BCJSSE: Only select X.509v3 credentials
{
private static final Logger LOG = Logger.getLogger(ProvX509KeyManager.class.getName());
+ private static final int X509V3_VERSION = 3;
+
private final JcaJceHelper helper;
private final List<KeyStore.Builder> builders;
@@ -356,6 +358,7 @@ private boolean isSuitableChain(X509Certificate[] chain, List<String> keyTypes,
BCAlgorithmConstraints algorithmConstraints, boolean forServer)
{
if (null == chain || chain.length < 1
+ || !isSuitableChainForTLS(chain)
|| !isSuitableChainForIssuers(chain, uniqueIssuers)
|| !isSuitableEECert(chain[0], keyTypes, algorithmConstraints, forServer))
{
@@ -570,6 +573,18 @@ private static boolean isSuitableChainForIssuers(X509Certificate[] chain, Set<Pr
&& uniqueIssuers.contains(eeCert.getSubjectX500Principal());
}
+ private static boolean isSuitableChainForTLS(X509Certificate[] chain)
+ {
+ for (int i = 0, count = chain.length; i < count; ++i)
+ {
+ if (X509V3_VERSION != chain[i].getVersion())
+ {
+ return false;
+ }
+ }
+ return true;
+ }
+
private static boolean isSuitableEECert(X509Certificate eeCert, List<String> keyTypes,
BCAlgorithmConstraints algorithmConstraints, boolean forServer)
{
