Proposed keystore fix (TC4 bug #1400)

[Christopher Cain <cc...@mhsoftware.com>]

Attached is a diff of SSLServerSocketFactory which demonstrates my proposed fix 
for bug #1400 (Tomcat SSL does not handle keystores with multiple entries). 
While this entry was classified as an "enhancement" during last week's roundup, 
I would argue that it is an actual bug (albeit a non-critical one).

The problem is this: Given a keystore with multiple entries, Sun's SSL 
implementation classes do not provide a way to affect which certificate is 
selected for use on the socket. In other words, it just grabs the first cert it 
finds inside the keystore. The attached fix extracts the "tomcat" entry 
from the keystore file, sticks it in a second keystore by itself, then uses 
this second, "tomcat-only" keystore to init the secure socket. (Yes, I know, 
it's kind of a roundabout hack, but it's a relatively clean one :-)

Note that while this is a diff, it is NOT meant to be a patch. This code will 
not yet compile, because it requires my exception cleanup patches from last 
month (which have not yet been applied). All I'm looking for at this point is 
any objections to my basic approach. If I get no objections over the next few 
days, while I test this code locally, I will commit it once it is tested and 
working, then close out the associated bugzilla entry.

- Christopher

/**
 * Pleurez, pleurez, mes yeux, et fondez vous en eau!
 * La moitié de ma vie a mis l'autre au tombeau.
 *    ---Corneille
 */