JDK-8288728 : Support for signature SHA256withECDSA for intermediate certificates.
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.security
  • Affected Version: 8
  • Priority: P4
  • Status: Closed
  • Resolution: Incomplete
  • OS: generic
  • CPU: generic
  • Submitted: 2022-06-14
  • Updated: 2022-07-08
  • Resolved: 2022-07-07
Related Reports
Relates :  
JDK-8225745 - NoSuchAlgorithmException exception for SHA256withECDSA with RSASSA-PSS support
Description
ADDITIONAL SYSTEM INFORMATION :
RHEL 8.3

A DESCRIPTION OF THE PROBLEM :
With open jdk 1.8.0.292 we can correctly access certificates having signature SHA256withECDSA for all the curves
For the certificates that are signed by a root certificate, we see the NoSuchAlgorithm exception => we tried using SunEC, BCFIPS and BC providers 

Caused by: java.security.NoSuchAlgorithmException: no such algorithm: SHA256withECDSA for provider SunEC
	at sun.security.jca.GetInstance.getService(GetInstance.java:101)
	at sun.security.jca.GetInstance.getInstance(GetInstance.java:218)
	at java.security.Security.getImpl(Security.java:739)
	at java.security.AlgorithmParameters.getInstance(AlgorithmParameters.java:244)
	at org.bouncycastle.jcajce.provider.X509SignatureUtil.setSignatureParameters(Unknown Source)
	at org.bouncycastle.jcajce.provider.X509CertificateObject.checkSignature(Unknown Source)
	at org.bouncycastle.jcajce.provider.X509CertificateObject.verify(Unknown Source)
	at com.cisco.cpm.infrastructure.certmgmt.util.CertMgmtUtils.isIssuingCert(CertMgmtUtils.java:784)


================================
Same issue for BCFIPS
Caused by: java.security.NoSuchAlgorithmException: no such algorithm: SHA256withECDSA for provider BCFIPS
	at sun.security.jca.GetInstance.getService(GetInstance.java:101)
	at sun.security.jca.GetInstance.getInstance(GetInstance.java:218)
	at java.security.Security.getImpl(Security.java:739)
	at java.security.AlgorithmParameters.getInstance(AlgorithmParameters.java:244)
	at org.bouncycastle.jcajce.provider.X509SignatureUtil.setSignatureParameters(Unknown Source)
	at org.bouncycastle.jcajce.provider.X509CertificateObject.checkSignature(Unknown Source)
	at org.bouncycastle.jcajce.provider.X509CertificateObject.verify(Unknown Source)
	at com.cisco.cpm.infrastructure.certmgmt.util.CertMgmtUtils.isIssuingCert(CertMgmtUtils.java:784)
Comments
Requested the submitter try a later version of the JDK 17u or later and provide a reproducer. Also Suggested reporting the issue to Red Hat if it works on JDK 17u and later.
08-07-2022
Moved to JDK for further investigations.
20-06-2022
This seems related to JDK-8225745
20-06-2022