5561: Support for Crypto Events in JMC by Suchitainf · Pull Request #686 · openjdk/jmc

Suchitainf · 2025-11-17T10:44:40Z

This PR enhances the JMC UI for adding new information related to crypto events: specifically X509CertificateEvent.

This PR adds a new rule with respect to X509CertificateEvent which provides alert related to expired/expiring certificates and weak signature algorithms or weak key length or key type. The rule gives a basic overview of all the certificate ids which needs action or attention, however complete details are provided as part of a new screen - Security.

Attaching the screenshots here for better reference:

Rule Page:

Security Screen Page:

Progress

Commit message must refer to an issue
Change must be properly reviewed (1 review required, with at least 1 Committer)

Issue

JMC-5561: Support for Crypto Events in JMC (New Feature - P2)

Reviewers

Marcus Hirt (@thegreystone - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jmc.git pull/686/head:pull/686
$ git checkout pull/686

Update a local copy of the PR:
$ git checkout pull/686
$ git pull https://git.openjdk.org/jmc.git pull/686/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 686

View PR using the GUI difftool:
$ git pr show -t 686

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jmc/pull/686.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-11-17T10:46:48Z

👋 Welcome back schaturvedi! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-11-17T10:47:04Z

@Suchitainf This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

5561: Support for Crypto Events in JMC

Reviewed-by: hirt

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 4 new commits pushed to the master branch:

a3b850a: 8545: Update Jolokia third party to 2.5.1
151a108: 8536: Add files under core/license to sources jars of jmc/core submodules
e83d2e8: 8554: Fix copyright year check script
... and 1 more: https://git.openjdk.org/jmc/compare/8d51efa4b84082822ced5c3901885bd6eb28a409...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

mlbridge · 2025-11-17T10:51:12Z

Webrevs

thegreystone · 2025-12-02T17:53:55Z

+
+   <context id="security">
+      <description></description>
+      <topic href="PLUGINS_ROOT/org.openjdk.jmc.docs/html/GUID-4F885E48-A548-4140-B985-74B1685BEDEA.htm" label="Using the Security Page" />


This seems to link to the exact same page as Using the TLAB Allocations Page. Copy/Paste error?

Should perhaps the messages be more action oriented?

Certificate with id x expired t days ago. It should be replaced.

Certificate with id y is using SHA-1. It should be updated to use SHA-256 or SHA-512.

This seems to link to the exact same page as Using the TLAB Allocations Page. Copy/Paste error?

Yes, I have added that link as placeholder for the respective html help page then forgot to update it. Is there any tool to generate the html help page or any other easy way? OR we need to write that completely from scratch.

These were previously handled by the documentation team at Oracle, but they aren't anymore. You'll have to add a documentation page from scratch.

openjdk · 2025-12-23T22:25:00Z

@Suchitainf this pull request can not be integrated into master due to one or more merge conflicts. To resolve these merge conflicts and update this pull request you can run the following commands in the local repository for your personal fork:

git checkout 5561
git fetch https://git.openjdk.org/jmc.git master
git merge FETCH_HEAD
# resolve conflicts and follow the instructions given by git merge
git commit -m "Merge master"
git push

Suchitainf · 2025-12-23T22:27:07Z

Hi @thegreystone I have updated the action items in the Rules as per your suggestion. However, for HTML page I would need some help from docs team. As they are designed in some different way. Meanwhile, I have added a placeholder page and I have created a new ticket to track it separately. https://bugs.openjdk.org/browse/JMC-8487

Request you to kindly approve this PR if you dont have any other suggestions.

bridgekeeper · 2026-01-21T05:45:38Z

@Suchitainf This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

thegreystone · 2026-02-02T13:22:01Z

+		return icon;
+	}
+
+	public static String getCryptoRuleResult(


There is a lot of code duplication. How about separating out some of the key functionality, e.g. :

private static boolean isWeakSignatureAlgorithm(String signatureAlgorithm) {
return signatureAlgorithm.contains("MD2") || signatureAlgorithm.contains("MD5");
}

Both MD2 and MD5 have different logics of handling. Hence, i don't think we can merge them together.

thegreystone · 2026-02-02T13:25:49Z

+		return remark;
+	}
+
+	public static String getCryptoIcon(


Splitting up the determination of the severity level and then deciding at the icon at the end might be cleaner. Perhaps using an enum for the severity level.

Icon is just a string here which will be used later to show the specific icon.

bridgekeeper · 2026-03-04T00:04:28Z

@Suchitainf This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

Suchitainf · 2026-03-04T05:33:26Z

/touch

openjdk · 2026-03-04T05:34:03Z

@Suchitainf The pull request is being re-evaluated and the inactivity timeout has been reset.

openjdk · 2026-03-23T07:51:01Z

⚠️ @Suchitainf This pull request contains merges that bring in commits not present in the target repository. Since this is not a "merge style" pull request, these changes will be squashed when this pull request in integrated. If this is your intention, then please ignore this message. If you want to preserve the commit structure, you must change the title of this pull request to Merge <project>:<branch> where <project> is the name of another project in the OpenJDK organization (for example Merge jdk:master).

thegreystone · 2026-03-23T10:28:32Z

+<div class="ind"><a id="SecurityPage" name="SecurityPage"></a><!-- End Header -->
+<h1 id="JMCOH-SecurityPage" class="sect1">Using the Security Page</h1>
+<div><p>The security page is designed to display information related to certificates used. It mainly displays the information derived from X509Certificate events. </p>
+<p>There is one table which shows information related to the cryptographic algorithm. For ex: Signature Algorithm, Key type, Key length, Certificate Valid from, Certificate expiring on, Certificate Id and Issuer details. </p>


