This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/master by this push:
new b08d04e8e Improving docs for subject cert constraint (#690)
b08d04e8e is described below
commit b08d04e8eb121480aa26a78b9c2c7241258ffde0
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Mon Sep 14 15:21:03 2026 +0100
Improving docs for subject cert constraint (#690)
---
.../java/org/apache/wss4j/common/ConfigurationConstants.java | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git
a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
index ff1b447e4..9461fcb2c 100644
---
a/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
+++
b/ws-security-common/src/main/java/org/apache/wss4j/common/ConfigurationConstants.java
@@ -901,6 +901,15 @@ public class ConfigurationConstants {
* of regular expressions which will be applied to the subject DN of the
certificate used for signature
* validation, after trust verification of the certificate chain
associated with the
* certificate.
+ * <p/>
+ * The use-case this is intended for is where a CA certificate is
configured in the truststore,
+ * and so every certificate issued by that CA would otherwise be accepted
for signature
+ * validation. The constraints restrict this to the subject DNs that are
actually expected.
+ * <p/>
+ * It follows that these constraints are only applied when a certificate
chain has been
+ * constructed and validated for the certificate. They are not applied to
a certificate that is
+ * trusted directly, in other words one that is itself stored in the
keystore or truststore, as
+ * in that case trust has already been established for that individual
certificate.
*/
public static final String SIG_SUBJECT_CERT_CONSTRAINTS =
"sigSubjectCertConstraints";
