This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit f1b0226300f2be96423a5e5c40544b3670ee9f03 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 18:01:26 2026 +0200 Resolve the served alias once when logging a certificate --- .../apache/tomcat/util/net/AbstractEndpoint.java | 25 +++++++++++----------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/java/org/apache/tomcat/util/net/AbstractEndpoint.java b/java/org/apache/tomcat/util/net/AbstractEndpoint.java index 74c7b68d42..20bed17f8e 100644 --- a/java/org/apache/tomcat/util/net/AbstractEndpoint.java +++ b/java/org/apache/tomcat/util/net/AbstractEndpoint.java @@ -552,23 +552,24 @@ public abstract class AbstractEndpoint<S, U> { getLogCertificate().info(sm.getString("endpoint.tls.info", getName(), sslHostConfig.getHostName(), certificate.getType(), certificateInfo, trustStoreSource)); - // When a configured alias was resolved to a different alias than is actually served (e.g. a SunMSCAPI - // Windows-MY numbered duplicate), report it so the alias logged above is not mistaken for the one in use. - String configuredAlias = certificate.getCertificateKeyAlias(); - if (sslContext != null && configuredAlias != null) { + if (sslContext != null) { String servedAlias = sslContext.getServedAlias(certificate); - if (servedAlias != null && !servedAlias.equalsIgnoreCase(configuredAlias)) { + + // When a configured alias was resolved to a different alias than is actually served (e.g. a SunMSCAPI + // Windows-MY numbered duplicate), report it so the alias logged above is not mistaken for the one in use. + String configuredAlias = certificate.getCertificateKeyAlias(); + if (configuredAlias != null && servedAlias != null && !servedAlias.equalsIgnoreCase(configuredAlias)) { getLogCertificate() .info(sm.getString("endpoint.tls.info.cert.aliasResolved", configuredAlias, servedAlias)); } - } - if (getLogCertificate().isDebugEnabled() && sslContext != null) { - X509Certificate[] x509Certificates = sslContext.getCertificateChain(sslContext.getServedAlias(certificate)); - if (x509Certificates != null && x509Certificates.length > 0) { - getLogCertificate().debug(generateCertificateDebug(x509Certificates[0])); - } else { - getLogCertificate().debug(sm.getString("endpoint.tls.cert.noCerts")); + if (getLogCertificate().isDebugEnabled()) { + X509Certificate[] x509Certificates = sslContext.getCertificateChain(servedAlias); + if (x509Certificates != null && x509Certificates.length > 0) { + getLogCertificate().debug(generateCertificateDebug(x509Certificates[0])); + } else { + getLogCertificate().debug(sm.getString("endpoint.tls.cert.noCerts")); + } } } } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
