Hi Mark, This is probably a question for the security-dev mailing list, which I have put in the to: of my reply.
best regards, -- daniel On 07/07/2020 20:24, Mark A. Claassen wrote:
I was curious if there has been any thought to allowing accessing to other certificate stores in Windows besides the "Trusted Root Certification Authorities" and the "Personal" ones. It seems like web servers omitting intermediate certificates in the certificate chain is pretty common. Browsers seems to fill in the gaps, but Java does not. We very recently encountered this again when a customer started proxying their SSL requests, creating a new certificate on the fly, resigning ours with their corporate CA. (The browser handled this fine, but our Java app detected a chain length of 2, instead of 4 like in the browser.) Having them put their intermediate certificates in the "Trusted Root Certification Authorities" solved the issue, but they are unwilling to do this on a corporate-wide basis. If Java was able to access more keystores through the MSCAPI interface, is seems like it would fill in the gaps as well and remove a pain point we are experiencing where Java does not accept a certificate even though all their browsers will. I think all intermediate certificates are supposed to be in the chain sent from the server (https://tools.ietf.org/html/rfc5246) in the TLS negotiation, but since browser's don't enforce care, people are left thinking everything is great (until Java tries to connect). Thanks, Mark Claassen Senior Software Engineer Donnell Systems, Inc. 130 South Main Street Leighton Plaza Suite 375 South Bend, IN 46601 E-mail: mailto:mclaas...@ocie.net Voice: (574)232-3784 Fax: (574)232-4014 Disclaimer: The opinions provided herein do not necessarily state or reflect those of Donnell Systems, Inc.(DSI). DSI makes no warranty for and assumes no legal liability or responsibility for the posting.
