On Fri, 28 Aug 2026 19:30:27 GMT, Weijun Wang <[email protected]> wrote:
> The enhancement implements the new RFC 9846-style support group selection on > the server side (first mutual group matters) and change the supported-groups > format. Specifically: > > 1. `SSLParameters.setNamedGroups` and the `jdk.tls.namedGroups` system > property now recognize a *-prefix on a group name. > 2. The prefix does not change the supported_groups extension. > 3. On a TLS 1.3 client, usable starred groups determine the initial key_share > entries. If no usable starred group remains, JSSE falls back to its existing > automatic key-share selection. > 4. SunJSSE’s default parameters contains 2 starred groups, which can be > observed by `getNamedGroups`. > 5. The server ignores the marker in its own configuration. > 6. Server group selection now follows RFC 9846: choose the first mutually > supported group according to the client’s supported_groups order, then sends > ServerHello if its key share is present or HelloRetryRequest if not. > > No new API or system property defined for the new format. The existing > methods and system property are already called a lot by both JSSE itself and > an application. The default value of the system property is empty which gives > each provider the chance to define it itself. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). src/java.base/share/classes/javax/net/ssl/SSLParameters.java line 921: > 919: * parameters are used in SSL/TLS/DTLS connections. > 920: * <p> > 921: * In TLS 1.3, the ClientHello message can include a list of > pre-calculated Should you also say something like, "For TLS versions earlier than 1.3, group names with asterisks are treated as if they did not have the asterisk"? ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32586#discussion_r4108519406
