This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit bc60238ff3f20b07a953e003729299d429e66d60 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 14:51:29 2026 +0200 Reuse SSLHostConfigCertificate.chooseServerAlias in the OpenSSL contexts --- .../tomcat/util/net/openssl/OpenSSLContext.java | 32 ++-------------------- .../util/net/openssl/panama/OpenSSLContext.java | 31 ++------------------- 2 files changed, 4 insertions(+), 59 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java index f0728cc52c..de276dd3c1 100644 --- a/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java +++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java @@ -27,9 +27,7 @@ import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.util.ArrayList; -import java.util.Arrays; import java.util.Base64; -import java.util.Iterator; import java.util.List; import java.util.Set; import java.util.concurrent.atomic.AtomicInteger; @@ -605,7 +603,7 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { } X509Certificate[] chain = x509KeyManager.getCertificateChain(alias); if (chain == null) { - alias = findAlias(x509KeyManager, certificate); + alias = certificate.chooseServerAlias(x509KeyManager); chain = x509KeyManager.getCertificateChain(alias); } PrivateKey key = x509KeyManager.getPrivateKey(alias); @@ -642,32 +640,6 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { } - /* - * Find a valid alias when none was specified in the config. - */ - private static String findAlias(X509KeyManager keyManager, SSLHostConfigCertificate certificate) { - - Type type = certificate.getType(); - String result = null; - - List<Type> candidateTypes = new ArrayList<>(); - if (Type.UNDEFINED.equals(type)) { - // Try all types to find a suitable alias - candidateTypes.addAll(Arrays.asList(Type.values())); - candidateTypes.remove(Type.UNDEFINED); - } else { - // Look for the specific type to find a suitable alias - candidateTypes.add(type); - } - - Iterator<Type> iter = candidateTypes.iterator(); - while (result == null && iter.hasNext()) { - result = keyManager.chooseServerAlias(iter.next().getKeyType(), null, null); - } - - return result; - } - private static X509TrustManager chooseTrustManager(TrustManager[] managers) { for (TrustManager m : managers) { if (m instanceof X509TrustManager) { @@ -724,7 +696,7 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { } chain = x509KeyManager.getCertificateChain(alias); if (chain == null) { - alias = findAlias(x509KeyManager, certificate); + alias = certificate.chooseServerAlias(x509KeyManager); chain = x509KeyManager.getCertificateChain(alias); } } diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java index c568fa1746..a9e3d9d624 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java @@ -34,7 +34,6 @@ import java.security.cert.X509Certificate; import java.util.ArrayList; import java.util.Arrays; import java.util.Base64; -import java.util.Iterator; import java.util.List; import java.util.Map; import java.util.Set; @@ -1453,7 +1452,7 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { } X509Certificate[] chain = x509KeyManager.getCertificateChain(alias); if (chain == null) { - alias = findAlias(x509KeyManager, certificate); + alias = certificate.chooseServerAlias(x509KeyManager); chain = x509KeyManager.getCertificateChain(alias); } String encodedKey = BEGIN_KEY + Base64.getMimeEncoder(64, new byte[] { '\n' }) @@ -1570,32 +1569,6 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { } - /* - * Find a valid alias when none was specified in the config. - */ - private static String findAlias(X509KeyManager keyManager, SSLHostConfigCertificate certificate) { - - Type type = certificate.getType(); - String result = null; - - List<Type> candidateTypes = new ArrayList<>(); - if (Type.UNDEFINED.equals(type)) { - // Try all types to find a suitable alias - candidateTypes.addAll(Arrays.asList(Type.values())); - candidateTypes.remove(Type.UNDEFINED); - } else { - // Look for the specific type to find a suitable alias - candidateTypes.add(type); - } - - Iterator<Type> iter = candidateTypes.iterator(); - while (result == null && iter.hasNext()) { - result = keyManager.chooseServerAlias(iter.next().getKeyType(), null, null); - } - - return result; - } - private static X509TrustManager chooseTrustManager(TrustManager[] managers) { for (TrustManager m : managers) { if (m instanceof X509TrustManager) { @@ -1663,7 +1636,7 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { } chain = x509KeyManager.getCertificateChain(alias); if (chain == null) { - alias = findAlias(x509KeyManager, certificate); + alias = certificate.chooseServerAlias(x509KeyManager); chain = x509KeyManager.getCertificateChain(alias); } } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
