title: Relaxing SSL algorithm constrains programmatically
body: <h1>The problem</h1>
  
  <p>I'm trying to connect to a local server via a SSL socket. The server uses a SSL certificate that:</p>
  
  <ol>
  <li>Is self-signed.</li>
  <li>Has a MD5withRSA signature (?)</li>
  </ol>
  
  <p><em>I am aware of the security implications, but for reasons beyond my control, I cannot change or request changes to this certificate, thus I am forced to work with it - or rather, around it.</em></p>
  
  <p>To overcome the above two points, I have created:</p>
  
  <ol>
  <li>A <code>TrustManager</code> that allows all certificates.</li>
  <li>An <code>AlgorithmConstraints</code> that allows all algorithms.</li>
  </ol>
  
  <p>I end up with the following error:</p>
  
  <p><code>Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: MD5withRSA</code></p>
  
  <p>It seems that my approach to relaxing the algorithm constrains is flawed.</p>
  
  <p><strong>Note</strong>: I am aware that that the <code>MD5withRSA</code> algorithm can be allowed via altering the JVM configuration or a commandline parameter, but I need to do this programmatically.</p>
  
  <h1>The code</h1>
  
  <p>The <code>TrustManager</code> was created as follows:</p>
  
  <pre><code>TrustManager[] trustManager = new TrustManager[] { 
      new X509TrustManager() {     
          @Override
          public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
              return new X509Certificate[0];
          } 
          @Override
          public void checkClientTrusted( 
              java.security.cert.X509Certificate[] certs, String authType) {
              } 
          @Override
          public void checkServerTrusted( 
              java.security.cert.X509Certificate[] certs, String authType) {
          }
      } 
  };
  </code></pre>
  
  <p>The <code>AlgorithmConstraints</code> was created as follows:</p>
  
  <pre><code>AlgorithmConstraints algorithmConstraints = new AlgorithmConstraints() {
      @Override
      public boolean permits(Set&lt;CryptoPrimitive&gt; primitives, String algorithm, AlgorithmParameters parameters) {
          return true;
      }
  
      @Override
      public boolean permits(Set&lt;CryptoPrimitive&gt; primitives, Key key) {
          return true;
      }
  
      @Override
      public boolean permits(Set&lt;CryptoPrimitive&gt; primitives, String algorithm, Key key, AlgorithmParameters parameters) {
          return true;
      }
  }
  </code></pre>
  
  <p>And finally, the socket code is as follows:</p>
  
  <pre><code>SSLContext sslContext = SSLContext.getInstance("TLS"); 
  
  sslContext.init(null, trustManager, new java.security.SecureRandom());
  
  SSLSocketFactory factory = sslContext.getSocketFactory();
  SSLSocket sslsocket = (SSLSocket) factory.createSocket(server, port);
  
  SSLParameters sslParameters = new SSLParameters();
  sslParameters.setAlgorithmConstraints(algorithmConstraints);
  
  sslsocket.setSSLParameters(sslParameters);
  
  sslSocket.startHandshake();
  </code></pre>
  
  <p>Suggestions?</p>