(ofbiz-framework) branch trunk updated: Fixed: Reject untrusted certificates in MultiTrustManager when the all-trusted properties are missing or empty (OFBIZ-13654)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new ec6adeae8d Fixed: Reject untrusted certificates in MultiTrustManager 
when the all-trusted properties are missing or empty (OFBIZ-13654)
ec6adeae8d is described below

commit ec6adeae8d9f371b23171b87a6cccddd2d43e074
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Wed Oct 7 17:37:45 2026 +0530

    Fixed: Reject untrusted certificates in MultiTrustManager when the 
all-trusted properties are missing or empty (OFBIZ-13654)
    
    MultiTrustManager ignored a certificate validation failure when the 
property server.all-trusted or client.all-trusted of certificate.properties was 
"true", and it read both properties with the default "true". A 
certificate.properties without these entries, or with an empty value, therefore 
silently disabled the certificate validation of the outgoing connections and of 
the client certificates. The shipped file sets both to false, so a default 
installation was not affected.
    
    Both properties are now read with the default "false", so that a missing or 
empty value keeps the validation on and only an explicit "true" turns it off.
---
 .../src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
index 3ce5e43131..6ffe8f9a41 100644
--- 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
+++ 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
@@ -82,7 +82,7 @@ public class MultiTrustManager implements X509TrustManager {
             // (e.g. when there are no trust anchors at all) instead of a 
CertificateException.
             trustFailure = new CertificateException(e);
         }
-        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"client.all-trusted", "true"))) {
+        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"client.all-trusted", "false"))) {
             throw trustFailure;
         }
     }
@@ -100,7 +100,7 @@ public class MultiTrustManager implements X509TrustManager {
             // (e.g. when there are no trust anchors at all) instead of a 
CertificateException.
             trustFailure = new CertificateException(e);
         }
-        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"server.all-trusted", "true"))) {
+        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"server.all-trusted", "false"))) {
             throw trustFailure;
         }
     }