This is an automated email from the ASF dual-hosted git repository.
dsoumis pushed a change to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 6d38d21ef9 Review "Remove stray raw path entry added to the WebSocket
template..."
new 3fc32588eb Document Windows keystores and TLS certificate reloading
new b1ec63c405 Select a key store certificate valid for TLS server
authentication
new 36f3d745d0 Select a server-auth certificate for a configured
Windows-MY alias
new 7aef71134c Use the certificate actually served after Windows-MY alias
resolution
new 2aec4ae182 Fix typos
new 4bfe0bd304 Scan only the contiguous run of Windows-MY numbered
duplicates
new 16992bfb5f Reuse SSLHostConfigCertificate.chooseServerAlias in the
OpenSSL contexts
new d705bdd900 Share served-alias resolution across all SSLContext engines
new 77901381d8 Ignore alias case when reporting a resolved certificate
alias.
new 20f4d33efb Simplify by removing redundant method.
new 5355f552cd Resolve the served alias once when logging a certificate
new a5dbd2493e Enhance docs
new faefc134aa Skip key entries without a server-auth X.509 certificate
when auto-selecting
new 61510fbf97 Replace runtime certificate generation with pre-generated
fixtures
new 9266eb82b0 Skip an entry only when its cert is provably unusable.
Absent/non-X.509 certs are accepted.
new c17acee849 The wrapped SSLContext and its key manager are supplied
pre-configured, so Tomcat cannot reliably predict which alias a handshake will
serve: the socket-based chooseServerAlias callback used elsewhere to probe the
served alias may disagree with the chooseEngineServerAlias callback that an
SSLEngine handshake actually uses. The alias the operator configured is
therefore the only dependable answer for certificate monitoring.
new 346d709a62 Non-exportable Windows keys require JSSE
new c923e72076 Add TestSSLContextWrapper
new 87b3943ff1 Catch RuntimeException in case of weird provider
new 097a0d533a Align behavior with Panama
new b91f958800 Fix a missing alias being treated the same way as a present
but unsuitable certificate.
new 0c3a4efabb Prefer the configured alias when Tomcat did not wrap the
key manager
The 22 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/catalina/manager/ManagerServlet.java | 8 +-
.../apache/tomcat/util/net/AbstractEndpoint.java | 28 +-
java/org/apache/tomcat/util/net/Constants.java | 18 +
.../apache/tomcat/util/net/LocalStrings.properties | 4 +
java/org/apache/tomcat/util/net/SSLContext.java | 61 +++
.../apache/tomcat/util/net/SSLContextWrapper.java | 16 +
java/org/apache/tomcat/util/net/SSLHostConfig.java | 7 +-
.../tomcat/util/net/SSLHostConfigCertificate.java | 27 ++
java/org/apache/tomcat/util/net/SSLUtilBase.java | 136 +++++-
.../tomcat/util/net/jsse/JSSESSLContext.java | 18 +
.../util/net/openssl/LocalStrings.properties | 1 +
.../tomcat/util/net/openssl/OpenSSLContext.java | 60 +--
.../util/net/openssl/panama/OpenSSLContext.java | 57 +--
.../SSLUtilBaseCertificateSelectionTestBase.java | 481 +++++++++++++++++++++
.../tomcat/util/net/TestSSLContextServedAlias.java | 221 ++++++++++
.../tomcat/util/net/TestSSLContextWrapper.java | 156 +++++++
...stSSLUtilBaseAutomaticCertificateSelection.java | 148 +++++++
.../TestSSLUtilBaseConfiguredAliasSelection.java | 255 +++++++++++
.../tomcat/util/net/localhost-rsa-anyauth.jks | Bin 0 -> 2639 bytes
.../tomcat/util/net/localhost-rsa-clientauth.jks | Bin 0 -> 2643 bytes
.../apache/tomcat/util/net/localhost-rsa-noeku.jks | Bin 0 -> 2757 bytes
.../tomcat/util/net/localhost-rsa-serverauth.jks | Bin 0 -> 2644 bytes
.../tomcat/util/net/localhost-rsa-serverauth2.jks | Bin 0 -> 2641 bytes
webapps/docs/changelog.xml | 19 +
webapps/docs/config/http.xml | 34 +-
webapps/docs/ssl-howto.xml | 112 +++++
26 files changed, 1741 insertions(+), 126 deletions(-)
create mode 100644
test/org/apache/tomcat/util/net/SSLUtilBaseCertificateSelectionTestBase.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLContextServedAlias.java
create mode 100644 test/org/apache/tomcat/util/net/TestSSLContextWrapper.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseAutomaticCertificateSelection.java
create mode 100644
test/org/apache/tomcat/util/net/TestSSLUtilBaseConfiguredAliasSelection.java
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-anyauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-clientauth.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-noeku.jks
create mode 100644 test/org/apache/tomcat/util/net/localhost-rsa-serverauth.jks
create mode 100644
test/org/apache/tomcat/util/net/localhost-rsa-serverauth2.jks
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
