[FIXED] java.security.cert.CertificateParsingException: java.io.IOException: Unknown named curve: 1.3.132.0.38

Issue

I am migrating an application from JDK8 to OpenJDK 11. However I am missing some elliptic curve, when building the app with the new version:

java.security.cert.CertificateParsingException: Caused by: java.io.IOException: Unknown named curve: 1.3.132.0.38
    at java.base/sun.security.util.ECParameters.engineInit(ECParameters.java:141)
    at java.base/java.security.AlgorithmParameters.init(AlgorithmParameters.java:312)
    at java.base/sun.security.x509.AlgorithmId.decodeParams(AlgorithmId.java:137)
    at java.base/sun.security.x509.AlgorithmId.<init>(AlgorithmId.java:119)
    at java.base/sun.security.x509.AlgorithmId.parse(AlgorithmId.java:384)
    at java.base/sun.security.x509.X509Key.parse(X509Key.java:168)
    at java.base/sun.security.x509.CertificateX509Key.<init>(CertificateX509Key.java:75)
    at java.base/sun.security.x509.X509CertInfo.parse(X509CertInfo.java:674)
    at java.base/sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)

So I assume OpenJDK does not have the license (or so) to include this elliptic curve in their package. Adding JCE did not changed anything. I also tried adding BouncyCastle as dependency in the app, but this did not help mitigate the issue either.

I saw it is marked as a bug in OpenJDK but did not found if it has been fixed yet. Has anyone found any workaround to fix this issue ?

Solution

Later response: the problem for me was being caused by a keystore which contained both RSA and EC keys. Removing the EC keys and/or replacing them with only RSA keys fixed this issue.

Answered By - Alin Gabriel