christophvw commented on PR #1089: URL: https://github.com/apache/tomcat/pull/1089#issuecomment-6270249096
> > Can you check for outdated certificates as well here? Perhaps choose the one with the longest remaining validity, or at least avoid any that have expired > > I think we should not skip expired certificates unless there is an equivalent one with the same DN. We should not be preventing the server from starting if there is only an expired certificate to serve. It's the client's responsibility to decide whether or not to trust an expired certificate. good point. But choosing the one with the longest remaining validity would be good. Certs skipped because of missing read permissions for the private key should be logged otherwise people will change the tomcat service to Local System again instead of setting proper key permissions. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
