcTO//iTPpFVJ8yst9IGn34AndyYULaPpnljMCiUhu
+X+zVATaxDMGwc++/95VHdeGRLhb+C5qeSqcPrIdV8XKCd53lgrAoZD1a9nym/mkCLQd+zjm+IE5y
+pnxccn/LoFrBm8yf0A35rm+A4Gl8gPSq2GYwu7zfEjXFiAlYrCsc5trQ9YNSGOzbD2BMAn5xxrob
+pQliw72xBt43e/VYCWwnLpgKqOfPfX18moDRK/kGeMPe/xtZ4rOiXbm9SEuT0pIFIaoMmilEuEI1
+bP2QC/GN1DgBMlV+FRAhWJ+X/NjHjB/TKBMsESyp3ShhCOum112eqoOxk0O4Ob6LVA6Ay6YPtoVX
+WhFjebHif5UtTtqd0u9jIU0J9UURkViLEzYN7/3FLIrlmntW35KhEYwCW8FhuXfFfbMHunw+zNoj
+ioaJtktg4TqRAXEFrSLIFy3VrsMCnNol100/EU+fqLtJfB9tvAx5pjYzUa2mfFiaoSliBRYHFy/N
+BzaXJ2DpFSd+RRbUsrLju3+vljTqtFEkhHFhMG4lgYxTAscqcoUAYfecGGhqL/wYDzh8V1WBDBGq
+9UsABqQd4EoqUX01/Driawft4mozRmxtWnTmrvXSRPT4CJp7zCZeQMPrlMKS6+gXDU5MljCCCGkG
+CSqGSIb3DQEHAaCCCFoEgghWMIIIUjCCBUcGCyqGSIb3DQEMCgECoIIE+jCCBPYwKAYKKoZIhvcN
+AQwBAzAaBBQ4eGcrDBrmIvtj/pYR8qK0Qn77ggICBAAEggTIttxjYbbyyDe0ikO7pUOYY2lCBLGX
+Z3Mx54Jg9fYmSCGv7aWubwkixV+tlfWjRfGrpaMLNfJXzcbkvso/H0Fyk1oVWLkhT9DrPWRjMYWn
+aZo91EKMvuu77RPzXuEVzNc5dSj01qEURgokH7WUh7Hrsp6Ssuuud+d6a6tCAwiCjLKZQiLuZ1h/
+uGalDjtM2yJVo2bZWt6puFt/H8AMLdf8HCREQ0Cddg2PG4EyQiUuzIQEk6IddPKhguWR350YCeoU
+Ywx4vU6eVFYZY0DX889rXDi++b975GKoWGd74Kkt+CXrOIuXHCzmeILFouc1Uh/wwIYkgT0ClDnQ
+749jKxcFG9tMkqE46POK8BLiy9V2FioKviumdiHVAMOah/sH7Ykf9QY1Qr//fHmaWRz1j966jaow
+L9pdQ4v98qRSa7EUJ70AD/wK5Xajtyh6QnzW/OPq9HGIBhcy+PjP95S0MV5TG7OIXBVwgw86wp0E
+ycpc2Yr0LmNQP4PJGaN0ECQm5/n886tmyv6KAMlxrzziasYymUNhY4ima12rjVN9wcNxq8Sghq4k
+minW3dO4mAfU9gbvZJ1RqPFswBFm5n24zJKjzrO2qlu7tLx6Vkck3vJI3UuGWWxUBsVoHd5m1ZZP
+5qrJHeEXvQuxXlyKaY7cNhk0yR7EDYC5SpUroTvVzWe1xYpoQ3ZyDKxCQ23l6jaovHJ3kQz450z0
+W59wD1078JlpTwYHsx4TBilabTcZku02uz8PZrFdPl2uJgtkgY0YyrQfYDK88+BvGWl23mbpRCbb
+9pO4dxFW0lqJ112EOXECbDmkCvh43NWvr0VqsJUM3xWsKKb9xpaNLSpcK32/BL+ZTQg7ec5/xx4Y
+FN4yHTd6YSDzKYHQI252CMImL0HIAC7qOOCftRDEswv6xKIn6TEykCyr08RcTsnjfjzH7HIsjhxa
+anv+xXosLZfCN9/RiRXfUb2ayRF2fdQsTNepp3ECiZlhMxfKO7aSwXnQzFyB+F8axEOFBLMEmJxC
+7ugz5qDqUOqiR1UNQfpz8fWXGZ4e+GLr3PblVR+CyGCDibZedaeDVXGG3yx2/V7DsYUehJSDz2DB
+C8KwWMHetjDlAOXbaKcZ1QhS7upnZhTCwF90JllIZtfKPS4VP9uyFecMc0Ocoq1zdB954nzX2Iyy
+t4l8+WWHH1Zb4EY6eLNNy1/wUvngGXqyrUDAocZKk/G8Hy7UPXrSWo9hGRiAm86WeokJjMKHgOH9
+lFg7/B1YHl2rW+E1JCAu2xAEJM9HB2+x8OFL/VBoxQLHr/flgGwCkOD62Oy/psUSL0ZQ+hM7qElW
+y3+KlS01t4icC99/r4oyA9poAx0EVfSvffi3Nb3Et2ryYRG7kmjMoxvDVpmrAKopnePSE+GAjEbG
+FIOli1ewzkOjcLZrdfTpONWfUKJB3Y6AOi7aV4N+wlrMrgAtlHSuDZ4csr1SnHctqpas37CkMg23
+KCILn2XktsGXN5AyCmPcmZI48w+8uO4OTxOdK2qIbXrlNaL1bFlHTt9riehDyHD+5LR4zB4XL080
