[jdk11u-dev] RFR: 8355779: When no "signature_algorithms_cert" extension is present we do not apply certificate scope constraints to algorithms in "signature_algorithms" extension

[Severin Gehwolf]

On Tue, 24 Feb 2026 08:29:54 GMT, Antonio Vieiro <avieiro at openjdk.org> wrote:

>> Clean backport of [JDK-8355779](https://bugs.openjdk.org/browse/JDK-8355779) as a follow-up of [JDK-8349583](https://bugs.openjdk.org/browse/JDK-8349583) on #3130.
>> 
>> Security tests pass:
>> 
>> 
>> ==============================
>> Test summary
>> ==============================
>>    TEST                                              TOTAL  PASS  FAIL ERROR   
>>    jtreg:test/jdk:jdk_security                        1366  1366     0     0   
>> ==============================
>> TEST SUCCESS
>
> Retested, all good. It might have been a local misconfiguration. Good to go.
> 
> 
> ==============================
> Test summary
> ==============================
>    TEST                                              TOTAL  PASS  FAIL ERROR   
>    jtreg:test/jdk:jdk_security                        1366  1366     0     0   
> ==============================
> TEST SUCCESS

@vieiro Please apply for approval together with https://github.com/openjdk/jdk11u-dev/pull/3130 once ready. Thanks!

-------------

PR Comment: https://git.openjdk.org/jdk11u-dev/pull/3161#issuecomment-3958223991