You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ws.apache.org by "coheigea (via GitHub)" <gi...@apache.org> on 2026/10/13 06:44:19 UTC
[PR] WSS-721 - Search the truststore before the keystore when verifying trust [ws-wss4j]
coheigea opened a new pull request, #750:
URL: https://github.com/apache/ws-wss4j/pull/750
Merlin.verifyTrust searched the keystore before the truststore, both when
looking for the transmitted certificate itself (direct trust) and when
looking for its issuer. Trusted certificates are normally stored in the
truststore, so this caused an unnecessary keystore search, which is costly
when the KeyStore is backed by a remote or HSM provider.
The truststore is now searched first in both steps, and in MerlinAKI. A
certificate found in the keystore is still directly trusted, and the trust
anchors used for path validation are unchanged. The general
getX509Certificates(CryptoType) lookup order is not changed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
Re: [PR] WSS-721 - Search the truststore before the keystore when verifying trust [ws-wss4j]
Posted by "coheigea (via GitHub)" <gi...@apache.org>.
coheigea merged PR #750:
URL: https://github.com/apache/ws-wss4j/pull/750
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org