dsoumis commented on PR #1098: URL: https://github.com/apache/tomcat/pull/1098#issuecomment-6374226744
> This PR appears to be missing some key points. > > The Java KeyStore API assumes that aliases are unique. The original problem was related to multiple keys of different types with the same alias. > > It looks like for current versions of Java (including latest 8) those duplicate aliases get a number appended to the end: > > * alias > * alias (1) > * alias (2) > > We need to handle this when looking for alias and checking the EKU value. @markt-asf I have been thinking on how to resolve this, but no idea seems concise enough to implement. I am considering the scenario where: | Java alias | Actual original name | EKU | | :--- | :----: | ----: | | tomcat | tomcat | clientAuth | | tomcat (1) | tomcat (1) | serverAuth | | tomcat (2) | tomcat | serverAuth | so treating aliases only by their number suffix is not an option. Running on debug I noticed that the original alias is available, but KeyStore.keyStoreSpi is private. From my point of view, this is something that should be addressed on the jdk's side. see: <img width="1443" height="831" alt="image" src="https://github.com/user-attachments/assets/a423f7f5-5183-4e92-9bb7-1377c0796816"; /> I've looked around openjdk source code and resulted in sending the following email. https://mail.openjdk.org/archives/list/[email protected]/thread/XUCB6BURVVSJEFJMCEHP34XNUOSPVAGR/ It's noteworthy that, per https://bugs.openjdk.org/browse/JDK-8187634, it seems there is a mismatch on what getCertificateAlias returns before and after java 23. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