+IA9XkbyR5OxdWlcShjPboOvGxMZeoTwmTYE23kCgh0zx0jLhb3bo3jnu6K76h3oPaRikYA5KBob3
+L51vXtrFMTowEwYJKoZIhvcNAQkUMQYeBABjAGEwIwYJKoZIhvcNAQkVMRYEFAxeTobq6DehjSbi
+ylxISkcqQqH6MIIDAwYLKoZIhvcNAQwKAQKgggKyMIICrjAoBgoqhkiG9w0BDAEDMBoEFAZ8kRRQ
+C5cLg1CRiF+Lgzkl9aD/AgIEAASCAoA2KwrF2adzCcInax9pPRso6j4h2KcNgrdsxCWhz+DWBRCw
+pOD6uitzCdyeLEMXN95Roqf/XxHZ6n/VKov0U8vgvKEU4RSeHsUQ6DqjrL7HpEhbM/lhfHj0vaWc
+tQQCTslHdwl4hWajN44Yv79zMHjA75/n4JAOvtnsyQrF0+44/yA5lFYLZyY4ndbyqzAPo0ZQD6PO
+bT8uyH/KbUAi5Etri47ibD1++EDltb45ctO8xA0rFIV25tL/AOG/YajgLC/7QBLTNgvMZ7F2rV9y
+qYmNCTdIDzaUIWg4+0qidqVeCPbrHHkqhti4LwOIQhBXesSTuBl1xafwzDeFQpADUe5Hc4+TtJGj
+gUT2gBR9dGJI6Wj5MRM/WGT/78UgbpYxG1Q7cZ6quILuzZjWQD+guHSCrhIK42dulowx1aTaela/
+XYcR+cRiQtLcmr/0FHfr99d0hJ2BSQIp9IhCsAkU+W7Py39jTcgU/HepzvpsLuPOxI+JL1Rb0llq
++uKaw9jCAy8yIGgplEXg5mhSPXXSDO8k+9CL5rpJvUjQSnLrhLKo2i22p/LIEK6S2uVnD6EdRMYo
+J/Vpx2ujqkPZfM/xsbAh04frXLGa2uAISDig+DH1RWlB5jNLRVbfgZA5/PjZyt6gz4lJigpXAVv1
+Z13EbEKrbv+CIUJOC+spz8YMH/37YkTW382gWrZkBgmQvZ6Gu5EeeFOIxXRNPseHyg+aY5vjQVyg
+V9RAg2sUDwh4u8JANq45dKEFUZfD8EqhVKyd4DuJ38AkxM5SQblQ8eygx0/bAVYzwN8ZRwxDB7Ii
+VD+LPthBp147NBgBw0ssNJYQ4GB4gBc7x3UXnyau5aDO9n6KMT4wFwYJKoZIhvcNAQkUMQoeCAB1
+AHMAZQByMCMGCSqGSIb3DQEJFTEWBBTuNf6QntPPWXHkQhWW+uEJ8d85XTA9MCEwCQYFKw4DAhoF
+AAQUk5iGX7naSu9IN6Kw+sU5Gk319ygEFAwa1WFGcSE0mhaX1jNiYWZtqQnSAgIEAA==

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/jdk_jks_twopass.p12.data

@@ -0,0 +1,45 @@
+MIIJzgIBAzCCCYgGCSqGSIb3DQEHAaCCCXkEggl1MIIJcTCCA/MGCSqGSIb3DQEHBqCCA+QwggPg
+AgEAMIID2QYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUt/45tX+NVmWByhUTxlYXZtkG23wC
+AgQAgIIDoHK05qRAikt4Qf2pBGjBl1KH28QZEqGHygCfUpdGyou10RMbkeJ254HBhdRGQrkhLva9
+RPC2TDQuFY3RWqy/we6TvhWyq6T2rW7wPysAL7Me9sJLVvekpWXOpLz0iye+/4qaJZCFsftnUKMA
+FttOkAfVr5DvfZjJYCF4AXnlFi2s5Vz0cSEyiOarrnXpGv0cnhVBkWUu09Afhvk9WnLoggYUIBeg
+w5d/RRj7qM5db1GzYAO+ZXaMGwoASbnZMjFv/drJFqvifToOkn3DHX+nGF55ra5JNBbzOckGplWH
+HCqqirmbguGLGf1RLoPcphWC12jQgEOnvoc+u+lC0+R967wFWhgGmC49UuCUVJSlkEl8hqwCYYb/
+T5pGW5K9sMHzzlPFMbCN3YlG9F9Upb9jFduOXXDi2SddyX3kFTRc5Q1CRea1fSm7mFdKIPr4W99j
+hWT4RJTVZzbsWTh/kNUSNgP+cgKGxthqaLvgiMnOeoT3uldQ3thvSrzJKrZWi0ykk8/sV4hpMwbn
+k3N24yDZB+FL1Buw+MmJ5PQdCxEoZa/Q6JahqWP/Kz/LSjOOgk4WdrJGx4cUwnrqCIgnHK+FAVD6
+ibdW2LG5w67FjMIGPS0nuFyZ/pwKO2jbgRU3CpB2XVwBhUZmHXgaJH7A68jGYSaJWc5ViGcJyeRU
