Fixed TLS feature (RFC 7633) checks: TLS 1.3 features are satisfied by the end-entity CertificateEntry, status_request_v2 is not enforced under TLS 1.3, and must-staple now requires a stapled response for the end-entity certificate in every version, relates to github #2458.

Author: peterdettman

docs/releasenotes.md

@@ -76,6 +76,10 @@ Date: 2026, TBD
 - The jdk1.4 and jdk1.3 providers registered the PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM, PKCS12-DEF-AES256-AES128 and PKCS12-DEF-AES256-AES128-GCM KeyStores against classes those distributions do not contain. They are no longer registered there; the legacy PKCS12 stores can still read PBES2/AES protected files.
 - The OCSPResp(byte[]) and OCSPReq(byte[]) constructors reported a malformed encoding only when the ASN.1 decode raised IllegalArgumentException, ClassCastException or ASN1Exception, so a top-level SEQUENCE that is empty or truncated - which makes OCSPResponse/OCSPRequest read seq.getObjectAt(0) out of bounds - escaped the declared IOException as an ArrayIndexOutOfBoundsException. Both parsers now surface any RuntimeException from the decode as a CertIOException, as X509CertificateHolder and X509CRLHolder already do, so an OCSP client parsing a response and an OCSP responder parsing a request reject malformed input through the contract rather than crashing. The cause was in the ASN.1 types, which read fixed positions of their SEQUENCE without checking its size: OCSPResponse, OCSPRequest, BasicOCSPResponse, ResponseData, TBSRequest and Request now reject a short one with IllegalArgumentException, as SingleResponse and CertID already did. The OCSP ASN.1 types also cast their elements rather than passing them to getInstance(), so an element of the wrong type surfaced as a ClassCastException and a signature BIT STRING in a legal encoding other than DER was refused; they now use getInstance() throughout, and BasicOCSPResponse and Signature accept any BIT STRING encoding. The provider's OCSP revocation checking parses these types directly and let an unchecked exception out of CertPathValidator.validate() for a response that would not decode, whether stapled by the caller or returned by the responder; a stapled one is now rejected with a CertPathValidatorException, and a fetched one is treated as an unreachable responder is, so the check can fall back to CRLs. A successful response carrying no response bytes, which failed with a NullPointerException, is rejected the same way.
 
+- TLS: A TLS 1.3 client rejected every server certificate whose TLS feature extension (RFC 7633) listed status_request ("must-staple") whenever it had offered status_request itself, since the feature was looked for only in EncryptedExtensions, where RFC 8446 does not permit it; TLS 1.3 carries the OCSP response in the end-entity certificate's CertificateEntry. A feature is now also satisfied by the extensions of that CertificateEntry, and a feature whose extension has no place in TLS 1.3, such as status_request_v2, is no longer enforced once TLS 1.3 is negotiated (github #2458).
+- (D)TLS: A server certificate whose TLS feature extension listed status_request or status_request_v2 was accepted without any OCSP response for it when the server acknowledged the status request but then sent no CertificateStatus message, which RFC 6066 permits, or sent an ocsp_multi list with no response for the end-entity certificate. Such a certificate now requires a stapled OCSP response for the end-entity certificate, in every protocol version. A TLS feature in force against a (D)TLS 1.2 ServerHello that carried no extensions at all now fails with a certificate_unknown alert rather than a NullPointerException.
+- TLS: A TLS 1.3 client aborted the handshake with an illegal_parameter alert when the server sent the cached_info or record_size_limit extension in EncryptedExtensions, or the server_name extension in a CertificateRequest, since these were missing from the table of extensions permitted in each TLS 1.3 message.
+
 ### 2.1.3 Additional Features and Functionality
 
 - The CRMF certificate request message controls now include the RFC 4211 sec. 6.6 protocolEncrKey control, which names the key a CA is to encrypt its response with: org.bouncycastle.cert.crmf.ProtocolEncrKeyControl carries the SubjectPublicKeyInfo the control is defined to take, and CertificateRequestMessage.getControl() recognises id-regCtrl-protocolEncrKey alongside the regToken, authenticator and pkiArchiveOptions controls it already returned (github PR #2443).
@@ -97,6 +101,8 @@ Date: 2026, TBD
 
 - The provider adds ECDHwithSHA256HKDF, ECDHwithSHA384HKDF and ECDHwithSHA512HKDF KeyAgreement algorithms: ECDH followed by HKDF (RFC 5869), the counterparts for elliptic curve keys of the XDHwithSHA\*HKDF agreements used for the RFC 8418 dhSinglePass-stdDH-hkdf schemes. As with those, a UserKeyingMaterialSpec supplies the HKDF info and, optionally, its salt. They are registered by name only; the RFC 8418 scheme object identifiers remain registered to the XDH agreements.
 
