This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 848b4ffbcf6586470fe2943b6fb5eafb8ebe189a Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 17:48:22 2026 +0200 Simplify by removing redundant method. --- .../apache/catalina/manager/ManagerServlet.java | 3 ++- java/org/apache/tomcat/util/net/SSLContext.java | 23 +++------------------- java/org/apache/tomcat/util/net/SSLHostConfig.java | 3 ++- 3 files changed, 7 insertions(+), 22 deletions(-) diff --git a/java/org/apache/catalina/manager/ManagerServlet.java b/java/org/apache/catalina/manager/ManagerServlet.java index cde65b296a..cc81af58f9 100644 --- a/java/org/apache/catalina/manager/ManagerServlet.java +++ b/java/org/apache/catalina/manager/ManagerServlet.java @@ -1748,7 +1748,8 @@ public class ManagerServlet extends HttpServlet implements ContainerServlet { if (sslContext == null) { certList.add(smClient.getString("managerServlet.certsNotLoaded")); } else { - X509Certificate[] certs = sslContext.getCertificateChain(sslHostConfigCert); + X509Certificate[] certs = sslContext.getCertificateChain( + sslContext.getServedAlias(sslHostConfigCert)); if (certs == null) { certList.add(smClient.getString("managerServlet.certsNotAvailable")); } else { diff --git a/java/org/apache/tomcat/util/net/SSLContext.java b/java/org/apache/tomcat/util/net/SSLContext.java index 7c3c4134ef..0f282f3b2d 100644 --- a/java/org/apache/tomcat/util/net/SSLContext.java +++ b/java/org/apache/tomcat/util/net/SSLContext.java @@ -91,10 +91,7 @@ public interface SSLContext { SSLParameters getSupportedSSLParameters(); /** - * Returns the certificate chain for the given key store alias. This is a low-level lookup by exact alias; callers - * that want the certificate actually served for a configured {@link SSLHostConfigCertificate} should use - * {@link #getCertificateChain(SSLHostConfigCertificate)}, which resolves the served alias (it can differ from the - * configured alias, for example after SunMSCAPI Windows-MY numbered-duplicate resolution). + * Returns the certificate chain for the given alias. * * @param alias The alias * @@ -137,25 +134,11 @@ public interface SSLContext { } } } - String configured = certificate.getCertificateKeyAlias(); - return configured == null ? SSLUtilBase.DEFAULT_KEY_ALIAS : configured; + String configuredAlias = certificate.getCertificateKeyAlias(); + return configuredAlias == null ? SSLUtilBase.DEFAULT_KEY_ALIAS : configuredAlias; } - /** - * Returns the certificate chain actually served for the given certificate configuration. Unlike - * {@link #getCertificateChain(String)}, which looks up a fixed alias, this uses {@link #getServedAlias}, so callers - * such as the certificate reload check observe the certificate that is really in use. This can differ from the - * configured alias, for example after SunMSCAPI Windows-MY duplicate resolution. - * - * @param certificate The certificate configuration - * - * @return The served certificate chain, or {@code null} if none can be determined - */ - default X509Certificate[] getCertificateChain(SSLHostConfigCertificate certificate) { - return getCertificateChain(getServedAlias(certificate)); - } - /** * Returns the accepted issuers. * diff --git a/java/org/apache/tomcat/util/net/SSLHostConfig.java b/java/org/apache/tomcat/util/net/SSLHostConfig.java index 137393210d..9707bb4118 100644 --- a/java/org/apache/tomcat/util/net/SSLHostConfig.java +++ b/java/org/apache/tomcat/util/net/SSLHostConfig.java @@ -1873,7 +1873,8 @@ public class SSLHostConfig implements Serializable { for (SSLHostConfigCertificate sslHostConfigCertificate : sslHostConfigCertificates) { SSLContext sslContext = sslHostConfigCertificate.getSslContext(); if (sslContext != null) { - X509Certificate[] certificates = sslContext.getCertificateChain(sslHostConfigCertificate); + X509Certificate[] certificates = sslContext.getCertificateChain( + sslContext.getServedAlias(sslHostConfigCertificate)); if (certificates != null && certificates.length > 0) { X509Certificate certificate = certificates[0]; Date expirationDate = certificate.getNotAfter(); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
