This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 1277d43953 More docs updates.
1277d43953 is described below
commit 1277d439530142bdf23fc1956b726a19a0af9680
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Nov 5 15:07:41 2026 +0000
More docs updates.
Co-authored by: Claude / Sonnet 5.5
---
webapps/docs/config/http.xml | 4 +++-
webapps/docs/ssl-howto.xml | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/webapps/docs/config/http.xml b/webapps/docs/config/http.xml
index 0ab0c850cb..8c804608f1 100644
--- a/webapps/docs/config/http.xml
+++ b/webapps/docs/config/http.xml
@@ -1919,7 +1919,9 @@
<code>serverAuth</code> nor <code>anyExtendedKeyUsage</code>, are ignored
when selecting the key to use. Certificates with no Extended Key Usage
extension remain eligible. If no eligible key entry is found, connector
- initialization fails.</p>
+ initialization fails. This selection does not apply when the key manager
+ factory is provided by a FIPS provider. Tomcat does not wrap or alter the
+ keys in that case, so the provider chooses which entry is served.</p>
<p>A configured alias is used even if its certificate is not valid for
TLS
server authentication. The exception is a Windows-MY store accessed
through
the SunMSCAPI provider (key store type <code>Windows-MY</code>,
diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml
index 0185ce9d7d..8ddd575a35 100644
--- a/webapps/docs/ssl-howto.xml
+++ b/webapps/docs/ssl-howto.xml
@@ -463,7 +463,9 @@ qualifies if its Extended Key Usage includes
<code>serverAuth</code> or <code>anyExtendedKeyUsage</code>, or if it has no
Extended Key Usage extension at all. Certificates whose Extended Key Usage
excludes both purposes or cannot be parsed are ignored. If no eligible key
entry
-is found, connector initialization fails.</p>
+is found, connector initialization fails. This selection does not apply when
the
+key manager factory is provided by a FIPS provider. Tomcat does not wrap or
alter
+the keys in that case, so the provider chooses which entry is served.</p>
<p>A configured <strong>certificateKeyAlias</strong> is normally used even if
its
certificate is unsuitable for server authentication. The one exception is a
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
