JDK-8242417 : For tls mutual authentication, client certs are not getting send to the server
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 13.0.2
  • Priority: P4
  • Status: Closed
  • Resolution: Duplicate
  • OS: linux_ubuntu
  • CPU: x86_64
  • Submitted: 2020-03-31
  • Updated: 2021-01-07
  • Resolved: 2020-07-01
Related Reports
Duplicate :  
Description
ADDITIONAL SYSTEM INFORMATION :
This happened initially on Java 13 but I also tested the Java 15 with the same issue.

A DESCRIPTION OF THE PROBLEM :
We are using openssl to generate keys for tls 1.3 communication.  The handshake completes except the client certs are not sent to the server.  This is because the key and cert use ed25519 algorithm.  The X509Authentication enum does not support this.  I am not sure if there is a way to workaround this.

javax.net.ssl|WARNING|01|main|2020-03-31 14:43:13.232 EDT|CertificateMessage.java:1057|Unsupported authentication scheme: ed25519

                SSLAuthentication ka = X509Authentication.valueOf(ss);
                if (ka == null) {
                    if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
                        SSLLogger.warning(
                            "Unsupported authentication scheme: " + ss.name);
                    }
                    checkedKeyTypes.add(ss.keyAlgorithm);
                    continue;
                }


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Use openssl to generate keys and certs with algorithm ed25519 and use these for tls 1.3 mutual communication.

openssl genpkey -out "ca.key.pem" -outform PEM -algorithm ed25519
  openssl pkey -in ca.key.pem -pubout -out ca.pubkey.pem

  # generate self-signed CA cert
  openssl req -config ca.cnf -keyform PEM -key ca.key.pem -new -x509 -days 7300 -out ca.cert.pem


EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Excepted the handshake to complete successfully
ACTUAL -
Server does not get the client certs.

FREQUENCY : always



Comments
EdDSA is not yet supported in JDK. It is an upcoming feature: JDK-8166596
23-04-2020

Requested the test code and commands to reproduce the incident.
02-04-2020