title: JDK 11 SSL Error on valid certificate (working in previous versions)
body: <p>The following code throws an error in JDK 11:</p>
  
  <pre><code>    HttpURLConnection con = (HttpURLConnection) new URL("https://sis.redsys.es/sis/realizarPago").openConnection();
      con.setRequestMethod("GET");
      con.getResponseCode();
  </code></pre>
  
  <p>The error is:</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: extension (10) should not be presented in server_hello
  at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
  at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:312)
  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:268)
  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:259)
  at java.base/sun.security.ssl.SSLExtensions.&lt;init&gt;(SSLExtensions.java:71)
  at java.base/sun.security.ssl.ServerHello$ServerHelloMessage.&lt;init&gt;(ServerHello.java:169)
  at java.base/sun.security.ssl.ServerHello$ServerHelloConsumer.consume(ServerHello.java:860)
  at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:390)
  at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:445)
  at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422)
  at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:178)
  at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
  at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:877)
  at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:810)
  at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:383)
  at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:567)
  </code></pre>
  
  <p>It was working in any previous JDK (I've tested in 7, 8, 9 and 10). </p>
  
  <p>The certificate seems valid as it's recognized by browsers or most SSL test i've found in internet.</p>
  
  <p>I've tried disabling host name verifying, disabling cacerts, adding the DigiCert to the cacerts file without any luck.</p>
  
  <p>It seems like a bug in openJDK. Tested in build 26, 27 and 28 (release candidate).</p>