git: openjdk/jdk17u-dev: 8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled

[Goetz Lindenmaier]

Changeset: c6e19d63
Branch: master
Author:    Goetz Lindenmaier <goetz at openjdk.org>
Date:      2025-09-02 08:37:30 +0000
URL:       https://git.openjdk.org/jdk17u-dev/commit/c6e19d6330e8474d97d791e2f7a476bd953562c7

8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled

Reviewed-by: mbaesken
Backport-of: 1cdf8f5497f2b986c13a1c263d806a31d67fe015

! src/java.base/share/classes/sun/security/ssl/CertSignAlgsExtension.java
! src/java.base/share/classes/sun/security/ssl/CertificateMessage.java
! src/java.base/share/classes/sun/security/ssl/CertificateRequest.java
! src/java.base/share/classes/sun/security/ssl/ClientHello.java
! src/java.base/share/classes/sun/security/ssl/PreSharedKeyExtension.java
! src/java.base/share/classes/sun/security/ssl/ServerHello.java
! src/java.base/share/classes/sun/security/ssl/SessionTicketExtension.java
! src/java.base/share/classes/sun/security/ssl/SignatureAlgorithmsExtension.java
! src/java.base/share/classes/sun/security/ssl/SignatureScheme.java
! test/jdk/javax/net/ssl/HttpsURLConnection/CriticalSubjectAltName.java
! test/jdk/javax/net/ssl/templates/SSLSocketTemplate.java
! test/jdk/sun/net/www/protocol/https/HttpsURLConnection/DNSIdentities.java
! test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPAddressIPIdentities.java
! test/jdk/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java
! test/jdk/sun/net/www/protocol/https/HttpsURLConnection/Identities.java
+ test/jdk/sun/security/ssl/SignatureScheme/MD5NotAllowedInTLS13CertificateSignature.java