Is the extension actually being processed? sun.security.ssl.HandshakeHash.setCertificateVerifyAlg(String) appears to have no effect because the cvAlg member is never read. -- Florian Weimer / Red Hat Product Security Team