FULL PRODUCT VERSION :
java version "1.8.0_102"
Java(TM) SE Runtime Environment (build 1.8.0_102-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.102-b14, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Centos 6.8

EXTRA RELEVANT SYSTEM CONFIGURATION :
PCI DSS compliant environment, default java security settings

A DESCRIPTION OF THE PROBLEM :
HTTPS host uses strong certificate but this certificate was issued using root certificate with MD5 algorithm.

When root is trusted we get "java.security.cert.CertificateException: Certificates does not conform to algorithm constraints" and this is CORRECT. Weak root could be used to issue strong but fake certificates and they cannot be trusted.

BUT if we add the end certificate as trusted we still get the same exception and this is WRONG. If certificate is trusted we don't need to validate the issuer.


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Create weak self-signed certificate using MD5.
2. Use this certificate to sign strong certificate.
3. Add the strong end-certificate to truststore.
4. Try to connect to host that uses this certificate.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Successful handshake using trusted certificate
ACTUAL -
Handshake fails because of weak root certificate

ERROR MESSAGES/STACK TRACES THAT OCCUR :
%% Invalidated: [Session-2, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
http-nio2-8080-exec-7, SEND TLSv1.2 ALERT: fatal, description = certificate_unknown
http-nio2-8080-exec-7, WRITE: TLSv1.2 Alert, length = 2
[Raw write]: length = 7
0000: 15 03 03 00 02 02 2E .......
http-nio2-8080-exec-7, called closeSocket()
http-nio2-8080-exec-7, handling exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints

REPRODUCIBILITY :
This bug can be reproduced always.