This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 9810d1eaac437e3b307c8eb9e1e1eb96dcb14b63 Author: Dimitris Soumis <[email protected]> AuthorDate: Wed Nov 4 13:33:15 2026 +0200 Fix a missing alias being treated the same way as a present but unsuitable certificate. --- java/org/apache/tomcat/util/net/SSLUtilBase.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java b/java/org/apache/tomcat/util/net/SSLUtilBase.java index 1cde87ef74..f9969a09eb 100644 --- a/java/org/apache/tomcat/util/net/SSLUtilBase.java +++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java @@ -423,7 +423,7 @@ public abstract class SSLUtilBase implements SSLUtil { throw new IOException(sm.getString("sslUtilBase.alias_no_key_entry", (Object) null)); } } else { - if (isSunMSCAPIWindowsMY(ks)) { + if (isSunMSCAPIWindowsMY(ks) && ks.containsAlias(keyAlias)) { Certificate configuredCert = ks.isKeyEntry(keyAlias) ? ks.getCertificate(keyAlias) : null; if (!(configuredCert instanceof X509Certificate x509) || !isServerAuthCapable(x509)) { String duplicateAlias = findServerAuthAliasInWindowsMYFamily(ks, keyAlias); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
