coheigea opened a new pull request, #750: URL: https://github.com/apache/ws-wss4j/pull/750
Merlin.verifyTrust searched the keystore before the truststore, both when looking for the transmitted certificate itself (direct trust) and when looking for its issuer. Trusted certificates are normally stored in the truststore, so this caused an unnecessary keystore search, which is costly when the KeyStore is backed by a remote or HSM provider. The truststore is now searched first in both steps, and in MerlinAKI. A certificate found in the keystore is still directly trusted, and the trust anchors used for path validation are unchanged. The general getX509Certificates(CryptoType) lookup order is not changed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