+S06FeViECnRu71P32NelWArbZ0XlKXKAwHse+kWUi8xuttgXas2KQ8Nz5sRjv78vqpC9tjDSkGUk
+uLhJwRagJHLXltOYbXgH3CAhXhk6yTo45ytgwOV9GWs6RCOVZaMM942yMwQ2RR33MsF+N1NFI5bQ
+5PYkGy0zGsvjqlT9iNE+u9ZcUMKp5EHI2BLrs6+41gYaaMTddB/bfyTcf0XIhAqeiOlz53YgbolO
+i6DudU4lWyvz01T7zcl+J95s03qf7yaCGkAhetNg19ETxmxQSF5yBLZPns0CA9M1RzeM7qelj7by
+3OqF8lxl6H//ZBuPxRNNuub7PwctPULDieYNWZA8kAn22utOVlCBsZHZ/CTUQCRM/gVm3QQjSUMw
+oyK4Ijf2LywzHVuyCkPXAKSHrxyk8ecTwSWDmzER5uqgevBK47oOXy+nuxkC9tkeLg4ZqeWrRUGS
+p8iIDNTaIrlVJ5g6s7hOgHDsPFh2sw5tGg4QkWw9SWcKkySCg7jg2Nh+0dTMzTG+yFBx4qbG5D9t
+P4rtstIGeyZvjEW4DEiS0WCZe6SFcFgwggV2BgkqhkiG9w0BBwGgggVnBIIFYzCCBV8wggVbBgsq
+hkiG9w0BDAoBAqCCBPowggT2MCgGCiqGSIb3DQEMAQMwGgQUadAw0f3PDGS5mrzMd1JZRDeJ10AC
+AgQABIIEyLWepBjU2whnDqOcH8u6Cc/+RAjsz/laSR9SkSOsd1Kn13DEFvfTiwcvkphQyOFK3w/L
+cv/ZocA9Br5FQdMcgmUladwokZP/0f9TR3iacf7GVAI7J3DEXiN9fRpljG/oU/+YoHEjo1i8rqEK
+U1AhJ/+t8ABZfrK8nnu6mD0vJDdgslQeky5bqzYHyvf4C1YKYXZIhG6Xcl1aCR3NAZxmhlBeYZeW
+0doiPeHj0GImWoA4ExMrNkNTDwcDXEpPzpdSWuM4DuoaWFrcFJG9PFFrN3/Rs1gu1UP+ZtkGoBNA
++RxehNGCLMFuPgFvnQYRvnYhuYTB/mvbkOyfUSiRr3CpdblH2nmdsQBwUUOh7Vp7uv8pJwoFui4A
+09T7AG4sK1YwUU/d80cZoNh52LdEBddNWrVINPxi4Pb5id0bvvr/CbjZCPwPqrFw6wNAmWolDac6
+kibaFQku3aWX3W6zW+J+zM2TCpMIGcWsiMNgBsrHL54FET2QUk5E406AGiNrMTMB3yHDV+C94KU/
+LPSEzuTUXmpWQcYrjr02afkmkwgSysQq3IQA8LuMzapGf7fuA/RxSILuPcWw7lCWy4HmVn4uiKLo
+tGyxfWrnXZG/9tMCnm2hxpbmP2BYbYck/vgDCxDhOmptHM7wUjs3ujhFmwp5x0A9BAU8WKuJFdPC
+aZ8hjkgvPaVwtFhEScELSQh6iwfHftAS0jb1NfvsaPou3a4KQ63pvMuF4Qx7b5Cq4L2aBqhvgRqp
+kinAJfAVr4vRuI199KnADlH9YGmOdrOVJ07ru9dtisH4t+zo7j8lqqcqhUstjUVcmFf6LlYPKsOG
+yPsaMTg3DfIYhpWlV2rd9DXBBzNgz4KW6CEujxCSBLP3VSQQgA5xRBROPw/uBq6isBBkuWZZy9z3
+GS0J/YtZY99Q9BfK7n+vythB3aciecySnoWYS1UB6m2b+F4xMmab2P8GhzzFsyUmAzNy1mQHGdYe
+eHBKA1CunIvICiv95XRAplBSIh3KHEeaCwbKVhNJYmf/xTmRBiTtVEgLKpxSQMVh+Lax6rmvVMcu
+cb3klVE1n9DILVAkuW3uxScLDS1wQyGWdGu1/2vU3yojus/kw868+gMzvszc704XDviwgQblYe27
+eOdpRB8oOK63o/dY5cDSdEYhjYEVlOZ3eriZ/FYW5WHAbR7PuM1EYfVUy/5XGLylDutaA/0klfu4
+Lhs4Sptdt7DifBI6R1LAcXu7REbu/r+Xhxnj6ik27oMitYO2PG3slnBEzj37Hc9EOGvBbuB3Fn28
+oRs6tAFilysj8hrJnHVFbA9OiNa8sdFj797n4lvlYv2ZMMUvJpg0hjInkTG0vkRhQbzszd0URUK0
+hpGVADFlwsfAWKoNAO2YoBmNIILSs8Sgogf5yuRvZBZPKRxQffGp9UjRpe2TiM2EZfHhgruyvnR4
+GfZfY3oHCtWA3DmQZYfQtwqeo4N4gA0Kwr34VGSFDMJxmEIuwWZYRL1sZXyGUZjZWYhtrp25vUn5
+uXrzhsi4IuDbAV5QlBi3NAC1uRfcZrn9OhGT/Q7LK8M4z2WL7gui5ULq+a4OvDFdcLdej/obWRip
+X20CW/bWzctM2dLUFWwP0xdv9wHAMDpnrOHVWF5gRaWjFjFOMCcGCSqGSIb3DQEJFDEaHhgAcABr
