JEP 288: Disable SHA-1 Certificates

ecki at ecki at
Thu Apr 21 20:18:02 UTC 2016

Hello, can answer the first question myself, the additional attribute deny after is not documented in the JEP but in this task:


-----Original Message-----
From: ecki at
To: security-dev at
Sent: Do., 21 Apr. 2016 10:51
Subject: Re: JEP 288: Disable SHA-1 Certificates


Two questions: the condition "starting on 2017-01-01" will this be part of the general algorithm deprecation or the jdkCA qualifier. I.e. if I add "SHA1" with no qualifier, will it be in effect immediatelly?

The exception for timestamped code, does it also consider the actual signature hash algorithm? (Asuming SHA1 would be to weak I could also forge an backdated TS signature).

I guess it is implicitely stated but not spelled out: the self signature on root certificates is not considered part of the path checking and can be SHA1, right?



-----Original Message-----
From: mark.reinhold at
To: sean.mullan at
Cc: security-dev at
Sent: Mi., 20 Apr. 2016 21:01
Subject: JEP 288: Disable SHA-1 Certificates

New JEP Candidate:

- Mark

More information about the security-dev mailing list