google / google/conscrypt

SHA256withRSA (and more) not supported in Java7ExtendedSSLSession

Open
#972 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

Using conscrypt-openjdk-uber on non-android java does not support SHA256 client auth certificates.
The error boils down to hardcoded value (see below). Tweaking only this value (e.g. in debugger) to include `SHA256withRSA` makes my certificate working.
`org.conscrypt.Java7ExtendedSSLSession` (and therefor also `org.conscryptJava8ExtendedSSLSession`) hard codes supported algorithms
```
// TODO: use BoringSSL API to actually fetch the real data
private static final String[] PEER_SUPPORTED_SIGNATURE_ALGORITHMS =
new String[] {"SHA1withRSA", "SHA1withECDSA"};
```

My actual usecase is GRPC ok-http client + conscrypt-openjdk-uberjar on oracle jre 8 and openjdk-11. But having the `ExtendedSSLSession.getPeerSupportedSignatureAlgorithms()` returning this limited values (as called by `sun.security.ssl.X509KeyManagerImpl` in all java versions I checked) is the root problem.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.