Re: RFR: 8396708: SunPKCS11 disables RSA-PSS with NSS 3.128+ due to signed-byte version comparison [v2]

[Valerie Peng]

On Tue, 10 Nov 2026 08:06:44 GMT, Daniel Jeliński <djelin...@openjdk.org> wrote:

>> test/jdk/sun/security/pkcs11/tls/fips/FipsModeTLS.java line 27:
>> 
>>> 25: /*
>>> 26:  * @test
>>> 27:  * @bug 8029661 8325164 8368073 8368514 8368520 8396708
>> 
>> Just wondering why this test is added with the bug id? Does this test fail 
>> or shows any different behavior for NSS 3.128+?
>
> Yes. Without the changes the test is failing with:
> 
> javax.net.ssl.SSLException: (internal_error) No supported CertificateVerify 
> signature algorithm for RSA key
>         at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:132)
>         at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
>         at 
> java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:362)
>         at 
> java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:318)
>         at 
> java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
>         at 
> java.base/sun.security.ssl.CertificateVerify$T13CertificateVerifyMessage.<init>(CertificateVerify.java:916)
>         at 
> java.base/sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.onProduceCertificateVerify(CertificateVerify.java:1118)
>         at 
> java.base/sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.produce(CertificateVerify.java:1111)
> 
> that's because the configured keystore contains a RSA key which cannot be 
> used without RSA-PSS, and RSA-PSS is disabled because of overflow in the 
> version check.

I see, thanks for the clarification.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/33751#discussion_r4527688898