The "certificate_authorities" extension is an optional extension introduced in TLS 1.3. It is used to indicate the certificate authorities (CAs) that an endpoint supports and should be used by the receiving endpoint to guide certificate selection.

With this JDK release, the "certificate_authorities" extension is supported for TLS 1.3 in both the client and the server sides.  This extension is always present for client certificate selection, while it is optional for server certificate selection.

Applications can enable this extension for server certificate selection by setting the `jdk.tls.client.enableCAExtension` system property to `true`.  The default value of the property is `false`.

Note that if the client trusts more CAs than the size limit of the extension (less than 2^16 bytes), the extension is not enabled.  Also, some server implementations do not allow handshake messages to exceed 2^14 bytes.  Consequently, there may be interoperability issues when `jdk.tls.client.enableCAExtension` is set to `true` and the client trusts more CAs than the server implementation limit.