+- TLS: Added CertificateStatusType.getName and getText, and TlsUtils.hasExtension.
+
 ### 2.1.4 Additional Notes
 
 - The sources and javadoc jars of the Ant-built distributions (jdk14, jdk15to18 and jdk13) no longer carry test material. Each module's javadoc target copies the package documentation it needs - org/bouncycastle/<area>/**/*.html - back into the module source directory that has already been compiled from, and zip-src zips that directory afterwards, so every test package's package.html arrived in the sources jar by that route; javadoc-util additionally copied org/bouncycastle/asn1/isismtt/**/*.java, which put test classes into the bcutil javadoc as generated pages, and javadoc-pg deliberately copied the gpg and bcpg test sources in order to document them. Separately the source copies excluded test material only one directory deep and only for *.java, because Ant reads ** as an any-depth wildcard just where it is a whole path segment, so anything nested further or with another extension - the PEM certificate fixtures under org/bouncycastle/est/test/san corrected in 1.86, and an ICAO master list under org/bouncycastle/asn1/icao/test - went through. The source and javadoc copies of every module now exclude test directories at any depth, and javadoc-pg no longer documents the test packages. org.bouncycastle.util.test is unaffected and still ships in the bcprov binary, sources and javadoc jars, as it does from the Gradle build: it is the SimpleTest framework the light-weight API's own test classes are written against, not test material of the distribution. No binary changes - the classes and resources of every Ant-built jar are identical to those of the 1.86 release - and the Gradle-built jdk18on artifacts never carried any of this.

tls/src/main/java/org/bouncycastle/tls/CertificateStatus.java

@@ -26,6 +26,25 @@ public CertificateStatus(short statusType, Object response)
         this.response = response;
     }
 
+    /**
+     * Whether there exists an OCSP response for certificate 0 of the chain this status answers for:
+     * always true for {@link CertificateStatusType#ocsp}, true for
+     * {@link CertificateStatusType#ocsp_multi} only when there was a non-empty response for
+     * position 0.
+     */
+    boolean hasLeafResponse()
+    {
+        switch (statusType)
+        {
+        case CertificateStatusType.ocsp:
+            return true;
+        case CertificateStatusType.ocsp_multi:
+            return null != ((Vector)response).elementAt(0);
+        default:
+            throw new IllegalStateException();
+        }
+    }
+
     public short getStatusType()
     {
         return statusType;

tls/src/main/java/org/bouncycastle/tls/TlsUtils.java

@@ -4840,48 +4840,119 @@ else if (null == clientSigAlgsCert)
         }
     }
 
-    static void checkTlsFeatures(Certificate serverCertificate, Hashtable clientExtensions, Hashtable serverExtensions) throws IOException
+    static void checkTlsFeatures(TlsClientContext clientContext, TlsServerCertificate serverCertificate,
+        Hashtable clientExtensions, Hashtable serverExtensions) throws IOException
     {
         /*
          * RFC 7633 4.3.3. A client MUST treat a certificate with a TLS feature extension as an
          * invalid certificate if the features offered by the server do not contain all features
          * present in both the client's ClientHello message and the TLS feature extension.
          */
-        byte[] tlsFeatures = serverCertificate.getCertificateAt(0).getExtension(TlsObjectIdentifiers.id_pe_tlsfeature);
-        if (tlsFeatures != null)
+
+        Certificate certificate = serverCertificate.getCertificate();
+        if (certificate.isEmpty())
+        {
+            throw new TlsFatalAlert(AlertDescription.internal_error);
+        }
+
+        CertificateEntry eeEntry = certificate.getCertificateEntryAt(0);
+
+        byte[] tlsFeatures = eeEntry.getCertificate().getExtension(TlsObjectIdentifiers.id_pe_tlsfeature);
+        if (tlsFeatures == null)
+        {
+            return;
+        }
+
+        // TODO[tls] Proper ASN.1 type class for this extension?
+        ASN1Primitive tlsFeaturesObj = readASN1Object(tlsFeatures);
+        if (!(tlsFeaturesObj instanceof ASN1Sequence))
+        {
+            throw new TlsFatalAlert(AlertDescription.bad_certificate,
+                "Server certificate has invalid TLS Features extension");
+        }
+
+        ASN1Sequence tlsFeaturesSeq = (ASN1Sequence)tlsFeaturesObj;
+        for (int i = 0; i < tlsFeaturesSeq.size(); ++i)
         {
-            // TODO[tls] Proper ASN.1 type class for this extension?
-            ASN1Primitive tlsFeaturesObj = readASN1Object(tlsFeatures);
-            if (!(tlsFeaturesObj instanceof ASN1Sequence))
+            if (!(tlsFeaturesSeq.getObjectAt(i) instanceof ASN1Integer))
             {
                 throw new TlsFatalAlert(AlertDescription.bad_certificate,
                     "Server certificate has invalid TLS Features extension");
             }
+        }
+
+        requireDEREncoding(tlsFeaturesSeq, tlsFeatures);
 
