This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a change to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 48af999b06 Review "Remove stray raw path entry added to the WebSocket
template..."
new 16220b441c Document Windows keystores and TLS certificate reloading
new 77b5cd3fb3 Select a key store certificate valid for TLS server
authentication
new 7c64b73f70 Select a server-auth certificate for a configured
Windows-MY alias
new c2f69f5e13 Use the certificate actually served after Windows-MY alias
resolution
new da5c7a88c4 Fix typos
new 4c49e40747 Scan only the contiguous run of Windows-MY numbered
duplicates
new 1c4db41d7b Reuse SSLHostConfigCertificate.chooseServerAlias in the
OpenSSL contexts
new 1b5775aef1 Share served-alias resolution across all SSLContext engines
new 888aac479e Ignore alias case when reporting a resolved certificate
alias.
new e7406e57d1 Simplify by removing redundant method.
new 3af1880922 Resolve the served alias once when logging a certificate
new 96315d927e Enhance docs
new 5364993381 Skip key entries without a server-auth X.509 certificate
when auto-selecting
new f877cd6d78 Replace runtime certificate generation with pre-generated
fixtures
new 6c0cd6e2e2 Skip an entry only when its cert is provably unusable.
Absent/non-X.509 certs are accepted.
new 9084b72b15 The wrapped SSLContext and its key manager are supplied
pre-configured, so Tomcat cannot reliably predict which alias a handshake will
serve: the socket-based chooseServerAlias callback used elsewhere to probe the
served alias may disagree with the chooseEngineServerAlias callback that an
SSLEngine handshake actually uses. The alias the operator configured is
therefore the only dependable answer for certificate monitoring.
new 2ecc91ee39 Non-exportable Windows keys require JSSE
new 77f1211a66 Add TestSSLContextWrapper
new 276452c9e8 Catch RuntimeException in case of weird provider
new b3dd023e5c Align behavior with Panama
new 9810d1eaac Fix a missing alias being treated the same way as a present
but unsuitable certificate.
new c8ea979e0d Prefer the configured alias when Tomcat did not wrap the
key manager
The 22 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/catalina/manager/ManagerServlet.java | 8 +-
.../apache/tomcat/util/net/AbstractEndpoint.java | 28 +-
java/org/apache/tomcat/util/net/Constants.java | 18 +
.../apache/tomcat/util/net/LocalStrings.properties | 4 +
java/org/apache/tomcat/util/net/SSLContext.java | 61 +++
.../apache/tomcat/util/net/SSLContextWrapper.java | 16 +
java/org/apache/tomcat/util/net/SSLHostConfig.java | 7 +-
.../tomcat/util/net/SSLHostConfigCertificate.java | 27 ++
java/org/apache/tomcat/util/net/SSLUtilBase.java | 133 ++++++-
.../tomcat/util/net/jsse/JSSESSLContext.java | 18 +
.../util/net/openssl/LocalStrings.properties | 1 +
.../tomcat/util/net/openssl/OpenSSLContext.java | 60 +--
.../util/net/openssl/panama/OpenSSLContext.java | 57 +--
.../SSLUtilBaseCertificateSelectionTestBase.java | 441 +++++++++++++++++++++
.../tomcat/util/net/TestSSLContextServedAlias.java | 223 +++++++++++
.../tomcat/util/net/TestSSLContextWrapper.java | 156 ++++++++
...stSSLUtilBaseAutomaticCertificateSelection.java | 148 +++++++
.../TestSSLUtilBaseConfiguredAliasSelection.java | 255 ++++++++++++
.../tomcat/util/net/localhost-rsa-anyauth.jks | Bin 0 -> 2639 bytes
.../tomcat/util/net/localhost-rsa-clientauth.jks | Bin 0 -> 2643 bytes
.../apache/tomcat/util/net/localhost-rsa-noeku.jks | Bin 0 -> 2757 bytes
.../tomcat/util/net/localhost-rsa-serverauth.jks | Bin 0 -> 2644 bytes
.../tomcat/util/net/localhost-rsa-serverauth2.jks | Bin 0 -> 2641 bytes
webapps/docs/changelog.xml | 19 +
webapps/docs/config/http.xml | 34 +-
webapps/docs/ssl-howto.xml | 112 ++++++
26 files changed, 1700 insertions(+), 126 deletions(-)
create mode 100644
test/org/apache/tomcat/util/net/SSLUtilBaseCertificateSelectionTestBase.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLContextServedAlias.java
create mode 100644 test/org/apache/tomcat/util/net/TestSSLContextWrapper.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseAutomaticCertificateSelection.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-anyauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-clientauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-noeku.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-serverauth.jks
create mode 100644
test/org/apache/tomcat/util/net/localhost-rsa-serverauth2.jks
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
