This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit c6b9d054a6c72529e7d6af30dd7566b621909a83 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 18:10:29 2026 +0200 Enhance docs --- java/org/apache/tomcat/util/net/SSLUtilBase.java | 5 +++-- webapps/docs/config/http.xml | 6 ++++-- webapps/docs/ssl-howto.xml | 8 +++++--- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java b/java/org/apache/tomcat/util/net/SSLUtilBase.java index cddcf325ed..876abb5735 100644 --- a/java/org/apache/tomcat/util/net/SSLUtilBase.java +++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java @@ -527,8 +527,9 @@ public abstract class SSLUtilBase implements SSLUtil { * so rejecting them would needlessly exclude the many server certificates issued without an EKU.</li> * <li>A certificate that <strong>does</strong> carry an EKU extension is usable only if that extension explicitly * lists the {@code id-kp-serverAuth} OID ({@value Constants#SERVER_AUTH_EXTENDED_KEY_USAGE_OID}) or the - * {@code anyExtendedKeyUsage} OID ({@value Constants#ANY_EXTENDED_KEY_USAGE_OID}). Any other declared usage - * - for example a certificate limited to client authentication - is rejected.</li> + * {@code anyExtendedKeyUsage} OID ({@value Constants#ANY_EXTENDED_KEY_USAGE_OID}). Any other usage - for + * example a certificate limited to client authentication, or an extension that lists no usages at all - is + * rejected.</li> * <li>A certificate whose EKU extension <strong>cannot be decoded</strong> is ignored (treated as not usable).</li> * </ul> * diff --git a/webapps/docs/config/http.xml b/webapps/docs/config/http.xml index 4960a5551e..0ab0c850cb 100644 --- a/webapps/docs/config/http.xml +++ b/webapps/docs/config/http.xml @@ -1921,8 +1921,10 @@ extension remain eligible. If no eligible key entry is found, connector initialization fails.</p> <p>A configured alias is used even if its certificate is not valid for TLS - server authentication. The exception is the Windows-MY store accessed - through the SunMSCAPI provider: if the certificate at the configured alias is + server authentication. The exception is a Windows-MY store accessed through + the SunMSCAPI provider (key store type <code>Windows-MY</code>, + <code>Windows-MY-CURRENTUSER</code> or <code>Windows-MY-LOCALMACHINE</code>): + if the certificate at the configured alias is not valid there, but the store also contains a key entry whose alias is the configured alias with <code>" (1)"</code>, <code>" (2)"</code>, etc. appended and whose certificate is valid, that certificate is used instead. That store diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml index a47598653d..480414d3b9 100644 --- a/webapps/docs/ssl-howto.xml +++ b/webapps/docs/ssl-howto.xml @@ -466,9 +466,11 @@ excludes both purposes or cannot be parsed are ignored. If no eligible key entry is found, connector initialization fails.</p> <p>A configured <strong>certificateKeyAlias</strong> is normally used even if its -certificate is unsuitable for server authentication. The one exception is the -Windows-MY store accessed through the SunMSCAPI provider: if the certificate at the -configured alias is unsuitable there, but the store also holds a suitable +certificate is unsuitable for server authentication. The one exception is a +Windows-MY store accessed through the SunMSCAPI provider (key store type +<code>Windows-MY</code>, <code>Windows-MY-CURRENTUSER</code> or +<code>Windows-MY-LOCALMACHINE</code>): if the certificate at the configured alias +is unsuitable there, but the store also holds a suitable certificate under that same name with <code>" (1)"</code>, <code>" (2)"</code>, etc. appended - the way that store gives unique aliases to several certificates that share a name, since the key store API requires aliases to be unique - the --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
