Improve error message for failed EKU check
@@ -166,7 +166,8 @@ private static void checkEndEntity(JcaJceHelper helper, BCAlgorithmConstraints a
{
if (!supportsExtendedKeyUsage(eeCert, ekuOID))
{
- throw new CertPathValidatorException("Certificate doesn't support '" + ekuOID + "' ExtendedKeyUsage");
+ throw new CertPathValidatorException(
+ "Certificate doesn't support '" + getExtendedKeyUsageName(ekuOID) + "' ExtendedKeyUsage");
}
if (!supportsKeyUsage(eeCert, kuBit))
@@ -207,6 +208,19 @@ private static void checkIssuedBy(JcaJceHelper helper, BCAlgorithmConstraints al
}
}
+ private static String getExtendedKeyUsageName(KeyPurposeId ekuOID)
+ {
+ if (KeyPurposeId.id_kp_clientAuth.equals(ekuOID))
+ {
+ return "clientAuth";
+ }
+ if (KeyPurposeId.id_kp_serverAuth.equals(ekuOID))
+ {
+ return "serverAuth";
+ }
+ return "(" + ekuOID + ")";
+ }
+
private static String getKeyUsageName(int kuBit)
{
switch (kuBit)
