8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically

[gnu-andrew]

This change backports enhancements to the CertificateBuilder test library to allow automated generation of certificates. It also replaces the static certificate in IPIdentities.java and is a pre-requisite for backporting JDK-8384815

The change actually backports fairly cleanly. There are just a few context differences because of the absence of JDK-8350807, which makes IPIdentities.java explicitly use TLSv1.2, and JDK-8349501 which moves CertificateBuilder into the regular jdk.test.lib namespace.

A number of follow-ups, included as follow-on commits, are then needed to make IPIdentities.java pass, and then to make other CertificateBuilder-using classes pass again.

1. IPIdentities.java needs to have @library and @build lines added to use CertificateBuilder. This is based on its usage in existing test classes in 11u that already use it.
2. 11u does not have SecureRandom.nextLong(long) so I ported this from java.util.random.RandomGenerator and jdk.internal.util.random.RandomSupport in 17u to jdk.test.lib.Utils. It is currently used by IPIdentities.java and CertificateBuilder.java and placing it in the library leaves the option open for other tests to use it.
3. JDK-8179502 is an enhancement change we don't want to backport, but it does update CertificateBuilder to actually consistently work to the Builder pattern, returning itself from its methods. This is necessary both for the usage introduced in this patch in IPIdentities.java and for the changes in 8384815, so builder invocations can be changed. I only included the return type changes from 8179502 and not the change to one of the methods.
4. Because CertificateBuilder now needs Utils from jdk.test.lib.Utils, a few tests that already used CertificateBuilder need to reference /test/lib.

I did start looking at backporting 8349501 but it is quite involved and has its own pre-requisites to explore. I wanted to make sure this and the follow-on could make the upcoming release and fix the currently broken test, so I worked around its absence for now. I do intend to backport it for the October release and this should clean up the dual library usage this change introduces by putting everything in jdk.test.lib.

Results for the tests which use CertificateBuilder look good with all passing after this patch.

$ make -C $HOME/builder/11u-dev run-test TEST="jtreg:sun/net/www/protocol/https jtreg:javax/net/ssl/Stapling jtreg:java/security/cert/CertPathValidator"
==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:test/jdk/sun/net/www/protocol/https            27    27     0     0   
   jtreg:test/jdk/javax/net/ssl/Stapling                 4     4     0     0   
   jtreg:test/jdk/java/security/cert/CertPathValidator
                                                        14    14     0     0   
==============================
TEST SUCCESS

---

• I confirm that I make this contribution in accordance with the OpenJDK Interim AI Policy.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8325766 needs maintainer approval

Issue

• JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically (Enhancement - P4)

Reviewers

• Severin Gehwolf (@jerboaa - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk11u-dev.git pull/3222/head:pull/3222
$ git checkout pull/3222

Update a local copy of the PR:
$ git checkout pull/3222
$ git pull https://git.openjdk.org/jdk11u-dev.git pull/3222/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 3222

View PR using the GUI difftool:
$ git pr show -t 3222

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk11u-dev/pull/3222.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back andrew! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 01: Full - Incremental (f5858bb6)
• 00: Full (cde0dc08)

[jerboaa]

Yes, this looks OK. I'll update #3214 to use the new Util.nextLong() utility once this is in.

[openjdk]

⚠️ @gnu-andrew This change is now ready for you to apply for maintainer approval. This can be done directly in each associated issue or by using the /approval command.

[jerboaa]

@gnu-andrew It appears one test change is missing:

diff --git a/test/jdk/sun/security/ssl/Stapling/StatusResponseManager.java b/test/jdk/sun/security/ssl/Stapling/StatusResponseManager.java
index 58ebb5b876..29aa1f2644 100644
--- a/test/jdk/sun/security/ssl/Stapling/StatusResponseManager.java
+++ b/test/jdk/sun/security/ssl/Stapling/StatusResponseManager.java
@@ -24,7 +24,7 @@
 /*
  * @test
  * @bug 8046321
- * @library ../../../../java/security/testlibrary
+ * @library /test/lib ../../../../java/security/testlibrary
  * @build CertificateBuilder SimpleOCSPServer
  * @run main/othervm -Djavax.net.debug=ssl:respmgr java.base/sun.security.ssl.StatusResponseManagerTests
  * @summary OCSP Stapling for TLS

[jerboaa]

See above.

[gnu-andrew]

test/jdk/sun/security/ssl/Stapling/StatusResponseManager.java

Ah, good catch. Not sure how I missed this. Maybe I assumed it was another instance of the other Stapling directory.

==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:test/jdk/sun/security/ssl/Stapling              1     1     0     0   
==============================

[jerboaa]

OK.

[gnu-andrew]

OK.

Thanks. I'll move this to 11u once all recent build promotions are pushed, but it'll otherwise be unchanged.

[gnu-andrew]

Moved to openjdk/jdk11u#120