[jdk11u-dev] RFR: 8340321: Disable SHA-1 in TLS/DTLS 1.2 handshake signatures

[Antonio Vieiro]

On Fri, 5 Dec 2025 12:10:39 GMT, Antonio Vieiro <avieiro at openjdk.org> wrote:

> Backport of [JDK-8340321](https://bugs.openjdk.org/browse/JDK-8340321) from [JDK17](https://github.com/openjdk/jdk17u-dev/commit/86765246d95c9e9586540c5f865ba093dff92ffe), that [disables SHA-1 in TLS/DTLS 1.2 handshake signatures](https://www.java.com/en/configure_crypto.html#DisableSHA1_TLS_DTLS) to comply with the [Oracle JRE Cryptographic Roadmap](https://www.java.com/en/jre-jdk-cryptoroadmap.html).
> 
> Backport is not clean, as there many differences in `java.security` from 17 to 11.
> 
> Tested with `tier1` tests on Linux and with `run-test-jdk_security`, that includes the new three new tests:
> 
> 
> ==============================
> Test summary
> ==============================
>    TEST                                              TOTAL  PASS  FAIL ERROR   
>    jtreg:test/jdk:jdk_security                        1368  1368     0     0   
> ==============================
> TEST SUCCESS
> 
> 
> NOTE: This PR is on top of prerrequisite #3130 .

Rebased on top of #3161. Clean but for `conf/security/java.security`, which is different in 11 (Solaris support, for instance).

All security tests pass:


==============================
Test summary
==============================
   TEST                                              TOTAL  PASS  FAIL ERROR   
   jtreg:test/jdk:jdk_security                        1369  1369     0     0   
==============================
TEST SUCCESS


Ready for review now.

-------------

PR Comment: https://git.openjdk.org/jdk11u-dev/pull/3131#issuecomment-3950546795