This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 96315d927e20d01400afd1a8bccc1892109d0605 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 18:10:29 2026 +0200 Enhance docs --- java/org/apache/tomcat/util/net/SSLUtilBase.java | 5 +++-- webapps/docs/config/http.xml | 6 ++++-- webapps/docs/ssl-howto.xml | 8 +++++--- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java b/java/org/apache/tomcat/util/net/SSLUtilBase.java index fdacffe9cd..e4ef3e39d5 100644 --- a/java/org/apache/tomcat/util/net/SSLUtilBase.java +++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java @@ -525,8 +525,9 @@ public abstract class SSLUtilBase implements SSLUtil { * so rejecting them would needlessly exclude the many server certificates issued without an EKU.</li> * <li>A certificate that <strong>does</strong> carry an EKU extension is usable only if that extension explicitly * lists the {@code id-kp-serverAuth} OID ({@value Constants#SERVER_AUTH_EXTENDED_KEY_USAGE_OID}) or the - * {@code anyExtendedKeyUsage} OID ({@value Constants#ANY_EXTENDED_KEY_USAGE_OID}). Any other declared usage - * - for example a certificate limited to client authentication - is rejected.</li> + * {@code anyExtendedKeyUsage} OID ({@value Constants#ANY_EXTENDED_KEY_USAGE_OID}). Any other usage - for + * example a certificate limited to client authentication, or an extension that lists no usages at all - is + * rejected.</li> * <li>A certificate whose EKU extension <strong>cannot be decoded</strong> is ignored (treated as not usable).</li> * </ul> * diff --git a/webapps/docs/config/http.xml b/webapps/docs/config/http.xml index 4ce7080196..c61698201b 100644 --- a/webapps/docs/config/http.xml +++ b/webapps/docs/config/http.xml @@ -1736,8 +1736,10 @@ extension remain eligible. If no eligible key entry is found, connector initialization fails.</p> <p>A configured alias is used even if its certificate is not valid for TLS - server authentication. The exception is the Windows-MY store accessed - through the SunMSCAPI provider: if the certificate at the configured alias is + server authentication. The exception is a Windows-MY store accessed through + the SunMSCAPI provider (key store type <code>Windows-MY</code>, + <code>Windows-MY-CURRENTUSER</code> or <code>Windows-MY-LOCALMACHINE</code>): + if the certificate at the configured alias is not valid there, but the store also contains a key entry whose alias is the configured alias with <code>" (1)"</code>, <code>" (2)"</code>, etc. appended and whose certificate is valid, that certificate is used instead. That store diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml index 069497e73f..10aae1da39 100644 --- a/webapps/docs/ssl-howto.xml +++ b/webapps/docs/ssl-howto.xml @@ -462,9 +462,11 @@ excludes both purposes or cannot be parsed are ignored. If no eligible key entry is found, connector initialization fails.</p> <p>A configured <strong>certificateKeyAlias</strong> is normally used even if its -certificate is unsuitable for server authentication. The one exception is the -Windows-MY store accessed through the SunMSCAPI provider: if the certificate at the -configured alias is unsuitable there, but the store also holds a suitable +certificate is unsuitable for server authentication. The one exception is a +Windows-MY store accessed through the SunMSCAPI provider (key store type +<code>Windows-MY</code>, <code>Windows-MY-CURRENTUSER</code> or +<code>Windows-MY-LOCALMACHINE</code>): if the certificate at the configured alias +is unsuitable there, but the store also holds a suitable certificate under that same name with <code>" (1)"</code>, <code>" (2)"</code>, etc. appended - the way that store gives unique aliases to several certificates that share a name, since the key store API requires aliases to be unique - the --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
