There must be a bug in SSL support

[Jack <ja...@hotmail.com>]

my ssl is ok, then I just add a new key to .keystore,

then my ssl doesn't work.
the client get the new key from the tomcat server.

after I delete the new key,
everything starts to work again.





---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Thank you for reply.

[Jack <ja...@hotmail.com>]

Paul Singleton wrote:
>Unless you specify the key with <Connector ... keyAlias="xyz" ... /> (works 
>with 5.5.9 and later, dunno about older versions)
>then it seems to pick an arbitrary one (the newest?)

Thank you for your effort to reply me.
I didn't specify the keyAlias. I was using 5.5.12.
I didn't spend time on that. I just delete the newest key.
then everything is fine.

I check its sha1 & md5 digest, and I am 100% sure it just picked the newest 
key. I don't know the reason. I don't want to put time on it.
I just want to let other people know it.

jackzhp@hotmail.com




---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

The bug seems come from here

[Jack <ja...@hotmail.com>]

In the getKeyManagers of org.apache.tomcat.util.net.jsse.JSSE14SocketFactory
we can see the following code:

        kms = kmf.getKeyManagers();
        jacklog("return "+kms.length+" KeyManagers.");
        if (keyAlias != null) {
            if (JSSESocketFactory.defaultKeystoreType.equals(keystoreType)) 
{
                keyAlias = keyAlias.toLowerCase();
            }
            for(int i=0; i<kms.length; i++) {
                kms[i] = new JSSEKeyManager((X509KeyManager)kms[i], 
keyAlias);
            }
        }

        return kms;

When the keyAlias==null, we don't use our own JSSEKeyManager at all.




---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org