JDK-8226712 : Certificate selection should be affected by the supported groups
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 11,12,13
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • Submitted: 2019-06-25
  • Updated: 2019-08-14
  • Resolved: 2019-08-14
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 14
14Resolved
Related Reports
Duplicate :  
JDK-8229720 - New JSSE APIs to configure named groups and signature algorithms
Description
Please consider the below case,
1. The key store contains two ECDSA certificates, which use secp256r1 and secp384r1 respectively.
2. Limit the supported groups to sepc384r1 only.
The ECDSA with secp256r1 certificate may be selected as unexpected.

This issue would raise on TLSv1.2 and earlier protocols.
Comments
The issue should be addressed in JDK-8229720, when new session properties for named groups are added.
14-08-2019
The attached CertSelectionTest.java can reproduce this issue. The debug logs contain: javax.net.ssl|DEBUG|01|main|2019-06-25 11:03:47.409 CST|X509KeyManagerImpl.java:389|KeyMgr: choosing key: cert-ecdsa-secp256 (verified: OK) javax.net.ssl|WARNING|01|main|2019-06-25 11:03:47.410 CST|X509Authentication.java:353|Unsupported named group (SECP256_R1) used in the 1.0.cert-ecdsa-secp256 certificate javax.net.ssl|ERROR|01|main|2019-06-25 11:03:47.413 CST|TransportContext.java:316|Fatal (HANDSHAKE_FAILURE): no cipher suites in common ( "throwable" : { javax.net.ssl.SSLHandshakeException: no cipher suites in common at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:311) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:267) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:258) at java.base/sun.security.ssl.ServerHello$T12ServerHelloProducer.chooseCipherSuite(ServerHello.java:470) at java.base/sun.security.ssl.ServerHello$T12ServerHelloProducer.produce(ServerHello.java:296) at java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:440) at java.base/sun.security.ssl.ClientHello$T12ClientHelloConsumer.consume(ClientHello.java:1120) at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:853) at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:812) at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422) at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:181) at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164) at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1455) at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1363) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:437) at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:878) at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:969) at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:929) at CertSelectionTest.runServerApplication(CertSelectionTest.java:79) at CertSelectionTest.doServerSide(CertSelectionTest.java:264) at CertSelectionTest.startServer(CertSelectionTest.java:690) at CertSelectionTest.bootup(CertSelectionTest.java:604) at CertSelectionTest.run(CertSelectionTest.java:68) at CertSelectionTest.main(CertSelectionTest.java:61)} )
25-06-2019