-            ASN1Sequence tlsFeaturesSeq = (ASN1Sequence)tlsFeaturesObj;
-            for (int i = 0; i < tlsFeaturesSeq.size(); ++i)
+        boolean isTLSv13 = isTLSv13(clientContext);
+        boolean mustStaple = false;
+        Hashtable eeExtensions = eeEntry.getExtensions();
+
+        for (int i = 0; i < tlsFeaturesSeq.size(); ++i)
+        {
+            BigInteger tlsExtension = ((ASN1Integer)tlsFeaturesSeq.getObjectAt(i)).getPositiveValue();
+            if (tlsExtension.bitLength() > 16)
             {
-                if (!(tlsFeaturesSeq.getObjectAt(i) instanceof ASN1Integer))
-                {
-                    throw new TlsFatalAlert(AlertDescription.bad_certificate,
-                        "Server certificate has invalid TLS Features extension");
-                }
+                // Feature has invalid value - couldn't legally appear in ClientHello extensions
+                continue;
             }
 
-            requireDEREncoding(tlsFeaturesSeq, tlsFeatures);
+            int extensionType = tlsExtension.intValue();
+            Integer extensionTypeKey = Integers.valueOf(extensionType);
 
-            for (int i = 0; i < tlsFeaturesSeq.size(); ++i)
+            if (!hasExtension(clientExtensions, extensionTypeKey))
             {
-                BigInteger tlsExtension = ((ASN1Integer)tlsFeaturesSeq.getObjectAt(i)).getPositiveValue();
-                if (tlsExtension.bitLength() <= 16)
+                // Feature only in force if actually in ClientHello extensions
+                continue;
+            }
+
+            if (isTLSv13 && ExtensionType.isRecognized(extensionType))
+            {
+                if (!isPermittedExtensionType13(HandshakeType.client_hello, extensionType))
                 {
-                    Integer extensionType = Integers.valueOf(tlsExtension.intValue());
-                    if (clientExtensions.containsKey(extensionType) && !serverExtensions.containsKey(extensionType))
-                    {
-                        throw new TlsFatalAlert(AlertDescription.certificate_unknown,
-                            "Server extensions missing TLS Feature " + extensionType);
-                    }
+                    // Feature not in force if extension not relevant to negotiated version
+                    continue;
                 }
+
+                // Note that no stapling extensions are skipped here
+                if (isPermittedExtensionType13(HandshakeType.server_hello, extensionType))
+                {
+                    // Feature not checked for TLS 1.3 ServerHello extensions - existing permitted extensions are
+                    // either not relevant to server certificate authentication, or always added. Revisit this if
+                    // one that is relevant becomes permitted there (e.g. tls_cert_with_extern_psk, RFC 8773).
+                    continue;
+                }
+            }
+
+            // We now consider the feature requirement to be "in force" - check it's satisfied
+
+            if (ExtensionType.status_request == extensionType || ExtensionType.status_request_v2 == extensionType)
+            {
+                mustStaple = true;
+            }
+
+            if (hasExtension(serverExtensions, extensionTypeKey))
+            {
+                // Feature satisfied by the ServerHello extensions (EncryptedExtensions in TLS 1.3)
+                continue;
+            }
+
+            if (hasExtension(eeExtensions, extensionTypeKey))
+            {
+                // Feature satisfied by the CertificateEntry extensions (only in TLS 1.3+)
+                continue;
+            }
+
+            throw new TlsFatalAlert(AlertDescription.certificate_unknown,
+                "Server extensions missing TLS Feature " + ExtensionType.getText(extensionType));
+        }
+
+        if (mustStaple)
+        {
+            CertificateStatus certificateStatus = serverCertificate.getCertificateStatus();
+            if (certificateStatus == null || !certificateStatus.hasLeafResponse())
+            {
+                throw new TlsFatalAlert(AlertDescription.certificate_unknown,
+                    "Server failed TLS Feature 'Must-Staple'");
             }
         }
     }
@@ -4953,8 +5024,6 @@ static void processServerCertificate(TlsClientContext clientContext,
 
         Certificate serverCertificate = securityParameters.getPeerCertificate();
 
-        checkTlsFeatures(serverCertificate, clientExtensions, serverExtensions);
-
         CertificateStatus certificateStatus;
         CertificateStatus[] certificateStatuses;
 
@@ -4975,8 +5044,12 @@ static void processServerCertificate(TlsClientContext clientContext,
             certificateStatuses = spreadCertificateStatus(serverCertificate, serverCertificateStatus);
         }
 
