The algorithm constraint does not apply to root/trusted certificate as the application or customer has made the decision to trust the cert although it is weak or broken.

Although the cert path definition does not contain the trusted certificate, it is not easy to understand this point for general developers. Better to document explicitly that algorithm restrictions (jdk.certpath.disabledAlgorithms, jdk.jar.disabledAlgorithms) do not apply to trusted certs.

See the update in JDK-8168822.

Please update guides for:
. JSSE Reference Guide (may need a new troubleshooting item).
. Java PKI Programmer's Guide