Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8325079

Alerts on client auth may not conform to the RFCs

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: P4 P4
    • None
    • 23
    • security-libs
    • None

      If no client certificate is sent on required client auth, the server alerts bad_certificate.
      This may not conform to the specifications.

      Please see Bernd's comment on openjdk/jdk/17645 [1] as the below,
      rfc8446 6.2 “certificate_required: Sent by servers when a client certificate is
      desired but none was provided by the client.”
      rfc5246 7.4.6 “ If the client does not send any certificates, the
      server MAY at its discretion either continue the handshake without
      client authentication, or respond with a fatal handshake_failure
      alert.”

      [1] https://github.com/openjdk/jdk/pull/17645#discussion_r1473440462

            Unassigned Unassigned
            jjiang John Jiang
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: