Hi Robert, Thanks for the report. I checked it and it's a real bug.
I've filed https://bugs.openjdk.org/browse/JDK-8396708. Best wishes, Weijun > On Nov 4, 2026, at 05:18, Robert Sturla <[email protected]> wrote: > > Hello, > > I would like to report a SunPKCS11 bug affecting NSS versions with a minor > version of 128 or greater. The Java bug submission form returns “Access > Denied” when I try to report the same through there. Please could someone > help file a JBS issue? > The issue was reproduced on Linux x86_64 with upstream OpenJDK 25.0.2+10-69 > and NSS 3.132. > (Disclaimer - first-time mailing list user, not too sure how to format code > blocks, etc.) > > In `SunPKCS11.initToken()`, the NSS version check includes: > > ``` > nssVersion.major == 3 && nssVersion.minor < 65 > ``` > > CK_VERSION.minor is a signed Java byte. For NSS 3.132, its value is therefore > -124. This incorrectly triggers the workaround that disables RSA-PSS > mechanisms for NSS versions older than 3.65. > > Expected result: > NSS 3.132 should pass the version check, and SunPKCS11 should expose the > RSASSA-PSS signature algorithm. > > Actual result: > ``` > NSS advertises RSA-PSS mechanisms, but SunPKCS11 disables them: > hardwareVersion: 3.132 > ... > Mechanism CKM_RSA_PKCS_PSS: > ... > DISABLED due to known issue with NSS > ... > Provider: SunPKCS11-NSSRepro > RSA-PSS service: null > Exception in thread "main" java.security.NoSuchAlgorithmException: > no such algorithm: RSASSA-PSS for provider SunPKCS11-NSSRepro > ``` > > Steps to reproduce: > Save the following as NssPssRepro.java: > > ``` > import java.nio.file.Files; > import java.nio.file.Path; > import java.security.Provider; > import java.security.Security; > import java.security.Signature; > > public class NssPssRepro { > public static void main(String[] args) throws Exception { > Path config = Files.createTempFile("nss-repro-", ".cfg"); > try { > Files.writeString(config, """ > name = NSSRepro > nssLibraryDirectory = %s > nssDbMode = noDb > nssModule = crypto > showInfo = true > """.formatted(args[0])); > > Provider provider = Security.getProvider("SunPKCS11") > .configure(config.toString()); > > System.out.println("Provider: " + provider.getName()); > System.out.println("RSA-PSS service: " > + provider.getService("Signature", "RSASSA-PSS")); > > Signature.getInstance("RSASSA-PSS", provider); > System.out.println("PASS: RSA-PSS is available"); > } finally { > Files.deleteIfExists(config); > } > } > } > ``` > > Save the following as Containerfile in the same directory: > ``` > FROM container-registry.oracle.com/java/openjdk:25 AS upstream > FROM docker.io/library/debian:bookworm-slim > > RUN printf '%s\n' 'deb http://deb.debian.org/debian sid main' \ > > /etc/apt/sources.list.d/nss-repro.list > > RUN apt-get update && \ > DEBIAN_FRONTEND=noninteractive apt-get install -y -t sid \ > --no-install-recommends libnss3 libstdc++6 zlib1g && \ > rm -rf /var/lib/apt/lists/* > > COPY --from=upstream /usr/java/jdk-25 /opt/jdk-25 > ENV JAVA_HOME=/opt/jdk-25 > ENV PATH=/opt/jdk-25/bin:$PATH > > COPY NssPssRepro.java /repro/NssPssRepro.java > ``` > > Build and run on Linux x86_64: > ``` > $ podman build -t localhost/nss-pss-repro -f Containerfile . > > $ podman run --rm localhost/nss-pss-repro \ > java -version > > $ podman run --rm localhost/nss-pss-repro \ > dpkg-query -W libnss3 > > $ podman run --rm localhost/nss-pss-repro \ > java /repro/NssPssRepro.java /usr/lib/x86_64-linux-gnu > ``` > > The container copies the unchanged JDK from Oracle’s upstream OpenJDK image > into a Debian environment with newer NSS. The tested versions were: > > openjdk version "25.0.2" 2026-01-20 > OpenJDK Runtime Environment (build 25.0.2+10-69) > OpenJDK 64-Bit Server VM (build 25.0.2+10-69, mixed mode, sharing) > libnss3:amd64 2:3.132-1 > > The final command fails with NoSuchAlgorithmException. It should print PASS: > RSA-PSS is available. > > Thanks, > Robert > > -- > Robert Sturla Senior Software Engineer Red Hat [email protected]
