On Thu, 11 Sep 2025 18:40:43 GMT, Sean Mullan <mul...@openjdk.org> wrote:
>> Artur Barashev has updated the pull request with a new target base due to a >> merge or a rebase. The pull request now contains eight commits: >> >> - Merge branch 'master' into Check_RSASSA-PSS_cert_params >> >> # Conflicts: >> # >> src/java.base/share/classes/sun/security/ssl/X509KeyManagerCertChecking.java >> - Add a TrustManager check >> - Fix key algorithm bug. Add more test cases >> - Use null instead of SIGNATURE_CONSTRAINTS_MODE.NONE >> - Use default constraints if SIGNATURE_CONSTRAINTS_MODE is NONE. Log >> warning and return true on InvalidParameterSpecException >> - Address review comments >> - More test cases >> - 8367104: Check for RSASSA-PSS parameters when validating certificates >> against algorithm constraints > > src/java.base/share/classes/sun/security/ssl/X509TrustManagerImpl.java line > 462: > >> 460: >> 461: // Additional certificate chain check to verify the signature >> 462: // algorithms with the corresponding signing keys. > > Suggest rewording: "Additional certificate chain check to verify that the > algorithm constraints permit the signature algorithms to be used with the > corresponding signing keys." Done, thanks! ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/27146#discussion_r2342277956
