> [JDK-8349583](https://bugs.openjdk.org/browse/JDK-8349583) implementation > assumes that OpenJDK client always sends "signature_algorithms_cert" > extension together with "signature_algorithms" extension. But we didn't > account for `jdk.tls.client.disableExtensions` and > `jdk.tls.server.disableExtensions` system properties which can disable > producing "signature_algorithms_cert" extension. This is an issue similar to > [JDK-8355779](https://bugs.openjdk.org/browse/JDK-8355779) but on the > extension producing side. > > Per TLSv1.3 RFC: > >> If no "signature_algorithms_cert" extension is >> present, then the "signature_algorithms" extension also applies to >> signatures appearing in certificates. > > Also making a few cosmetic changes to the existing code.
Artur Barashev has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains 10 additional commits since the last revision: - Add a positive test case - Merge branch 'master' into JDK-8365820 - Add a ticket number to unit tests - Merge branch 'master' into JDK-8365820 - Add a server-side unit test. Rename existing tests. - Update tests - Revert "Include RSASSA-PKCS1-v1_5 and Legacy algorithms in signature_algorithms for TLSv1.3" This reverts commit adc236be4bcac11614e2741c99545aa593f6af5b. - Merge branch 'master' into JDK-8365820 - Include RSASSA-PKCS1-v1_5 and Legacy algorithms in signature_algorithms for TLSv1.3 - 8365820: Apply certificate scope constraints to algorithms in "signature_algorithms" extension when "signature_algorithms_cert" extension is not being sent ------------- Changes: - all: https://git.openjdk.org/jdk/pull/26887/files - new: https://git.openjdk.org/jdk/pull/26887/files/b934cd1b..360ac544 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=26887&range=06 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=26887&range=05-06 Stats: 140199 lines in 1389 files changed: 121475 ins; 10503 del; 8221 mod Patch: https://git.openjdk.org/jdk/pull/26887.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/26887/head:pull/26887 PR: https://git.openjdk.org/jdk/pull/26887