+AGMAcwAxADIAdABlAHMAdABjAGEwIwYJKoZIhvcNAQkVMRYEFAxeTobq6DehjSbiylxISkcqQqH6
+MD0wITAJBgUrDgMCGgUABBReCaXcoIK8JTMwigEZzYPfmYG2TwQUZCjIEn2XZ9poivqAwEKWWmB6
+1QoCAgQA

test/jdk/java/security/KeyStore/PKCS12/certs/convertP12/keystoreCA.jceks.data

@@ -0,0 +1,38 @@
+zs7OzgAAAAIAAAABAAAAAQAMcGtjczEydGVzdGNhAAAA9w1c8TsAAATsMIIE6DAaBgkrBgEEASoC
+EwEwDQQIENnMq+mjV/MCARQEggTIxcLo7BUq16C/xG5KhlyvHkNqvHIFDcCXcwSA6L+1OD8jZztH
++/0Xjv24+gCvto+XPzkKaYkCN35SI9D+y461jqUStnjbgWiHnXnhe/V1IDfkY93cV1zLOWwaNXvM
+UPMY5IEbFKowrh3Yrr0ljh57hXifgj63520l7ZV2sbVqwH+1ttBOyNuMB45AvZMX9+qZDucu/I32
+mdzvYoxBPQSwYyt0XMleEMxgSdum0WbhBcjZmcAHjsrLhrNK6wAEjM+6s/wpbJgU4SNIQ4rDVLT6
+SMf+xBz6YxzLiNBWEoga/aQK8WzCF00YQOrCRHpLu1DRSvCofmdttO9FW+OSLKTePV2xQavdu5GD
+Kpyog1BaQlkt/QFqx6xMw7Sf4cJV7PPd2rsqM/xiAbYFcGjw/hlk9pGoHcbGT92bUum+F1KvMdZj
+LZo4Mzo0CEYpp9MmSt/q5dGbCxQlUVKgLg16P+jQ5TvLyIyd4rFG9yaqYQ3Q0Um7rRfFQ1+/aAZE
+OJNNFp9Oxv7eBAwbW5DdriWXNtxo3yIRbjQhn2wa5Lyv9cVcUQ9OVKU6Exu2BWjuMmjr4mM11MAX
+rmzZcslK2iX89phOOMk/ZG4BRb4lD+RTeSHVJrORd+eaZFXhXYx96a74vJI1tAcjgT75T6Dmq4da
+uC39W13zhWOsOQnO0jdZQ+DkiE7XQ2+ZoB+nMmIWHyGokg1fS1AB6v7Os6pyPKKTEqXWM73L8bg6
+rTtCYQS1/NaSoAofOsbg7UWV/EQnShu2eHE91V509lY+l8p/TWddv4IVOBKHranSuRhJ56cD5xs0
+9IksUK2LXdMJl949bU4NsnrmUohkjxeOZpgDrvM2U2TBaJ9lO973ScAUJ0kqU11Q94LU2TQ4JP9d
+2sWkq47wGE0yrx/ze2Vi1C+HD1esqKpw142cIzslmzzwLKZfauxT4XLprATrKYVBsA173Tbg1eUK
+17Og5p1p6qEqwI1dvD1NHhj5WuLztP/zhQhnMlPNukVo/+ue6od3wby9jeMBHIIQDjHXGX38APJI
+GHBxAhvOJeCKs3+JPnfuJYNshl9535oex5R1/K7pTCiOTdsjw9OQe+2xMFZX1ctaywWxQi4Bal7C
+hha6xREcyr/M2ffpn+Vcvp4U7NYOh86KEwSJxyrltAb7BKT7RYTcWLIKsh+OBBQIUbfYQXL8tMKt
+c8uNM9xLYFeHBAvgl09rpci14HsFfMD4atCYIremxSHO2whOwvOUVtBqX/NuKzxm9+Mbu7GDuJ/j
+tC2+0lcxytTibjK0+5PYNAoFp4jsX1qQ+Fxe6NN5b/71QjBTUFuXNFzWBgWdnzYW2Q5r4Fpt+GFv
+XUWBbxrkqUiHWOvlUaullgpN8I7JbOB4WwOD0r3EsTxO1OBSkZizFUH44oIaiVQfXXVMRxnVVQLC
+MKGGR4p0OmH9I0PXldqQPMtVKTDxgryNgXQoKFB83IPOcH7akfgh3W3zFYjohm7DvKXa9ydGaTDV
+1jmCHtjjhPvz7Qv4rY1Gtr/FcPADFkCpN44d29RQ3D3ThxJoP1wsMzYeLMkS3G4zomWHOXO34XA5
+08BZtij4gv553TrFu0tktdgpF7FRlUOOBXL3dXKFvzRQ3E5/WwuxEAr/Y3CZiVmgAAAAAQAFWC41
+MDkAAAMbMIIDFzCCAf8CBD8+0BswDQYJKoZIhvcNAQEFBQAwUDELMAkGA1UEBhMCVVMxETAPBgNV
+BAoTCEphdmFTb2Z0MRUwEwYDVQQLEwxTZWN1cml0eSBTUUUxFzAVBgNVBAMTDlBLQ1MxMiBUZXN0
+IENBMB4XDTAzMDgxNzAwNDUxNVoXDTEzMDgxNDAwNDUxNVowUDELMAkGA1UEBhMCVVMxETAPBgNV
+BAoTCEphdmFTb2Z0MRUwEwYDVQQLEwxTZWN1cml0eSBTUUUxFzAVBgNVBAMTDlBLQ1MxMiBUZXN0
+IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsFJYAnaFn02/LypHxXyGxS/WKC5e
+7PzEpjXzQ4pqWEDBr8U+GmOB+4oB755HkEpXBB6J34mlfRpN5RjUnegD/cK1qW2o//7rIkt8XwKy
+fHAdzAo5M0k75mJMlpp1uhDwY9BOUVAH9HB26Rv5cdTeTGP1Bp6KOry7pI9z5YgYsNgsZ7aKZgzX
+cakSxP+Kh9BnpWNN9J5JxbsxY0nkEEPyIPCD7kn4TYDAdmfCt/zkJz49mdP3BWaQtvZSM9yFSb3K
+P9Xf6bj2DLT3M8AdRDi2yWpd7K68rSgFbz21Sa7mCr/35hgQogrVeSUtlKkyREG+rDRT0VncXL8R
+uZPQOw2oAwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQBmyf+CNJK0YsQ9ckYhXDBiafOF3n9MAG4I
+821xWdCWnQ2YUIlybCpW6jEkL+jFtfDCt1EYaGvWPMHR181YONJUf4MVtaE4ynq1pvDLLJ/1i+VM
+8zCc3lfm9mQDnqap0MBRVJzD3uHceCxG2bZTH2W4N16MEWU6ANmRJEXJfRWB1rPbb0lQMIEx8CJE
+IPxVPYg3enRjxx0Ciq3wfEKmhKCRyLE8tcR40aFkLReumxSI85fXsXEtIOD1A6+OKC32fYzSvwNK
+hIdVt/9sIgMOgVQbEXM0rAJgayfPulQyB19OZWUUg+zVMDjgudV6cWRRz/V+0U7Ajq3IZOsE5PtU
+FgNW1MI40XfEdWafFXeJ+yQTHPyoNdk=

test/jdk/java/security/KeyStore/PKCS12/certs/readP12/ie_chain.pfx.data

@@ -0,0 +1,61 @@
+MIINXgIBAzCCDRoGCSqGSIb3DQEHAaCCDQsEgg0HMIINAzCCA7wGCSqGSIb3DQEHAaCCA60EggOp
+MIIDpTCCA6EGCyqGSIb3DQEMCgECoIICtjCCArIwHAYKKoZIhvcNAQwBAzAOBAipOP0AVsizDgIC
+B9AEggKQIP/YI9/C2WYbIWxKuqXMD8WPCvqj1fhHmZJ0epCzgEdOR7GT/h2Fy4/wxrthPkj4JqkS
+akQog3pjOFtj9D8QtkOw/b761qsyj17TYlQS9C6qVhcddMA+Ca2NcDhKlYofQMNTuYPXkXlpCh5R
+CNFgQ+PLVZwNZjqoitjv0RLQqBudhTmJSvfDlW2w+CpbziEeRNzn0pX0/Ts7KxykDscOmUCGHKic
+b6FqHoioElcmBp7ae3zdXuvI1x/1Y435qju2yODPpMXEZbdsD5iL07RZyL2vm6lfQbLc37TszDBx
+ZZJ7ja5F4V/j/6/AVLkcqfZxFOnXz5Ki9rQblYJbkkTpJAyiNqi8Gx+zgPGtLWvV6KRD0zmxo6q/
+OmdjKz4v9aG7MDSXenoy6tPAOvAQcQYaksvFZs1FjorJJpFzasfTUfy94JzrHUzRSPzNRDANHG/6
+TgxC1FMNw+iQUY9L8j4xrWsr2JN5tAgYcWz1qZrp4cx0he9cbQeqYcjv7ZvIQbIe2zxdvxh7WByy
+r8hNMe3RkMOM2yuP85JuWipq+9jt4/CrimKljN1ULPw+V9FZzY8kKcEiSPD+KXdJNkrMr77/lUJz
+PGNYpFBFb4natmi31ZBH2VomTeKPpeanN/ghWojft1mGd1s1nD4NelrWATMVquH2Cq6nhKLRHi4c
+KbQsMo+ftLvkDHHtpYenjGHbwEFfowkwn9slsZqmPEATV6caHNITCBbhQmvvhqPDPPViV+u1M1c7
+vwf/ol7IjBlubwzBJAg6f5GW0tMNHxfg5E7O27AyREyvexk0IVakzIwUuP2anPTjPW0vyeePLtiG
+TXNoUe+5UIzpshnLmSlerhVGoB+HBM1yoaaJHay7sdyQbVUxgdcwEwYJKoZIhvcNAQkVMQYEBAEA
+AAAwWwYJKoZIhvcNAQkUMU4eTAB7ADcAMQA5AEIAQgA4ADkANAAtADMANQA2ADEALQA0AEMAMAA0
+AC0AOQBCADIAMAAtADMAOQBCAEMARAAzADQANwAzADUAMQAwAH0wYwYJKwYBBAGCNxEBMVYeVABN
+AGkAYwByAG8AcwBvAGYAdAAgAEIAYQBzAGUAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAA
+UAByAG8AdgBpAGQAZQByACAAdgAxAC4AMDCCCT8GCSqGSIb3DQEHBqCCCTAwggksAgEAMIIJJQYJ
+KoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIEmpyonjQeMACAgfQgIII+Pr+GLKaSN1U1soCnWsw
+4kRoDxPPLNbzv/K+lsbGVk9vXjv5aBTi55FMCXvA5kGvdnQYrQ1KfIZmFVh3PnFQn/J6LVrpLbHC
+/D27wvnOMausJA7uJi6wgkUCkQmXn7kesWhr+bBI9Ci7uyOUxdY53Yg43OQtZbWvQjGe6GiVRqWm
+8NANuZ3c1IT2TmJw5xfvvE4tcHK0d75ApvTa43CkKmUY5A4SyNY4SUVdl9Cx50LEHcqGwV+uVGzy
+kdO0+bgXI66FPKriuqPfayeTmL8T9PimwhOfY38OqtTKHwJ7E817i/B8ULpkRO67uYYJpeK4cIz1
+0rDW/JPG8BqN47Rej8rCpmY1F4hOuFzYA3PAh50YlI2wD2vSSqVPMUe/AtsL+u2Nxl/EidWp/8EL
+l8rBgYJjSl+YjSRV22C/ZwDu/8oV3LeCuwL2SaO1r1tww3WuRAFcCctsemP84YI27Q8Z54P6wM8c
+kjYH9F3oT9bHUAfJUm2d6d3wd+iGbrrxdkLrD5tEQB16K8RAbhPPfrM5rcRlh+Zvn068H/Kc9rEa
+sfJD7ygUBZJ5MSsr4zP4koMZ0xjxAaXRUsURsF13772XL3zfTCVd5fV3wIpJsoXugZTOQ6hjAmeN
+yGMZDn14GyxvwLbGFB0Yx8GAIRDxBvDXkYOqEMocmNwZo+uxPew1H4PMkWMm/yh4Y4V/H9Jmyd3v
+aD2BWVyx7PIJ4cet3RdydHrKSNVBzwrO+y5HKZc7V7aRM0kZgdAJh9eDTlYk6B+ZHd1EawYRlIfl
+f4JydqRkRaya7FOfQ3mLgrz6bdde720XZVWqe9bbsBucbYAJsYvklYYYutnsx1Ri9UYYAbRDy920
+Z6iO1EGF5wcUc0nifXObYJ2x0ldlQskUdThPjZBl2Mk4F9oxS6W5j2llm1hS/vGnFtykQ5NMaxzi
+Jkhi1Mjm/KZJUo2xJai1gtHwBOnlocXZYqJQECabBayA7rLH3pFUhU/Wqkycz4m8dUVXLNHiMIEd
+3sc0QASMF56kqXtzph2zbXBbCD8afyt8WjMzZvO4lEGNM8xi/7C6h45QsdGZgqkHrYBJbSHfrU05
+ZvNpV8YcfhkzX6gNtZU5XDDBPgkYn41sEt3aVRHvRAqc+uhczQ8svVhPUsriWnKk2bfw8iAn1xex
+5huB52uVPRfuL7wJxyV1Rk8WhK10xCzFDnJtRUAJ6UtuezrMOh28NPULQnLIx1kF00+uflY5vAHM
+rAf92+NqORZUflKVidqHYmF7bdeNGw3qshaK/0+3grs6rQeQAvxiTdmG+sBP9poBIeeHo2OzcACB
+wTuerZiYlzL7mAUegdiPD+wOa2yfGF+WG2vM9npO+a1ZWsoWceAxpLOyubBVfLyc7lfCo7ma70Vd
+Kl/o7VevEqLIz5ZkaCoupWk7nDKDMG73vGXqJwaYjd8teOw66aELd2WI4cAoFTvPayxMKHD8hf4n
+78riWe2XomUzafZLoMhj5vfYsiwwL3F5O/KUtTOXNNDDVuAwByiCfN65LIjU/Dhn8t6Izkox/Tnl
+9kPqNxqJAxFtARCFo9Xpgba761dTBmUF9J+Krg6B53NEv+0qvJY3w1H8Fnop9S+eEs6/4qUMmgO4
+wrm3aEaLY4XWGejuxUEQ9+3/cxK1YTJIpBeK8Q1/yPgj2mq62RRGcyDPEMbcbFcsI4MKlGggcpHV
+H8hv1XPLbrMi56lax3dB/EkJzJ+5IEnYd0NkXclyQm4d7KUy6LG5I2Quwt0J50dxbqmfR0gWwGsY
+nsT4Kk71NiUyU9AWl46EOZIzONN4Vnm0qq3oNJ5e8VpKTb2g80m5ouw+tPiDA/IA3Vu3VKLT589j
+5IQrNYhrizZnEApqPAQwBiN6D+0BLgsNeQDUn56emMj1ETDgfjukqAQjlGUvAr/VV/+eFHvkqwJU
+Hy6Xzd36Cq4/sYKYVU7OFzh6Ts9gCvblZxbFI1yNimEvwZ/bINKAemQLoji3s1UIs5X+BYqKZpI5
+nZsjbIHLafNjfPoMKUlpQa27jFc4s4GQ9WLBDRnVIuzqpdmdslxc2Q+dwzbT+zFoAAe5VzA+ABxv
+cjPYCBVpys4hYH1p3uwUq/hKkR7QgPE2c25qIHl+6VVS9dgaQ4XnHtVZjFzDk8u5YNenHx8E3lx4
+Ebe3mNjsM51X16ERkGC7X+w4Ko89wvb7jnnOheC0W5ICZQgphdasjff259yEJuhfk62r6bhZH2Um
