Skip to content

8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled #2085

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 2 commits into from
Closed

8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled #2085

wants to merge 2 commits into from

Conversation

GoeLin
Copy link
Member

@GoeLin GoeLin commented Aug 13, 2025 •
edited by openjdk bot
Loading

I backport this for parity with 21.0.9-oracle.

Resolved one copyright. It is already at 2025.

But test MD5NotAllowedInTLS13CertificateSignature.java is failing.
It throws ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0
at MD5NotAllowedInTLS13CertificateSignature.lambda$main$1(MD5NotAllowedInTLS13CertificateSignature.java:100)

It expects an array of length 1 containing the exception javax.net.ssl.SSLHandshakeException: (bad_certificate) PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: MD5withRSA

All other testing, i.e. our nighlties and the tests touched here, pass.

Progress

  • Change must be properly reviewed (1 review required, with at least 1 Reviewer)
  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • JDK-8350807 needs maintainer approval

Issue

  • JDK-8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled (Bug - P3 - Approved)

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk21u-dev.git pull/2085/head:pull/2085
$ git checkout pull/2085

Update a local copy of the PR:
$ git checkout pull/2085
$ git pull https://git.openjdk.org/jdk21u-dev.git pull/2085/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 2085

View PR using the GUI difftool:
$ git pr show -t 2085

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk21u-dev/pull/2085.diff

Using Webrev

Link to Webrev Comment

@bridgekeeper
Copy link

bridgekeeper bot commented Aug 13, 2025

👋 Welcome back goetz! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk
Copy link

openjdk bot commented Aug 13, 2025 •
edited
Loading

@GoeLin This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled

Reviewed-by: mbaesken

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 12 new commits pushed to the master branch:

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

@openjdk openjdk bot changed the title backport abb23828f9dc5f4cdb75d5b924dd6f45925102cd 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled Aug 13, 2025
@openjdk
Copy link

openjdk bot commented Aug 13, 2025

This backport pull request has now been updated with issue from the original commit.

@openjdk openjdk bot added backport Port of a pull request already in a different code base clean Identical backport; no merge resolution required labels Aug 13, 2025
@GoeLin GoeLin force-pushed the goetz_backport_8350807 branch from c2635d4 to 7c9d000 Compare August 22, 2025 13:07
TheRealMDoerr
TheRealMDoerr reviewed Aug 23, 2025
View reviewed changes
test/jdk/sun/security/ssl/SignatureScheme/MD5NotAllowedInTLS13CertificateSignature.java Outdated
CertificateBuilder builder = new CertificateBuilder()
.setSubjectName(subjectName)
.setPublicKey(publicKey)
.setNotAfter(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be setNotBefore. This makes the test work and avoids the NullPointerException which we have seen. This was fixed in head by openjdk/jdk@e544cd9#diff-d1ab84463ba0a7169ea2a4709b6860c8c943251adc4366f93cbc1d230247ef56R219.

@openjdk openjdk bot removed the clean Identical backport; no merge resolution required label Aug 23, 2025
@GoeLin GoeLin marked this pull request as ready for review August 23, 2025 18:50
@openjdk openjdk bot added the rfr Pull request is ready for review label Aug 23, 2025
@GoeLin
Copy link
Member Author

GoeLin commented Aug 23, 2025

Hi Martin, thanks, that helps!!

@mlbridge
Copy link

mlbridge bot commented Aug 23, 2025

Webrevs

@GoeLin
Copy link
Member Author

GoeLin commented Aug 25, 2025

OK, this now also passed our internal testing, including the new test.

@MBaesken
Copy link
Member

src/java.base/share/classes/sun/security/ssl/CertificateMessage.java
has the COPYRIGHT header changed in the jdk PR, but not here, why ?
Please compare to https://patch-diff.githubusercontent.com/raw/openjdk/jdk/pull/24425.diff .

@MBaesken
Copy link
Member

Otherwise looks okay to me, thanks for backporting.

@GoeLin
Copy link
Member Author

GoeLin commented Aug 27, 2025 •
edited
Loading

Hi @MBaesken
the copyright of that file already lists 2025 in 21.
Thanks for the review.

@MBaesken
Copy link
Member

the copyright of that file already lists 2025 in 21.

okay that's why I did not see it when looking at the 'diff of the diffs' .

@openjdk
Copy link

openjdk bot commented Aug 27, 2025

⚠️ @GoeLin This change is now ready for you to apply for maintainer approval. This can be done directly in each associated issue or by using the /approval command.

@openjdk openjdk bot added approval Requires approval; will be removed when approval is received ready Pull request is ready to be integrated and removed approval Requires approval; will be removed when approval is received labels Aug 27, 2025
@GoeLin
Copy link
Member Author

GoeLin commented Sep 1, 2025

/integrate

@openjdk
Copy link

openjdk bot commented Sep 1, 2025

Going to push as commit 1cdf8f5.
Since your change was applied there have been 13 commits pushed to the master branch:

Your commit was automatically rebased without conflicts.

@openjdk openjdk bot added the integrated Pull request has been integrated label Sep 1, 2025
@openjdk openjdk bot closed this Sep 1, 2025
@openjdk openjdk bot removed the ready Pull request is ready to be integrated label Sep 1, 2025
@openjdk openjdk bot removed the rfr Pull request is ready for review label Sep 1, 2025
@openjdk
Copy link

openjdk bot commented Sep 1, 2025

@GoeLin Pushed as commit 1cdf8f5.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

@GoeLin GoeLin deleted the goetz_backport_8350807 branch September 1, 2025 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
2 more reviewers

@TheRealMDoerr TheRealMDoerr TheRealMDoerr left review comments

@MBaesken MBaesken MBaesken approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees
No one assigned
Labels
backport Port of a pull request already in a different code base integrated Pull request has been integrated
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@GoeLin @MBaesken @TheRealMDoerr