This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit eb680748bb4007ea8c8255448dd1d1764ee3080e Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 22:39:18 2026 +0200 The wrapped SSLContext and its key manager are supplied pre-configured, so Tomcat cannot reliably predict which alias a handshake will serve: the socket-based chooseServerAlias callback used elsewhere to probe the served alias may disagree with the chooseEngineServerAlias callback that an SSLEngine handshake actually uses. The alias the operator configured is therefore the only dependable answer for certificate monitoring. --- java/org/apache/tomcat/util/net/SSLContextWrapper.java | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLContextWrapper.java b/java/org/apache/tomcat/util/net/SSLContextWrapper.java index b1b434d5f0..5c75ad3764 100644 --- a/java/org/apache/tomcat/util/net/SSLContextWrapper.java +++ b/java/org/apache/tomcat/util/net/SSLContextWrapper.java @@ -81,9 +81,19 @@ class SSLContextWrapper implements SSLContext { } + /** + * {@inheritDoc} + * <p> + * The wrapped {@code javax.net.ssl.SSLContext} and its key manager are supplied pre-configured, so Tomcat cannot + * reliably predict which alias a handshake will serve: the socket-based {@link X509KeyManager#chooseServerAlias} + * callback used elsewhere to probe the served alias may disagree with the {@code chooseEngineServerAlias} callback + * that an {@code SSLEngine} handshake actually uses. The alias the operator configured is therefore the only + * dependable answer for certificate monitoring. + */ @Override - public X509KeyManager[] getServerKeyManagers(SSLHostConfigCertificate certificate) { - return new X509KeyManager[] { keyManager }; + public String getServedAlias(SSLHostConfigCertificate certificate) { + String configuredAlias = certificate.getCertificateKeyAlias(); + return configuredAlias == null ? SSLUtilBase.DEFAULT_KEY_ALIAS : configuredAlias; } @Override --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
