Oracle JDK 17 SpringBoot "java.lang.SecurityException: JCE cannot authenticate the provider BC"

[wolf-hunter404]

BC version: 1.83，No problem
BC version: 1.84，Error
Deploying in the form of a JAR package without unpacking it, just routine vulnerability fixes and upgrades.

[dghgit]

I've confirmed the jar is correctly signed.

What's the stack trace look like?

[wolf-hunter404]

I've confirmed the jar is correctly signed.

What's the stack trace look like?

This issue occurs quite strangely, under the same environment and JDK.
When running in an IDE, everything works normally, and dependency analysis shows only version 1.84.
However, when packaged as a Spring Boot executable JAR, it fails to run.
During system startup, when extracting SM2 keys from BKS based on alias, the decryption process at line 235 of org.bouncycastle.jcajce.provider.keystore.bc.BcKeyStoreSpi throws this error.
The error is swallowed and not properly propagated; only a "no match" message is thrown. We only discovered the root cause by using the debug version.

[wolf-hunter404]

I've confirmed the jar is correctly signed.

What's the stack trace look like?

By the way, you need to use Oracle JDK; OpenJDK is normal.

[dghgit]

My first guess would be there's two versions of BC in the classpath for the Oracle case. Alternately the jar file is getting unpacked by something, if the previous 1.83 version is decrypting keys this seems unlikely though.

Something else that just occurred to me, there's a Java25 directory in META-INF/versions. I'm not sure if springboot will cope with that on Java 17...

[wolf-hunter404]

My first guess would be there's two versions of BC in the classpath for the Oracle case. Alternately the jar file is getting unpacked by something, if the previous 1.83 version is decrypting keys this seems unlikely though.我的第一个猜测是，在Oracle的类路径中有两个版本的BC。或者，jar文件被某些东西解包，如果以前的1.83版本正在解密密钥，这似乎不太可能。

Something else that just occurred to me, there's a Java25 directory in META-INF/versions. I'm not sure if springboot will cope with that on Java 17...我刚刚想到的另一件事是，在META-INF/versions中有一个Java25目录。我不确定springboot是否能在Java 17上解决这个问题…

Would you like me to prepare a demo and commit it to the Git repository?

[dghgit]

If you can put together something small (so leave out the jars) and upload it as an attachment, that would help. The problem we always run into with things like this is getting the environment right.

[wolf-hunter404]

If you can put together something small (so leave out the jars) and upload it as an attachment, that would help. The problem we always run into with things like this is getting the environment right.如果你能把一些小的东西放在一起（所以不用罐子），并把它作为附件上传，那将会有帮助。我们在处理这类事情时经常遇到的问题是如何找到合适的环境。

this is simple demo, single function, no other special features.
https://github.com/wolf-hunter404/bc-java-springboot-demo-error.git

[dghgit]

I don't seem to be able to reproduce this, I'm using Java 17.0.19 - it's possible if your using a version of Java 17 prior to the KEM support been backported you might have an issue. What version of Java 17 are you using? Can you upgrade to Java 17.0.19?

[wolf-hunter404]

I don't seem to be able to reproduce this, I'm using Java 17.0.19 - it's possible if your using a version of Java 17 prior to the KEM support been backported you might have an issue. What version of Java 17 are you using? Can you upgrade to Java 17.0.19?

I have upgraded to version 17.0.19, and made a simple demo. you can check and run locally if it's convenient.