On Fri, 31 Jul 2026 06:56:40 GMT, Andreas Chmielewski <[email protected]> wrote:
>> I want to propose this enhancement. Please see the CSR. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Andreas Chmielewski has updated the pull request incrementally with one > additional commit since the last revision: > > Review there are 2 easy options to ensure that the PKCS11 generator is used: either use the FIPS mode (see `test/jdk/sun/security/pkcs11/tls/fips/FipsModeTLS.java`), which ensures that keys are only usable by the PKCS11 provider, or remove the SunJCE provider, ensuring that the SunPKCS11 implementation is the only one available. Alternatively, you could add an explicit check that the `SunTlsExtendedMasterSecret` in the PKCS11 provider is usable. Here the SunJCE implementation was used because the SunPKCS11 implementation was throwing exceptions and a fallback was required. There's no easy way to check which provider was used at run time, and the hard ways are probably out of scope for this PR. ------------- PR Comment: https://git.openjdk.org/jdk/pull/32081#issuecomment-5395061933
