This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/merlin-aki in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 44f3a6620c64dde618c22766c00a8153000f12d0 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Sep 22 11:54:56 2026 +0100 Fixing AKI bug --- .../src/main/java/org/apache/wss4j/common/crypto/MerlinAKI.java | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/MerlinAKI.java b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/MerlinAKI.java index 27bf7d7bf..549f64189 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/MerlinAKI.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/MerlinAKI.java @@ -208,7 +208,14 @@ public class MerlinAKI extends Merlin { private X509Certificate[] getX509CertificatesFromKeyIdentifier( byte[] keyIdentifierBytes ) throws WSSecurityException, NoSuchAlgorithmException, CertificateEncodingException { - if (keyIdentifierBytes == null) { + // A certificate with no AuthorityKeyIdentifier extension at all reads as an empty array, + // and one whose extension carries no keyIdentifier reads as null. Neither is an + // identifier: matching on the empty array made a certificate without the extension match + // every store entry that has no SubjectKeyIdentifier of its own, so an arbitrary entry + // was put forward as the issuer. This class looks the issuer up by that identifier and + // has no other way to find it, so without one there is nothing to search for. + if (keyIdentifierBytes == null || keyIdentifierBytes.length == 0) { + LOG.debug("The certificate carries no AuthorityKeyIdentifier to find its issuer by"); return new X509Certificate[0]; }
