This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 52209c65df Review "Remove stray raw path entry added to the WebSocket
template..."
new 1e7a786f78 Document Windows keystores and TLS certificate reloading
new 5aa46ccb20 Select a key store certificate valid for TLS server
authentication
new c4031a639e Select a server-auth certificate for a configured
Windows-MY alias
new d8d120b896 Use the certificate actually served after Windows-MY alias
resolution
new d9e248b6b0 Fix typos
new f9385793c5 Scan only the contiguous run of Windows-MY numbered
duplicates
new 7df07b0b6a Reuse SSLHostConfigCertificate.chooseServerAlias in the
OpenSSL contexts
new e7cf9e3db1 Share served-alias resolution across all SSLContext engines
new 8e721866d7 Ignore alias case when reporting a resolved certificate
alias.
new 14a26e85e3 Simplify by removing redundant method.
new 6e99e72d6a Resolve the served alias once when logging a certificate
new 7177918131 Enhance docs
new ed9ad6ddbd Skip key entries without a server-auth X.509 certificate
when auto-selecting
new d6da4e0799 Replace runtime certificate generation with pre-generated
fixtures
new bb2b3c3b68 Skip an entry only when its cert is provably unusable.
Absent/non-X.509 certs are accepted.
new fc344de5ef The wrapped SSLContext and its key manager are supplied
pre-configured, so Tomcat cannot reliably predict which alias a handshake will
serve: the socket-based chooseServerAlias callback used elsewhere to probe the
served alias may disagree with the chooseEngineServerAlias callback that an
SSLEngine handshake actually uses. The alias the operator configured is
therefore the only dependable answer for certificate monitoring.
new f733156547 Non-exportable Windows keys require JSSE
new 87d0975f19 Add TestSSLContextWrapper
new 69d20902cb Catch RuntimeException in case of weird provider
new 7b42c5d999 Align behavior with Panama
new e02987a24d Fix a missing alias being treated the same way as a present
but unsuitable certificate.
new d87fc62a58 Prefer the configured alias when Tomcat did not wrap the
key manager
The 22 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/catalina/manager/ManagerServlet.java | 8 +-
.../apache/tomcat/util/net/AbstractEndpoint.java | 28 +-
java/org/apache/tomcat/util/net/Constants.java | 18 +
.../apache/tomcat/util/net/LocalStrings.properties | 4 +
java/org/apache/tomcat/util/net/SSLContext.java | 61 +++
.../apache/tomcat/util/net/SSLContextWrapper.java | 16 +
java/org/apache/tomcat/util/net/SSLHostConfig.java | 7 +-
.../tomcat/util/net/SSLHostConfigCertificate.java | 27 ++
java/org/apache/tomcat/util/net/SSLUtilBase.java | 133 ++++++-
.../tomcat/util/net/jsse/JSSESSLContext.java | 18 +
.../util/net/openssl/LocalStrings.properties | 1 +
.../tomcat/util/net/openssl/OpenSSLContext.java | 60 +--
.../util/net/openssl/panama/OpenSSLContext.java | 62 +--
.../SSLUtilBaseCertificateSelectionTestBase.java | 441 +++++++++++++++++++++
.../tomcat/util/net/TestSSLContextServedAlias.java | 223 +++++++++++
.../tomcat/util/net/TestSSLContextWrapper.java | 156 ++++++++
...stSSLUtilBaseAutomaticCertificateSelection.java | 148 +++++++
.../TestSSLUtilBaseConfiguredAliasSelection.java | 255 ++++++++++++
.../tomcat/util/net/localhost-rsa-anyauth.jks | Bin 0 -> 2639 bytes
.../tomcat/util/net/localhost-rsa-clientauth.jks | Bin 0 -> 2643 bytes
.../apache/tomcat/util/net/localhost-rsa-noeku.jks | Bin 0 -> 2757 bytes
.../tomcat/util/net/localhost-rsa-serverauth.jks | Bin 0 -> 2644 bytes
.../tomcat/util/net/localhost-rsa-serverauth2.jks | Bin 0 -> 2641 bytes
webapps/docs/changelog.xml | 19 +
webapps/docs/config/http.xml | 34 +-
webapps/docs/ssl-howto.xml | 112 ++++++
26 files changed, 1701 insertions(+), 130 deletions(-)
create mode 100644
test/org/apache/tomcat/util/net/SSLUtilBaseCertificateSelectionTestBase.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLContextServedAlias.java
create mode 100644 test/org/apache/tomcat/util/net/TestSSLContextWrapper.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseAutomaticCertificateSelection.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-anyauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-clientauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-noeku.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-serverauth.jks
create mode 100644
test/org/apache/tomcat/util/net/localhost-rsa-serverauth2.jks
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
