[jdk11u-dev] RFR: 8340321: Disable SHA-1 in TLS/DTLS 1.2 handshake signatures
Antonio Vieiro
avieiro at openjdk.org
Fri Dec 5 12:16:36 UTC 2025
Backport of [JDK-8340321](https://bugs.openjdk.org/browse/JDK-8340321) from [JDK17](https://github.com/openjdk/jdk17u-dev/commit/86765246d95c9e9586540c5f865ba093dff92ffe), that [disables SHA-1 in TLS/DTLS 1.2 handshake signatures](https://www.java.com/en/configure_crypto.html#DisableSHA1_TLS_DTLS) to comply with the [Oracle JRE Cryptographic Roadmap](https://www.java.com/en/jre-jdk-cryptoroadmap.html).
Backport is not clean, as there many differences in `java.security` from 17 to 11.
Tested with `tier1` tests on Linux and with `run-test-jdk_security`, that includes the new three new tests:
==============================
Test summary
==============================
TEST TOTAL PASS FAIL ERROR
jtreg:test/jdk:jdk_security 1368 1368 0 0
==============================
TEST SUCCESS
NOTE: This PR is on top of prerrequisite #3130 .
-------------
Depends on: https://git.openjdk.org/jdk11u-dev/pull/3130
Commit messages:
- Backport 86765246d95c9e9586540c5f865ba093dff92ffe
Changes: https://git.openjdk.org/jdk11u-dev/pull/3131/files
Webrev: https://webrevs.openjdk.org/?repo=jdk11u-dev&pr=3131&range=00
Issue: https://bugs.openjdk.org/browse/JDK-8340321
Stats: 249 lines in 5 files changed: 246 ins; 0 del; 3 mod
Patch: https://git.openjdk.org/jdk11u-dev/pull/3131.diff
Fetch: git fetch https://git.openjdk.org/jdk11u-dev.git pull/3131/head:pull/3131
PR: https://git.openjdk.org/jdk11u-dev/pull/3131
More information about the jdk-updates-dev
mailing list