8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled

[GoeLin]

I backport this for parity with 21.0.9-oracle.

Resolved one copyright. It is already at 2025.

But test MD5NotAllowedInTLS13CertificateSignature.java is failing.
It throws ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0
at MD5NotAllowedInTLS13CertificateSignature.lambda$main$1(MD5NotAllowedInTLS13CertificateSignature.java:100)

It expects an array of length 1 containing the exception javax.net.ssl.SSLHandshakeException: (bad_certificate) PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: MD5withRSA

All other testing, i.e. our nighlties and the tests touched here, pass.

---

Progress

• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8350807 needs maintainer approval

Issue

• JDK-8350807: Certificates using MD5 algorithm that are disabled by default are incorrectly allowed in TLSv1.3 when re-enabled (Bug - P3)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk21u-dev.git pull/2085/head:pull/2085
$ git checkout pull/2085

Update a local copy of the PR:
$ git checkout pull/2085
$ git pull https://git.openjdk.org/jdk21u-dev.git pull/2085/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 2085

View PR using the GUI difftool:
$ git pr show -t 2085

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk21u-dev/pull/2085.diff

[bridgekeeper]

👋 Welcome back goetz! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

This backport pull request has now been updated with issue from the original commit.