+2IkUACGxKaEzh55Z5P2rcaSjAwIeWnLHDCPSOJ819/4XQEtPfbZs9eymDwNOg13kZhadSQF8+zht
+0Tko/9k41bNaT2ZqogskrIF9oltpofddqOa5IcE2d13T2IuDkV8/whV87P8Dg6fmFYpFCHN7zsks
+X+IHrRIt7gILXPwecu2LfUZxdH/Cr5WbfMzTnsWWSB7/Z9MLrlEISHM4zC7DlkbRSD7LyXyI4weh
+HNelf0uLtYRhXku5BkJUyysIYDpSHHxsMJ04Th+RZ7s8seoLBeAn7gbsj3B/JUOxIaEx8+W3bjb1
+wq6cc+KqLnvcO2BDvH30PfeQo7YjTNr4wcEoUFZXwhTL5owVc4GKtlfl/YxBXs2E6r6l43svlay6
+vCq58xTvWzzRtzvb6oh6qnoMP2xc8YTdpKma64TBmnFOVE/eGXZxVyk19TXwrokqUliutqhM6acv
+x87+Yru+uXTbUpMA0MuW0Ch6uvcwxmM1hq5vHDVBTAfGuXsdQMapKoqseFUfza7N2eSgU8oaJCGQ
+rmhvDn+MNzh2VyLOnPBwJ+sUnHM7XOnz/rCD99uRhhssEwZ5Xij+FG3EeTYyntGp6Z7ODIazLHM8
+81QtQDrJg2EDJ5RZHHrPbyUQDCkGpLZNOOoJkAD7I0VZRC3jJb8lTMXdKQjCd39F842+FXTSvOv9
+lmEOFH4AEyI6CokzFQCD0TXhTaG9wtzaE2q41eEKF45J5vyQxrNabZXeovNIVZryK+N8ep28M084
+vXp7uJm0bg5NunK6vTIqsxenQZWvXay8EwYLbAm8crDxK5sbW4tZtNeVxPE6ekCbifdxdgm0671w
+rt4wOzAfMAcGBSsOAwIaBBT1C0A3jyKtjUTFASRSO852mKBZQQQUqy721AxhZ26s5Tsue4OHTjEB
+CxwCAgfQ

test/jdk/java/security/KeyStore/PKCS12/certs/readP12/ie_self.pfx.data

@@ -0,0 +1,47 @@
+MIIKRgIBAzCCCgIGCSqGSIb3DQEHAaCCCfMEggnvMIIJ6zCCBgwGCSqGSIb3DQEHAaCCBf0EggX5
+MIIF9TCCBfEGCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAjnValj/qxAxQIC
+B9AEggTYZZfhDgMBhoV+P+A4KJf/gnrbkgp4ZDWzXl8gOttjRXofhACETGpX5IHsE7UnXbRc4T70
+ByZGlcGTDuT9VgiFnFN4VTs1tRIz2W4cs4EmogLX2sX4KP3U6lZiXugEJ36wPSSN8A1prsZsrTid
+ff6bsi+sIO+OI6X8Y0degOU44huDhZe7Fmjed13aW6jLhr8SKRSoufDR/sjVnJK476qkYZc4/Dlr
+sMmYftHdgxjfm1KdOVycWm+1ItRzniZemiYYYB+vkUBYPO/rMKCp717SWOQhs7SNQcG4KjdLs8vv
+skiRPgRzfbt6vaEC4yKy27FDFqzx4unLRzGJ+ekbLzzZAu4TMS7j5g7Ngo0d7GS4+ZGHamOvDuXQ
+x8/Itv1/0qzGMwLXyu1x4K1hTgFKD5NQoEk89qZMDVXi4ylGTWXE0x5azKCXP06LxP9/Pit/ufG9
+CwUAIeDrZ4A6F0hyT4p7WMgaUqry54/YrjQBd632I7FacKnYojgcW+xQeRufxiYJ5x/6QIZ4dDmj
+4rX7W4/0UOVlyFltmmoSq1HJRMaw95iUE+ft3q6vK/bvy6FZSd1CAbr0tut6HBmcW6BOdXFGmXGS
+JnbwaK1IFU4c6KOVAwP16poGhOxaJqRaa4zMBaPcYg84rQ3aI00UHGKQvRb6UWYVGVayc13WYcGQ
+Mm8GEjlmh4URRXaRL1qTKCjjYjG1mvTG+TOYUwGZUOGD+6fkGFKMkNXxLmaDyyT0cSoBeMl4whQx
+obafWD8sMxCJb/E0eil/fbu114rmFfrrqP2evPEIuQoacNr+OUnfr+T6vbBpT79emxkgsKuG7eEt
+4okYQTCp6aEpk7ZKppiZVOBvrN1lZfOH9s9qqtbx5Y+9uj5aGADHkhr6c4pYoIaa1BuUKgBiglE7
+QdRFm98TFlC328BbUvBFXEAnshXeYHRPgevcapDBIqFz8ZBnJNMgY3KZ+mug0wg09vsFE8TkH86p
+WwvgUzLlZDNt64OHh9E5Ql1MtnMlp0nunpLQyYcmCn8AJIcxSnaicjSlp+Z04hSWXAesbWie41H2
