title: Java Algorithm constraints check failed on key RSA with size of 1024bits
body: <p>After generating java keystore with: -keyalg RSA -keysize 2048
  and configuring the java.security policy with:</p>
  
  <pre><code>jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize &lt; 1024, EC keySize &lt; 224, 3DES_EDE_CBC, RSA keySize &lt; 2048
  </code></pre>
  
  <p>I keep getting errors:</p>
  
  <blockquote>
    <p>java.security.cert.CertPathValidatorException: Algorithm constraints check failed on key RSA with size of 1024bits</p>
  </blockquote>
  
  <p>I’m using the following command to generate a 2048bit RSA key:</p>
  
  <pre><code>keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -keystore star_domain_name.jks -storetype PKCS12 -dname "CN=*.domain_name.com,OU=Engineering, O=Company Name., L=City Name, ST=State, C=US" &amp;&amp; keytool -certreq -alias server -file star_domain_name.com.csr -keystore star_domain_name_io.jks
  </code></pre>
  
  <p>I then verify the above with:</p>
  
  <pre><code>openssl s_client -showcerts -connect localhost:443
  </code></pre>
  
  <p>That shows:</p>
  
  <pre><code>New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
  </code></pre>
  
  <p>I also view the keystore with:</p>
  
  <pre><code>keytool -list -v -keystore star_domain_name.com.jks
  </code></pre>
  
  <p>Which shows:</p>
  
  <pre><code>Certificate fingerprints:
           MD5:  67:4C:04:90:35:etc...etc...
           SHA1: AD:C8:06:74:3A:F1:72:etc...etc...
           SHA256: C5:D6:81:3B:C1:F7:CE:2D:43:91:06:E9:9etc...etc...
  Signature algorithm name: SHA256withRSA
  Subject Public Key Algorithm: 2048-bit RSA key
  </code></pre>
  
  <p>Everywhere I look I see 2048-bit RSA key.
  However, when I want to use the java keystore in my java spring boot application, it keeps complaining:</p>
  
  <blockquote>
    <ul>
    <li>Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on key RSA with size of 1024bits</li>
    <li>Caused by: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints</li>
    </ul>
  </blockquote>
  
  <p>As soon as I edit the java.security file, and remove RSA keySize &lt; 2048 from it, and restart the application, everything works…</p>
  
  <p>Is this because I did not import a signed domain cert?
  Why does the application complain although I clearly configured the policy and the java keystore for 2048 bits?</p>
  
  <p>My java application configuration contains:</p>
  
  <pre><code>ssl.key-store: /opt/cert_path/star_domain_name.com.jks
  ssl.enabled: true
  ssl.key-store-password: the_password_etc...
  ssl.key-store-type: PKCS12
  ssl.key-alias: tomcat
  </code></pre>
  
  <p>As soon as I edit the java.security file, and remove RSA keySize &lt; 2048 from it, and restart the application, everything works…</p>
  
  <p>Is this because I did not import a signed domain cert and the keystore is empty? I doubt it.</p>
  
  <p>Why does the application complain although I clearly configured the policy file and the java keystore for 2048 bits?</p>
  
  <p>The java.security file also contains:</p>
  
  <pre><code>jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize &lt; 1024, DSA keySize &lt; 1024
  </code></pre>
  
  <p>Should that also be adjusted?</p>
  
  <p>I've actually tried to adjust that, but that had no effect...</p>