markt-asf commented on PR #1098:
URL: https://github.com/apache/tomcat/pull/1098#issuecomment-6374451113
Thanks for looking into this in more depth. I agree this needs to be fixed
on the JRE side. The proper fix looks like it would need a breaking API change.
As much as it pains me to hack a solution, we do have a user with a genuine
issue. How about the following approach:
- document the JRE's keystore behaviour
- implement
1. look for the configured alias
2. if no cert found, fail
3. if EKU is for servers use this alias
4. if EKU not for servers look for next alias in JDK order "alias (1)",
"alias (2)" etc
5. goto 2
It isn't perfect. Aliases genuinely ending in (1) are going to conflict but
is that very likely? And it does solve the problem reported on users@ (at least
I think it does). WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
