This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 191e841b3d Improve error diagnostics
191e841b3d is described below
commit 191e841b3df0f2d4baa1c88b294875d518a515e3
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Nov 5 13:59:04 2026 +0000
Improve error diagnostics
---
.../apache/tomcat/util/net/openssl/panama/OpenSSLContext.java | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
index 87e11951d7..7f9b7cfb1d 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
@@ -24,6 +24,7 @@ import java.lang.ref.Cleaner;
import java.lang.ref.Cleaner.Cleanable;
import java.nio.charset.StandardCharsets;
import java.security.KeyManagementException;
+import java.security.PrivateKey;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
@@ -1200,11 +1201,17 @@ public class OpenSSLContext implements
org.apache.tomcat.util.net.SSLContext {
X509KeyManager x509KeyManager =
certificate.getCertificateKeyManager();
String alias = getServedAlias(certificate);
X509Certificate[] chain =
x509KeyManager.getCertificateChain(alias);
+ PrivateKey javaKey = x509KeyManager.getPrivateKey(alias);
+ if (javaKey == null || javaKey.getEncoded() == null || chain ==
null || chain.length == 0) {
+ // No native error will have been raised so identify the alias
that could not be loaded
+ log.error(sm.getString("openssl.errorLoadingCertificate",
alias));
+ return false;
+ }
// Convert the in-memory key manager entry to native objects with
// the shared loader (PKCS#8 key via d2i_AutoPrivateKey,
// certificates via d2i_X509)
CertificateLoader.CertificateEntry entry =
-
CertificateLoader.toCertEntry(x509KeyManager.getPrivateKey(alias), chain,
localArena);
+ CertificateLoader.toCertEntry(javaKey, chain, localArena);
if (entry == null) {
logLastError("openssl.errorLoadingCertificate");
return false;
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
