[CI] HttpCertificateCommandTests.testGenerateMultipleCertificateWithNewCA failures

[cbuescher]

Build scan:

https://gradle-enterprise.elastic.co/s/wvug4gay35pvs

Repro line:

./gradlew ':x-pack:plugin:security:cli:test' --tests "org.elasticsearch.xpack.security.cli.HttpCertificateCommandTests.testGenerateMultipleCertificateWithNewCA" \
  -Dtests.seed=24DD5274BC1DC313 \
  -Dtests.locale=ca-ES \
  -Dtests.timezone=Asia/Dacca \
  -Druntime.java=8

Reproduces locally?:

No

Applicable branches:

seen on 7.x, 7.13 and 7.12

Failure history:

Seems to have started failing yesteday

Failure excerpt:

java.security.KeyStoreException: Key protection  algorithm not found: java.security.UnrecoverableKeyException: Encrypt Private Key failed: unrecognized algorithm name: PBEWithSHA1AndDESede
	at __randomizedtesting.SeedInfo.seed([D57D4B272A0615B4:EBDD443599A99232]:0)
	at sun.security.pkcs12.PKCS12KeyStore.setKeyEntry(PKCS12KeyStore.java:694)
	at sun.security.pkcs12.PKCS12KeyStore.engineSetKeyEntry(PKCS12KeyStore.java:594)
	at java.security.KeyStore.setKeyEntry(KeyStore.java:1140)
	at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.lambda$writePkcs12$5(CertificateTool.java:557)
	at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:962)
	at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:86)
	at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.writePkcs12(CertificateTool.java:555)
	at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateAuthorityCommand.lambda$writeCertificateAuthority$1(CertificateTool.java:902)
	at org.elasticsearch.xpack.security.cli.CertificateTool.fullyWriteFile(CertificateTool.java:1020)
	at org.elasticsearch.xpack.security.cli.CertificateTool.access$500(CertificateTool.java:86)
	at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateAuthorityCommand.writeCertificateAuthority(CertificateTool.java:901)
	at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateAuthorityCommand.execute(CertificateTool.java:892)
	at org.elasticsearch.xpack.security.cli.CertificateToolTests.testCreateCaAndMultipleInstances(CertificateToolTests.java:601)

This seems to be limited to ES_RUNTIME_JAVA=zulu8 and only failed the matrix tests three times, so I'm leaving this unmuted for now.

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[albertzaharovits]

Looks like a JDK 8 bug in the bleeding edge build:
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8266261

From bcgit/bc-java#941 .

Other tests with the same issue:
HttpCertificateCommandTests.testGenerateSingleCertificateWithExistingCA
HttpCertificateCommandTests.testGenerateMultipleCertificateWithNewCA
CertificateToolTests.testTrustBetweenPEMandPKCS12
CertificateToolTests.testCreateCaAndMultipleInstances

It appears like a racy bug that we can get around in tests. I'll take a closer look a bit later today.

[martijnvg]

@albertzaharovits It looks like the tests you mentioned failed about 6 times last night. Should these tests be muted until a fix has been pushed?

[albertzaharovits]

@martijnvg The suggested work-arounds don't work, but I hope this will be fixed soon.
I'm tempted to mute, but I will try to find a way to skip these for JDK8 runs only.