java 1.6.0_19 MD2withRSA is disabled issue
843798Apr 8 2010 — edited Aug 3 2010Some of our clients have been upgraded to the latest jre 1.6.0_19. They get the following exception:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: algorithm check failed: MD2withRSA is disabled.
SEND TLSv1 ALERT: fatal, description = certificate_unknown
Data Processor, WRITE: TLSv1 Alert, length = 2
This is the certificate in question:
[
Version: V1
Subject: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
Signature Algorithm: MD2withRSA, OID = 1.2.840.113549.1.1.2
Key: Sun RSA public key, 1024 bits
modulus: 14140032204...Omitted for brevity...36711
public exponent: 65537
Validity: [From: Sun Jan 28 19:00:00 EST 1996,
To: Tue Aug 01 19:59:59 EDT 2028]
Issuer: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
SerialNumber: [ 70bae41d 10d92934 b638ca7b 03ccbabf]
]
Algorithm: [MD2withRSA]
Signature:
0000: BB 4C ...Omitted for brevity
0070: C0 7D B7 72 9C C9 36 3A 6B 9F 4E A8 FF 64 0D 64 ...r..6:k.N..d.d
]
Now I tested this with 1.6.0_18, and there are no problems with this certificate. No exceptions are thrown and logging in is successful. Why would this be if MD*withRSA has been disabled starting with 1.6.0_17 and upwards?
Upon looking at the 1.6.0_19 release notes, I noticed that several root certificates have been replaced in that release, including the one which we are currently using which uses MD2withRSA encryption.
Can anyone confirm that the reason why this is working in 0_18 is because the root cert in question was removed in 0_19?
Thanks in advance