dsoumis commented on PR #1089: URL: https://github.com/apache/tomcat/pull/1089#issuecomment-6268701832
> 2. Only failing after _all_ certificates matching aliases (from a PEM file, where alias == DN) fail @ChristopherSchultz I have some second thoughts on the above before committing an implementation. Considering the following example: Keystore with entries: 1. app.example.com CN=app.example.com serverAuth | key not readable 2. app.example.com (1) CN=app.example.com serverAuth | key readable Both are valid candidates, the first is tried, it fails, so selection falls through to the second entry and TLS stays up. However, the above may mask a misconfiguration from my point of view. It keeps a client up on a possibly soon-to-expire cert instead of failing loudly so the client can fix the key. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
