diff --git a/openjdk/src/test/java/org/conscrypt/ConscryptOpenJdkSuite.java b/openjdk/src/test/java/org/conscrypt/ConscryptOpenJdkSuite.java
index 350f4b33d..976e2bd47 100644
--- a/openjdk/src/test/java/org/conscrypt/ConscryptOpenJdkSuite.java
+++ b/openjdk/src/test/java/org/conscrypt/ConscryptOpenJdkSuite.java
@@ -186,6 +186,11 @@
 public class ConscryptOpenJdkSuite {
     @BeforeClass
     public static void setupStatic() {
+        // Java 26 introduced additional certificate checking in SunX509KeyManagerImpl
+        // that rejects test certificates lacking proper Key Usage extensions.  Disable
+        // it here so that certificate quality issues are not masked as TLS failures.
+        // TODO(#1486) Fix test certificate generation in TestKeyStore and remove this.
+        System.setProperty("jdk.tls.SunX509KeyManager.certChecking", "false");
         installConscryptAsDefaultProvider();
     }
 }