Furthermore, should the alternate issuer itself be issued by another "alternate" issuer, the entries inserted at the certificates map on previous iterations (on which traverseChain might have thrown an exception by not having found the correct issuer yet) might be required later, in order to match the whole chain.
This leads to a second point. The key to the certificates map (certificatesMap) is currently a BigInteger corresponding to the serial number of the certificate. This will work in most scenarios, however, nothing prevents certificates from different issuers to have equal serial numbers - issuers from Brazil often assign low integers to the serial numbers, meaning a high chance of serial number clash with certificates from other issuers. Therefore, changing the certificates map key to a String corresponding to the canonical Subject Name, followed by a separator character (e.g. colon ":"), followed by the Serial Number toString would be a handy improvement as well. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