Unnecessary abbreviation. Just write out example.

thegreystone · 2026-03-23T10:30:07Z

+<li>Attention Needed. SHA-1 signature. It should be updated to use SHA-256 or SHA-512.</li>
+</ul>
+</div>
+<p>If everything is fine we are displaying OK as crypto remark.</p>


How about "Certificates with no issues are marked with an OK status in the Crypto Remark column."?

thegreystone · 2026-03-23T10:33:15Z

+	};
+
+	public static final IAttribute<IQuantity> VALID_FROM = new Attribute<IQuantity>("validFrom", //$NON-NLS-1$
+			Messages.getString(Messages.ATTR_VALID_FROM), Messages.getString(Messages.ATTR_RSS_PEAK_DESC), TIMESTAMP) {


Wrong description! (Messages.ATTR_RSS_PEAK_DESC)

thegreystone · 2026-03-23T10:33:23Z

+	};
+
+	public static final IAttribute<IQuantity> VALID_UNTIL = new Attribute<IQuantity>("validUntil", //$NON-NLS-1$
+			Messages.getString(Messages.ATTR_VALID_UNTIL), Messages.getString(Messages.ATTR_RSS_PEAK_DESC), TIMESTAMP) {


Wrong description! (Messages.ATTR_RSS_PEAK_DESC)

thegreystone · 2026-03-23T10:36:13Z

+			IQuantity duration = expiryDate.subtract(UnitLookup.EPOCH_MS.quantity(System.currentTimeMillis()));
+			long expiringInDays = TimeUnit.MILLISECONDS.toDays(duration.longValue());
+
+			if ((expiringInDays > 0) && (expiringInDays < 90)) {


Should perhaps expiry warning threshold be configurable?

thegreystone · 2026-03-26T11:41:51Z

+					.build();
+		} else {
+			return ResultBuilder.createFor(CryptoSecurityRule.this, valueProvider).setSeverity(Severity.OK)
+					.setSummary("OK").build();


Nit: Should this be hardcoded?

Suchitainf · 2026-03-26T14:23:46Z

/integrate

openjdk · 2026-03-26T14:26:45Z

Going to push as commit bde624e.
Since your change was applied there have been 4 commits pushed to the master branch:

a3b850a: 8545: Update Jolokia third party to 2.5.1
151a108: 8536: Add files under core/license to sources jars of jmc/core submodules
e83d2e8: 8554: Fix copyright year check script
... and 1 more: https://git.openjdk.org/jmc/compare/8d51efa4b84082822ced5c3901885bd6eb28a409...master

Your commit was automatically rebased without conflicts.

openjdk · 2026-03-26T14:26:58Z

@Suchitainf Pushed as commit bde624e.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

5561: Support for Crypto Events in JMC

2a763af

openjdk Bot added the rfr label Nov 17, 2025

thegreystone self-requested a review December 2, 2025 16:21

thegreystone requested changes Dec 2, 2025

View reviewed changes

Implemented review comments

38ce9bd

openjdk Bot added the merge-conflict Pull request has merge conflict with target branch label Dec 23, 2025

Merge master

2741e02

openjdk Bot removed the merge-conflict Pull request has merge conflict with target branch label Dec 23, 2025

Suchitainf requested a review from thegreystone December 23, 2025 22:36

Fixing spotless failure

547cc3f

thegreystone requested changes Feb 2, 2026

View reviewed changes

thegreystone reviewed Feb 2, 2026

View reviewed changes

Comment thread application/org.openjdk.jmc.ui/src/main/java/org/openjdk/jmc/ui/UIPlugin.java

Implemented review comments

a4ac49c

Suchitainf requested a review from thegreystone February 3, 2026 22:00

Suchitainf added 3 commits February 4, 2026 03:41

Update copyright year in IRule file

a662ab0

Merge branch 'openjdk:master' into 5561

547c384

Update copyright for datadog as well

bb62649

Suchitainf added 4 commits March 20, 2026 19:15

Modified doc pages for contextual help

e93bc57

Merge branch 'openjdk:master' into 5561

dc16111

Copyright update

226b00f

Merge branch '5561' of https://github.com/Suchitainf/jmc into 5561

4b03b5c

thegreystone requested changes Mar 23, 2026

View reviewed changes

Implemented review comments

9366014

Suchitainf requested a review from thegreystone March 25, 2026 13:43

thegreystone approved these changes Mar 26, 2026

View reviewed changes

openjdk Bot added the ready label Mar 26, 2026

openjdk Bot added the integrated label Mar 26, 2026

openjdk Bot closed this Mar 26, 2026

openjdk Bot removed ready rfr labels Mar 26, 2026

Conversation

Suchitainf commented Nov 17, 2025 • edited by openjdk Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Reviewing

Uh oh!

bridgekeeper Bot commented Nov 17, 2025

Uh oh!

openjdk Bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mlbridge Bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openjdk Bot commented Dec 23, 2025

Uh oh!

Suchitainf commented Dec 23, 2025

Uh oh!

bridgekeeper Bot commented Jan 21, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bridgekeeper Bot commented Mar 4, 2026

Uh oh!

Suchitainf commented Mar 4, 2026

Uh oh!

openjdk Bot commented Mar 4, 2026

Uh oh!

openjdk Bot commented Mar 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Suchitainf commented Mar 26, 2026

Uh oh!

openjdk Bot commented Mar 26, 2026

Uh oh!

openjdk Bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Suchitainf commented Nov 17, 2025 •

edited by openjdk Bot

Loading

openjdk Bot commented Nov 17, 2025 •

edited

Loading

mlbridge Bot commented Nov 17, 2025 •

edited

Loading