This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 2_4_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/2_4_x-fixes by this push:
new 3a281442a Improving docs for subject cert constraint (#690)
3a281442a is described below
commit 3a281442ab0509c2f93a2372d416b9967f0e3ec2
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Mon Sep 14 15:21:03 2026 +0100
Improving docs for subject cert constraint (#690)
---
.../java/org/apache/wss4j/common/ConfigurationConstants.java | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git
a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
index 6376b164e..cea8505cf 100644
---
a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
+++
b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
@@ -848,6 +848,15 @@ public class ConfigurationConstants {
* of regular expressions which will be applied to the subject DN of the
certificate used for signature
* validation, after trust verification of the certificate chain
associated with the
* certificate.
+ * <p/>
+ * The use-case this is intended for is where a CA certificate is
configured in the truststore,
+ * and so every certificate issued by that CA would otherwise be accepted
for signature
+ * validation. The constraints restrict this to the subject DNs that are
actually expected.
+ * <p/>
+ * It follows that these constraints are only applied when a certificate
chain has been
+ * constructed and validated for the certificate. They are not applied to
a certificate that is
+ * trusted directly, in other words one that is itself stored in the
keystore or truststore, as
+ * in that case trust has already been established for that individual
certificate.
*/
public static final String SIG_SUBJECT_CERT_CONSTRAINTS =
"sigSubjectCertConstraints";
