(ofbiz-framework) branch release24.09 updated: Fixed: Reject untrusted certificates in MultiTrustManager when the all-trusted properties are missing or empty (OFBIZ-13654)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 45474d5ae6 Fixed: Reject untrusted certificates in MultiTrustManager 
when the all-trusted properties are missing or empty (OFBIZ-13654)
45474d5ae6 is described below

commit 45474d5ae61e1c3410bf4a2ee086d58b1ad3ec63
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Wed Oct 7 17:37:45 2026 +0530

    Fixed: Reject untrusted certificates in MultiTrustManager when the 
all-trusted properties are missing or empty (OFBIZ-13654)
    
    MultiTrustManager ignored a certificate validation failure when the 
property server.all-trusted or client.all-trusted of certificate.properties was 
"true", and it read both properties with the default "true". A 
certificate.properties without these entries, or with an empty value, therefore 
silently disabled the certificate validation of the outgoing connections and of 
the client certificates. The shipped file sets both to false, so a default 
installation was not affected.
    
    Both properties are now read with the default "false", so that a missing or 
empty value keeps the validation on and only an explicit "true" turns it off.
---
 .../src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
index 3ce5e43131..6ffe8f9a41 100644
--- 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
+++ 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/MultiTrustManager.java
@@ -82,7 +82,7 @@ public class MultiTrustManager implements X509TrustManager {
             // (e.g. when there are no trust anchors at all) instead of a 
CertificateException.
             trustFailure = new CertificateException(e);
         }
-        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"client.all-trusted", "true"))) {
+        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"client.all-trusted", "false"))) {
             throw trustFailure;
         }
     }
@@ -100,7 +100,7 @@ public class MultiTrustManager implements X509TrustManager {
             // (e.g. when there are no trust anchors at all) instead of a 
CertificateException.
             trustFailure = new CertificateException(e);
         }
-        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"server.all-trusted", "true"))) {
+        if (!"true".equals(UtilProperties.getPropertyValue("certificate", 
"server.all-trusted", "false"))) {
             throw trustFailure;
         }
     }