JDK-8288794 : SSLExtension has incorrect name for PADDING and CLIENT_CERT_TYPE
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 8,11
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2022-06-21
  • Updated: 2024-09-03
  • Resolved: 2024-08-29
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 8
11.0.26-oracle masterFixed 8u441Fixed
Related Reports
Relates :  
JDK-8166596 - TLS support for the EdDSA signature algorithm
Description
Ben Smyth reported this on the security-dev mailing list https://mail.openjdk.org/pipermail/security-dev/2022-June/031003.html:

We have

    // extensions defined in RFC 7250
    CLIENT_CERT_TYPE        (0x0013, "padding"),
    SERVER_CERT_TYPE        (0x0014, "server_certificate_type"),

    // extensions defined in RFC 7685
    PADDING                 (0x0015, "client_certificate_type"),

We should have

    // extensions defined in RFC 7250
    CLIENT_CERT_TYPE        (0x0013, "client_certificate_type"),
    SERVER_CERT_TYPE        (0x0014, "server_certificate_type"),

    // extensions defined in RFC 7685
    PADDING                 (0x0015, "padding"),


This issue has been fixed in Java 16 and above but is still an issue in lower versions like Java 8 and Java 11.
Comments
While the related JDK-8166596 does actually address this issue in 16+, I would suggest fixing this issue directly in 8 & 11 as it really only has an impact on log output. To backport JDK-8166596 would bring in the whole EdDSA/TLS feature and goes way beyond the scope of this particular bug.
19-08-2022