This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/subject-cert-constraints-javadoc in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 5242dadff6dd7bc1b5c702d5037ba6a21bca83f4 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Sep 14 14:56:52 2026 +0100 Improving docs for subject cert constraint --- .../java/org/apache/wss4j/common/ConfigurationConstants.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java index ff1b447e4..9461fcb2c 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java @@ -901,6 +901,15 @@ public class ConfigurationConstants { * of regular expressions which will be applied to the subject DN of the certificate used for signature * validation, after trust verification of the certificate chain associated with the * certificate. + * <p/> + * The use-case this is intended for is where a CA certificate is configured in the truststore, + * and so every certificate issued by that CA would otherwise be accepted for signature + * validation. The constraints restrict this to the subject DNs that are actually expected. + * <p/> + * It follows that these constraints are only applied when a certificate chain has been + * constructed and validated for the certificate. They are not applied to a certificate that is + * trusted directly, in other words one that is itself stored in the keystore or truststore, as + * in that case trust has already been established for that individual certificate. */ public static final String SIG_SUBJECT_CERT_CONSTRAINTS = "sigSubjectCertConstraints";
