switched to the latest oracle/sun jdk 1.7, same result.

since the behavior is the same, i'm happy to switch back to 1.6. however, bouncy castle is still not registering properly. in reviewing the source code for apache sshd, in SecurityUtils.java i see the following, which suggests that an exception message/stack trace is being discarded in favor of a generic (and therefore useless) message. any suggestions on how to figure out why bouncy castle won't register?

    private static void register() {

        if (!registrationDone) {

            if (securityProvider == null && (registerBouncyCastle == null || registerBouncyCastle)) {

                // Use an inner class to avoid a strong dependency from SshServer on BouncyCastle

                try {

                    new BouncyCastleRegistration().run();

                } catch (Throwable t) {

                    if (registerBouncyCastle == null) {

                        LOG.info("BouncyCastle not registered, using the default JCE provider");

                    } else {

                        LOG.error("Failed to register BouncyCastle as the defaut JCE provider");

                        throw new RuntimeException("Failed to register BouncyCastle as the defaut JCE provider", t);

                    }

                }

            }

            registrationDone = true;

        }

    }

    private static class BouncyCastleRegistration {

        public void run() throws Exception {

            if (java.security.Security.getProvider(BOUNCY_CASTLE) == null) {

                LOG.info("Trying to register BouncyCastle as a JCE provider");

                java.security.Security.addProvider(new BouncyCastleProvider());

                MessageDigest.getInstance("MD5", BOUNCY_CASTLE);

                KeyAgreement.getInstance("DH", BOUNCY_CASTLE);

                LOG.info("Registration succeeded");

            } else {

                LOG.info("BouncyCastle already registered as a JCE provider");

            }

            securityProvider = BOUNCY_CASTLE;

        }

    }

still not solved yet, but i have new information.

i built a copy of apache sshd 0.5.0 and altered the SecurityUtil class slightly, so that it put the exception & stacktrace into the log instead of simply discarding it, and inserted the resulting class files into the appropriate bundle.jar. the result was the following, which suggest that the Oracle/Sun jdk is having issues validating the signed bouncy castle jce provider jar (openjdk 1.6 & 1.7 ignore the signatures on the JCE providers which is why i didn't see a problem with them). i haven't found much on the subject with respect to Fuse ESB, but apparently JBoss has similar issues.

the traces:

- sshd-core - 0.5.0 | BouncyCastle not registered, using the default JCE provider

java.security.NoSuchProviderException: JCE cannot authenticate the provider BC

        at javax.crypto.JceSecurity.getInstance(JceSecurity.java:101)

        at javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:223)

        at org.apache.sshd.common.util.SecurityUtils$BouncyCastleRegistration.run(SecurityUtils.java:97)[27:sshd-core:0.5.0]

...

Caused by: java.lang.SecurityException: Invalid signature file digest for Manifest main attributes

        at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:240)[:1.7.0]

        at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:193)[:1.7.0]

        at java.util.jar.JarVerifier.processEntry(JarVerifier.java:262)[:1.7.0]

        at java.util.jar.JarVerifier.update(JarVerifier.java:216)[:1.7.0]

i finally got the bouncy castle provider to show up. i had to register it statically with the jre by editing $JAVA_HOME/lib/security/java.security:

security.provider.9=org.bouncycastle.jce.provider.BouncyCastleProvider

and adding the bouncy castle jar to the classpath.

now i'm back to the "javax.net.ssl.SSLKeyException: RSA premaster secret error" issue which is more of a java crypto/httpclient thing than a Fuse ESB thing, i think. i have already installed the unlimited strength JCE policy files, so that's not it.

richard

ok, thanks. but another document calls for this:

org.apache.felix.karaf.security.providers = org.bouncycastle.jce.provider.BouncyCastleProvider

rather than this:

org.apache.karaf.security.providers = org.bouncycastle.jce.provider.BouncyCastleProvider

in config.properties. which is correct?

thanks,

   richard

ok trying it now.

note though, that the procedure i used that worked (static installation in the JRE) is technically correct too, the procedure you pointed out is just narrower in scope, which has some obvious advantages.

richard