JDK17下,使用SHA1算法报Certificates do not conform to algorithm constraints错误

JDK17从17.0.5开始,默认不再允许使用SHA1算法,如果引用的jar包或代码里使用了SHA1算法,会报以下错误。

复制代码
Caused by: javax.net.ssl.SSLHandshakeException: Certificates do not conform to algorithm constraints
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:201)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
	at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:589)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1450)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1421)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:220)
	at com.pingan.openbank.api.sdk.common.helper.WebUtils.doRequest(WebUtils.java:167)
	at com.pingan.openbank.api.sdk.common.helper.WebUtils.doPost(WebUtils.java:110)
	... 11 common frames omitted
Caused by: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1571)
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1496)
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1440)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
	... 29 common frames omitted
Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA1withRSA
	at java.base/sun.security.provider.certpath.AlgorithmChecker.check(AlgorithmChecker.java:237)
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1567)
	... 32 common frames omitted

如果从JDK8升级到JDK17时,或其他原因,必须要使用SHA1算法,则需要修改JDK的配置

找到你的JDK安装目录,找到目录下conf/security/java.security文件,如"/java-17-openjdk/conf/security/java.security"

注释掉或者直接删除SHA1 usage SignedJAR & denyAfter 2019-01-01,注意前面的逗号和空格也要删除

如果是RedHat系的,如RHEL,AlmaLinux,Rocky Linux,/etc/crypto-policies/back-ends/java.config也需要修改,把里面的SHA1删除

之后,重启服务,即可使用SHA1加密算法

相关推荐
麦兜*1 天前
Spring Boot 整合量子密钥分发(QKD)实验方案
java·jvm·spring boot·后端·spring·spring cloud·maven
崎岖Qiu1 天前
【JVM篇13】:兼顾吞吐量和低停顿的G1垃圾回收器
java·jvm·后端·面试
-Xie-1 天前
JVM学习日记(十三)Day13
jvm·学习
小白(猿)员2 天前
JVM、JDK、JRE的区别
java·开发语言·jvm
山间小僧2 天前
「查漏补缺」ZGC相关内容整理
java·jvm·后端
橙序员小站2 天前
仍然嫌GC卡顿?新一代低延迟GC了解一下
java·jvm·性能优化
籍籍川草3 天前
JVM指针压缩的那些事
java·开发语言·jvm
我命由我123453 天前
Spring Boot 项目问题:Web server failed to start. Port 5566 was already in use.
java·前端·jvm·spring boot·后端·spring·java-ee
_祝你今天愉快3 天前
Java-JVM探析
android·java·jvm
旋风菠萝4 天前
JVM易混淆名称
java·jvm·数据库·spring boot·redis·面试