The issue SECURITY-631 was fixed in JBoss Negotiation 2.0.4, which was the negotiation version used by EPP. But for some reason, this feature was fixed only in 2.0 branch, but not in negotiation trunk.

Currently we need to upgrade GateIn to be used by AS7 and so we use negotiation 2.2.1.Final but feature is not available here.