This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 50e0397e2f766dc1908a82ddadb66f3ce7a1f29d Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 14:30:38 2026 +0200 Scan only the contiguous run of Windows-MY numbered duplicates --- java/org/apache/tomcat/util/net/SSLUtilBase.java | 13 +++++++------ .../util/net/TestSSLUtilBaseConfiguredAliasSelection.java | 9 ++------- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java b/java/org/apache/tomcat/util/net/SSLUtilBase.java index 85880184b5..cddcf325ed 100644 --- a/java/org/apache/tomcat/util/net/SSLUtilBase.java +++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java @@ -491,25 +491,26 @@ public abstract class SSLUtilBase implements SSLUtil { * @param baseAlias the configured alias. Not itself re-checked: the caller has already determined that its * certificate is not valid for TLS server authentication. * - * @return the alias of the first duplicate (in increasing numeric order starting at 1) whose certificate is - * valid for TLS server authentication, or {@code null} if there is no such duplicate + * @return the alias of the first duplicate in the contiguous run (in increasing numeric order starting at 1) whose + * certificate is valid for TLS server authentication, or {@code null} if there is no such duplicate * * @throws KeyStoreException if the key store has not been initialized */ private static String findServerAuthAliasInWindowsMYFamily(KeyStore ks, String baseAlias) throws KeyStoreException { - int limit = Collections.list(ks.aliases()).size(); - for (int suffix = 1; suffix <= limit; suffix++) { + int suffix = 1; + while (true) { String candidateAlias = baseAlias + " (" + suffix + ")"; Certificate candidateCert = ks.getCertificate(candidateAlias); if (candidateCert == null) { - continue; + // The first missing number ends the contiguous run of numbered duplicates. + return null; } if (candidateCert instanceof X509Certificate && ks.isKeyEntry(candidateAlias) && isServerAuthCapable((X509Certificate) candidateCert)) { return candidateAlias; } + suffix++; } - return null; } diff --git a/test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java b/test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java index 05189fc0ef..f9f2a4c0e6 100644 --- a/test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java +++ b/test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java @@ -198,17 +198,12 @@ public class TestSSLUtilBaseConfiguredAliasSelection extends SSLUtilBaseCertific } - /* - * The numbered duplicates of a Windows-MY friendly name are normally contiguous, but should a gap appear (for - * example a lower-numbered duplicate was removed) the search must keep scanning past it rather than stop, so a valid - * server-auth duplicate beyond the gap is still found. - */ @Test - public void testConfiguredAliasSkipsGapInNumberedDuplicates() throws Exception { + public void testConfiguredAliasStopsAtGapAndKeepsBase() throws Exception { X509Certificate presented = present("tomcat", key("tomcat", CLIENT_AUTH), key("tomcat (2)", SERVER_AUTH)); - assertEku(presented, Constants.SERVER_AUTH_EXTENDED_KEY_USAGE_OID); + assertEku(presented, CLIENT_AUTH_EXTENDED_KEY_USAGE_OID); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
