On Mon, 9 Nov 2026 22:54:35 GMT, Valerie Peng <[email protected]> wrote:
>> Daniel Jeliński has updated the pull request incrementally with one
>> additional commit since the last revision:
>>
>> Add bug ID
>
> test/jdk/sun/security/pkcs11/tls/fips/FipsModeTLS.java line 27:
>
>> 25: /*
>> 26: * @test
>> 27: * @bug 8029661 8325164 8368073 8368514 8368520 8396708
>
> Just wondering why this test is added with the bug id? Does this test fail or
> shows any different behavior for NSS 3.128+?
Yes. Without the changes the test is failing with:
javax.net.ssl.SSLException: (internal_error) No supported CertificateVerify
signature algorithm for RSA key
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:132)
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
at
java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:362)
at
java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:318)
at
java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
at
java.base/sun.security.ssl.CertificateVerify$T13CertificateVerifyMessage.<init>(CertificateVerify.java:916)
at
java.base/sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.onProduceCertificateVerify(CertificateVerify.java:1118)
at
java.base/sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.produce(CertificateVerify.java:1111)
that's because the configured keystore contains a RSA key which cannot be used
without RSA-PSS, and RSA-PSS is disabled because of overflow in the version
check.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/33751#discussion_r4522449427
