[ https://issues.apache.org/jira/browse/QPID-8367?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17024425#comment-17024425 ]
ASF GitHub Bot commented on QPID-8367: -------------------------------------- alex-rufous commented on issue #44: QPID-8367 [Broker-J] Trusted CA revocation list URL: https://github.com/apache/qpid-broker-j/pull/44#issuecomment-578801454 Hi Tomas, Thanks for addressing my review comments. My apologies for the delay with applying this pull request. I have an additional question to the implementation of `org.apache.qpid.server.security.AbstractTrustStore#getParameters`. If attribute 'certificateRevocationListUrl' is set, the other certificate revocation check attributes are ignored. Why is that? I cannot find in documentation that `java.security.cert.PKIXParameters#addCertStore` and `java.security.cert.PKIXParameters#addCertPathChecker` are mutually exclusive. It looks like we should be able to add `PKIXRevocationChecker` together with not null CLR. Am I missing something here? Kind Regards, Alex ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org > [Broker-J] Trusted CA revocation list > ------------------------------------- > > Key: QPID-8367 > URL: https://issues.apache.org/jira/browse/QPID-8367 > Project: Qpid > Issue Type: Improvement > Components: Broker-J > Reporter: Tomas Vavricka > Priority: Major > Fix For: qpid-java-broker-8.0.0 > > > Qpid Broker-J supports custom CA. When in place clients then can connect with > certificate signed by custom CA. > However there is no way to reject compromised certificates. Implementation of > revocation list for custom CA can solve this issue. -- This message was sent by Atlassian Jira (v8.3.4#803005) --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org