-        clientAuthentication.notifyServerCertificate(
-            new TlsServerCertificateImpl(serverCertificate, certificateStatus, certificateStatuses));
+        TlsServerCertificate tlsServerCertificate = new TlsServerCertificateImpl(serverCertificate,
+            certificateStatus, certificateStatuses);
+
+        checkTlsFeatures(clientContext, tlsServerCertificate, clientExtensions, serverExtensions);
+
+        clientAuthentication.notifyServerCertificate(tlsServerCertificate);
     }
 
     static SignatureAndHashAlgorithm getCertSigAndHashAlg(TlsCertificate subjectCert, TlsCertificate issuerCert)

tls/src/test/java/org/bouncycastle/tls/CheckTlsFeaturesExtensionTest.java

@@ -13,6 +13,7 @@
 import org.bouncycastle.tls.crypto.TlsEncryptor;
 import org.bouncycastle.tls.crypto.TlsVerifier;
 import org.bouncycastle.tls.crypto.Tls13Verifier;
+import org.bouncycastle.tls.crypto.impl.bc.BcTlsCrypto;
 
 import junit.framework.TestCase;
 import junit.framework.TestSuite;
@@ -40,7 +41,7 @@ public void testNonSequenceTlsFeaturesRejected()
 
         try
         {
-            TlsUtils.checkTlsFeatures(serverCertificate, new Hashtable(), new Hashtable());
+            checkTlsFeatures(serverCertificate, new Hashtable(), new Hashtable());
             fail("expected TlsFatalAlert for non-SEQUENCE TLS Features extension");
         }
         catch (TlsFatalAlert e)
@@ -65,7 +66,7 @@ public void testValidTlsFeaturesAccepted()
         Certificate serverCertificate = makeCertificate(seq);
 
         // No client extensions requested, so nothing to enforce: must complete cleanly.
-        TlsUtils.checkTlsFeatures(serverCertificate, new Hashtable(), new Hashtable());
+        checkTlsFeatures(serverCertificate, new Hashtable(), new Hashtable());
     }
 
     /**
@@ -76,7 +77,59 @@ public void testNoTlsFeaturesExtension()
     {
         Certificate serverCertificate = makeCertificate(null);
 
-        TlsUtils.checkTlsFeatures(serverCertificate, new Hashtable(), new Hashtable());
+        checkTlsFeatures(serverCertificate, new Hashtable(), new Hashtable());
+    }
+
+    /**
+     * A (D)TLS 1.2 ServerHello may carry no extensions at all, leaving the server extensions null. A
+     * feature in force is then simply unsatisfied, and must fail with an alert rather than a
+     * NullPointerException.
+     */
+    public void testFeatureUnsatisfiedByAbsentServerExtensions()
+        throws Exception
+    {
+        ASN1Encodable[] features = new ASN1Encodable[]{ new ASN1Integer(ExtensionType.status_request) };
+        byte[] seq = new DERSequence(features).getEncoded(ASN1Encoding.DER);
+
+        Certificate serverCertificate = makeCertificate(seq);
+
+        Hashtable clientExtensions = new Hashtable();
+        TlsExtensionsUtils.addStatusRequestExtension(clientExtensions,
+            new CertificateStatusRequest(CertificateStatusType.ocsp, new OCSPStatusRequest(null, null)));
+
+        try
+        {
+            checkTlsFeatures(serverCertificate, clientExtensions, null);
+            fail("expected TlsFatalAlert for an unsatisfied TLS Feature");
+        }
+        catch (TlsFatalAlert e)
+        {
+            assertEquals(AlertDescription.certificate_unknown, e.getAlertDescription());
+        }
+    }
+
+    /**
+     * Runs the check as a (D)TLS 1.2 client would, for a server that stapled nothing.
+     */
+    private static void checkTlsFeatures(Certificate serverCertificate, Hashtable clientExtensions,
+        Hashtable serverExtensions) throws IOException
+    {
+        BcTlsCrypto crypto = new BcTlsCrypto();
+
+        TlsClientContextImpl clientContext = new TlsClientContextImpl(crypto);
+        clientContext.handshakeBeginning(new DefaultTlsClient(crypto)
+        {
+            public TlsAuthentication getAuthentication()
+            {
+                throw new UnsupportedOperationException();
+            }
+        });
+        clientContext.getSecurityParametersHandshake().negotiatedVersion = ProtocolVersion.TLSv12;
+
+        TlsServerCertificate tlsServerCertificate = new TlsServerCertificateImpl(serverCertificate, null,
+            new CertificateStatus[serverCertificate.getLength()]);
+
+        TlsUtils.checkTlsFeatures(clientContext, tlsServerCertificate, clientExtensions, serverExtensions);
     }
 
     private static Certificate makeCertificate(byte[] tlsFeaturesExtensionContent)