JDK-8340321 : Disable SHA-1 in TLS/DTLS 1.2 signatures
  • Type: Enhancement
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Priority: P2
  • Status: In Progress
  • Resolution: Unresolved
  • Submitted: 2024-09-17
  • Updated: 2025-03-14
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 25
25Unresolved
Related Reports
Blocks :  
JDK-8349583 - Add mechanism to disable signature schemes based on their TLS scope
Relates :  
JDK-8301626 - Capture Key Exchange information in TLSHandshakeEvent
Description
RFC 9155 [1] deprecates the use of SHA-1 in TLS & DTLS 1.2 digital signatures. This does not affect SHA-1 in TLS server certificates which has already been disabled.

Other TLS implementations have started deprecating their usage. Chrome 117 has removed support for signature algorithms using SHA-1 for server signatures during the TLS handshake [2]. OpenSSL changed their default security level to 2 in version 3.2.0, and this level disables SHA-1 TLS signatures.

[1] https://www.rfc-editor.org/rfc/rfc9155.html
[2] https://chromestatus.com/feature/4832850040324096