+OA1CqsQdc9EePijdjX3QxDK9mBNhXY2ngWrvwkmlYatHdSFzXB4uzCsT5NKK0nKI/AmUN5vVVv01
+CFCPHgyBBxF1wom2mA/QFv+7WX6c5Oj0WgOLe/3VySQ9xPoI53Cc1Jl7uOm6kXIMzMxCOiDDcScJ
+i0LwyDtmVZlOqhiGCiguoptQnTT3zzp2uaDLVvyMy7bZP8T7G7ka7CSpWQNr0USldgpT8HOXJWgI
+4il9iQlaajYO9ntwtYAlMTjsYy4NNoW0uYajdnjT1wO+0w1A0SKP7UrRnyaonf/G4z/VeNSh+yEn
+7RkFErPhhvHQRFMG3Gkgw4ER+zo7Q7x2m5R7FOeCp4x0/wiI0e/SzyYxBqXSQfEWxQjb7IJVfd6a
+gFT/heXJDvEGbLzUR9jhDptGggE2NlFyA4G+ol6XRRZKlBA0XUYJPHY+fyvcHikiJeMM/YRkrhCE
+LOqfCNOafSSSLcQNzJjevq/cDpgybQZV+BrN3yPtQlZgZAy9jOZlULVQSak7K2dF355mEtPNQUIH
+4U+GdMXitRVknz/dv7SF8tVzR/GYJEX51i0Qou+rzOFhmurxHyomRHnB5WTG8D/SbzGB3zATBgkq
+hkiG9w0BCRUxBgQEAQAAADBbBgkqhkiG9w0BCRQxTh5MAHsAMwA4ADkARgA0AEMAMQA3AC0AMABC
+ADQARgAtADQAOABFADYALQA5ADAARAA1AC0AMwAwAEMAMgA5AEYANAA4ADUAMAAwADUAfTBrBgkr
+BgEEAYI3EQExXh5cAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBuAGgAYQBuAGMAZQBkACAAQwByAHkA
+cAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAgAHYAMQAuADAwggPXBgkqhkiG
+9w0BBwagggPIMIIDxAIBADCCA70GCSqGSIb3DQEHATAcBgoqhkiG9w0BDAEGMA4ECBHBi0p8N2Vx
+AgIH0ICCA5A7JaVFBqZTQbSEJhtjKPmwteV230BLhKvw4qfM9vxcBNj8kBZGDJaWYZK5BatuKMu8
+xd60lqzoKgUOHrN9etjMCe2h/z/RyyeVpBuEILJUQaj+SuSTSUUTpGKokKVnSQvCAD1UgJGFt/ac
+elBlaIw9pRDnDZgFhzZ3AWO09vBz+GcowUlA77W173d6fHf26khicTalsdXbimnMt48/mdtKH9ep
+pjgxJwhshPhgKKt5M87nEyaaGSEFfsrPgcIj79poWwj8WE6sAg+bVw3OfX9rvbpP2vWF/e6Vc2x/
+QJPChQZs8LqJAUy2lI55gZgv+hTKkkBXoHG0c4248KdyvBT5DCiFufaj/dp1Eja02Qxo+BqZLJS7
+EYE1YxB7Ty9CUxWvAt6aRLQ0ZLbrK28mwgCePctczxQa+tcCMCfL/JJvcZtiu5CaHObLzF7Ymbh7
+/Q6u1+5u3/Im7aBdY5AksTz2Zn4JjzSAXKTdEgcadjGsxTd/lj4dUOreXN9rUgNyQzjQHpljnhxF
+6ZAAbNC8FJwFIAm+ipmV7keCWT8s6MQeoQ5qr5RDhVhGUVM2CWoKRjhbKzWbnKetfmjAUnvn0+ZO
+vSKmOShMG8QgyG8trDIH734jTG6u6yoe3Afjw52DtfOo1OVi0ZDsj5GviFDZYQX5Z/86N4Tx7Tol
+e/Wz5918nziNoU3+07ZySsRRESuLj6p11sUmFFPj64W/CZ1YQB/H4+R+94uYyWiovHudC/69KnBg
+Rfj0XpdSg0l+HKgTez7OuJrEu9/+5QF0M1unJSGxpdojVkACf+bxu2+4czzh80sL/3Yzcenvg/nt
+AQGm+sX/K2oF2E0h/22RD4U2txDxORVGcF+wfNUHkl2m+rBkgsUMhECeWGwoI/y5ZBHWWcQP2ByZ
+78fa8a9L1RWGvn51yLOe/cPZ0pmYBDZ9aiP1KucGBNMTzHefZiRXscXjB28u7/YxUb7fFPY3RjjO
+p2Rm17rrFrvR9/oChO9ZVJrm8p2lQfKufz/t1USs8+gZPS+kLfE3wxZefo1nFmbkTWQT6hW+z4zh
+0QoBNwGJVFYxPuGvyOmQ4ksEHe7G8fc7ihkiZ+A9fJROqOjVA/ThnWIuiLKbDFlW1rQbdlihQy7Z
+oKbzbA9eOMUCaXMEti5CG/97pOCiElARHDactfiy0J7ykjCGLCkw1/3j5Qdr3feN4GWqOBTfn0cK
+eq8RT0pBkT0wOzAfMAcGBSsOAwIaBBRW5H12kY01oB2hnm0lkT0yUbjP4wQUF7tfAlojMdSZIdKB
+/FfU1hlVl8YCAgfQ