This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a change to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 8f3becf09b Review "Remove stray raw path entry added to the WebSocket
template..."
new bea56b287b Document Windows keystores and TLS certificate reloading
new a65f4b6ce4 Select a key store certificate valid for TLS server
authentication
new 4353c62326 Select a server-auth certificate for a configured
Windows-MY alias
new 24d49b8a81 Use the certificate actually served after Windows-MY alias
resolution
new 62c7d75bc3 Fix typos
new 50e0397e2f Scan only the contiguous run of Windows-MY numbered
duplicates
new bc60238ff3 Reuse SSLHostConfigCertificate.chooseServerAlias in the
OpenSSL contexts
new c4c70fbd8c Share served-alias resolution across all SSLContext engines
new de04a5f3f6 Ignore alias case when reporting a resolved certificate
alias.
new 848b4ffbcf Simplify by removing redundant method.
new f1b0226300 Resolve the served alias once when logging a certificate
new c6b9d054a6 Enhance docs
new 1daa12c133 Skip key entries without a server-auth X.509 certificate
when auto-selecting
new 77199ff902 Replace runtime certificate generation with pre-generated
fixtures
new 5e13099b35 Skip an entry only when its cert is provably unusable.
Absent/non-X.509 certs are accepted.
new eb680748bb The wrapped SSLContext and its key manager are supplied
pre-configured, so Tomcat cannot reliably predict which alias a handshake will
serve: the socket-based chooseServerAlias callback used elsewhere to probe the
served alias may disagree with the chooseEngineServerAlias callback that an
SSLEngine handshake actually uses. The alias the operator configured is
therefore the only dependable answer for certificate monitoring.
new bbf1cd9afe Non-exportable Windows keys require JSSE
new 16d67c38ff Add TestSSLContextWrapper
new 3b3b4158fa Catch RuntimeException in case of weird provider
new 2ecf8c5a70 Align behavior with Panama
new c6a54476ee Fix a missing alias being treated the same way as a present
but unsuitable certificate.
new b8ebc64422 Prefer the configured alias when Tomcat did not wrap the
key manager
The 22 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/catalina/manager/ManagerServlet.java | 8 +-
.../apache/tomcat/util/net/AbstractEndpoint.java | 28 +-
java/org/apache/tomcat/util/net/Constants.java | 18 +
.../apache/tomcat/util/net/LocalStrings.properties | 4 +
java/org/apache/tomcat/util/net/SSLContext.java | 61 +++
.../apache/tomcat/util/net/SSLContextWrapper.java | 16 +
java/org/apache/tomcat/util/net/SSLHostConfig.java | 7 +-
.../tomcat/util/net/SSLHostConfigCertificate.java | 27 ++
java/org/apache/tomcat/util/net/SSLUtilBase.java | 136 +++++-
.../tomcat/util/net/jsse/JSSESSLContext.java | 18 +
.../util/net/openssl/LocalStrings.properties | 1 +
.../tomcat/util/net/openssl/OpenSSLContext.java | 60 +--
.../util/net/openssl/panama/OpenSSLContext.java | 57 +--
.../SSLUtilBaseCertificateSelectionTestBase.java | 487 +++++++++++++++++++++
.../tomcat/util/net/TestSSLContextServedAlias.java | 229 ++++++++++
.../tomcat/util/net/TestSSLContextWrapper.java | 161 +++++++
...stSSLUtilBaseAutomaticCertificateSelection.java | 153 +++++++
.../TestSSLUtilBaseConfiguredAliasSelection.java | 255 +++++++++++
.../tomcat/util/net/localhost-rsa-anyauth.jks | Bin 0 -> 2639 bytes
.../tomcat/util/net/localhost-rsa-clientauth.jks | Bin 0 -> 2643 bytes
.../apache/tomcat/util/net/localhost-rsa-noeku.jks | Bin 0 -> 2757 bytes
.../tomcat/util/net/localhost-rsa-serverauth.jks | Bin 0 -> 2644 bytes
.../tomcat/util/net/localhost-rsa-serverauth2.jks | Bin 0 -> 2641 bytes
webapps/docs/changelog.xml | 19 +
webapps/docs/config/http.xml | 34 +-
webapps/docs/ssl-howto.xml | 112 +++++
26 files changed, 1765 insertions(+), 126 deletions(-)
create mode 100644
test/org/apache/tomcat/util/net/SSLUtilBaseCertificateSelectionTestBase.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLContextServedAlias.java
create mode 100644 test/org/apache/tomcat/util/net/TestSSLContextWrapper.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseAutomaticCertificateSelection.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-anyauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-clientauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-noeku.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-serverauth.jks
create mode 100644
test/org/apache/tomcat/util/net/localhost-rsa-serverauth2.jks
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
