This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 6c0cd6e2e2746e398088b0df3a5c681197a4c516 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 22:36:30 2026 +0200 Skip an entry only when its cert is provably unusable. Absent/non-X.509 certs are accepted. --- java/org/apache/tomcat/util/net/SSLUtilBase.java | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java b/java/org/apache/tomcat/util/net/SSLUtilBase.java index 5f2b74ff01..e4ef3e39d5 100644 --- a/java/org/apache/tomcat/util/net/SSLUtilBase.java +++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java @@ -406,17 +406,15 @@ public abstract class SSLUtilBase implements SSLUtil { if (!ks.isKeyEntry(candidate)) { continue; } - // Select only a key entry with an X.509 certificate valid for server authentication. A non-X.509 - // or absent certificate cannot be validated or serve TLS, so skip it rather than prefer it. Certificate cert = ks.getCertificate(candidate); - if (cert instanceof X509Certificate x509 && isServerAuthCapable(x509)) { - keyAlias = candidate; - } else { + if (cert instanceof X509Certificate x509 && !isServerAuthCapable(x509)) { if (log.isDebugEnabled()) { log.debug(sm.getString("sslUtilBase.skippedKeyUsage", candidate)); } skippedForServerAuth = true; + continue; } + keyAlias = candidate; } if (keyAlias == null) { if (skippedForServerAuth) { --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
