ChristopherSchultz commented on code in PR #1098:
URL: https://github.com/apache/tomcat/pull/1098#discussion_r4402223997
##########
java/org/apache/tomcat/util/net/SSLUtilBase.java:
##########
@@ -450,6 +482,99 @@ public KeyManager[] getKeyManagers() throws Exception {
}
+ /**
+ * Searches a SunMSCAPI Windows-MY key store for a key entry whose
certificate is valid for TLS server
+ * authentication, among the numbered duplicates of {@code baseAlias}.
When several certificates share a Windows
+ * "friendly name", that provider appends {@code " (1)"}, {@code " (2)"},
etc. to give them unique aliases, as the
+ * key store API requires.
+ *
+ * @param ks the SunMSCAPI Windows-MY key store to search
+ * @param baseAlias the configured alias. Not itself re-checked: the
caller has already determined that its
+ * certificate is not valid for TLS server
authentication.
+ *
+ * @return the alias of the first duplicate (in increasing numeric order
starting at 1) whose certificate is
+ * valid for TLS server authentication, or {@code null} if
there is no such duplicate
+ *
+ * @throws KeyStoreException if the key store has not been initialized
+ */
+ private static String findServerAuthAliasInWindowsMYFamily(KeyStore ks,
String baseAlias) throws KeyStoreException {
+ // Numbered duplicates cannot outnumber the aliases in the store, so
that count bounds the scan.
+ int limit = Collections.list(ks.aliases()).size();
+ for (int suffix = 1; suffix <= limit; suffix++) {
+ String candidateAlias = baseAlias + " (" + suffix + ")";
+ Certificate candidateCert = ks.getCertificate(candidateAlias);
+ if (candidateCert == null) {
+ // A missing number is a gap, not the end of the sequence:
keep scanning so a valid duplicate beyond it
+ // is still found.
Review Comment:
How "smart" is Java here? If the original alias is literally `alias (1)`
does the duplicate become `alias (2)` or does it become `alias (1) (1)`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
