[jira] [Created] (OFBIZ-13654) Make MultiTrustManager reject untrusted certificates when its all-trusted properties are missing or empty

["Mridul Pathak (Jira)" <ji...@apache.org>]

Mridul Pathak created OFBIZ-13654:
-------------------------------------

             Summary: Make MultiTrustManager reject untrusted certificates when its all-trusted properties are missing or empty
                 Key: OFBIZ-13654
                 URL: https://issues.apache.org/jira/browse/OFBIZ-13654
             Project: OFBiz
          Issue Type: Bug
          Components: framework/base
    Affects Versions: 24.09.07, Upcoming Branch
            Reporter: Mridul Pathak
            Assignee: Mridul Pathak


MultiTrustManager validates certificates against the configured trust anchors, but when the validation fails it ignores the failure if the property server.all-trusted (outgoing connections) or client.all-trusted (client certificates) of certificate.properties is "true". The code reads both properties with the default "true", so a certificate.properties without these entries, or with an empty value, silently disables the certificate validation. The shipped file sets both to false, so a default installation is not affected.

h3. Proposed change

Read both properties with the default "false", so that a missing or empty value keeps the validation on and only an explicit "true" disables it.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)