Skip to content

Add a certificateSelectByKeyUsage attribute for JSSE - #1089

Draft
dsoumis wants to merge 2 commits into
apache:mainfrom
dsoumis:cert-select-by-key-usage
Draft

dsoumis wants to merge 2 commits into
apache:mainfrom
dsoumis:cert-select-by-key-usage

Conversation

@dsoumis

@dsoumis dsoumis commented Oct 16, 2026

Copy link
Copy Markdown
Member

No description provided.

@fabian-hahn

Copy link
Copy Markdown

Shouldn't certificateSelectByKeyUsage="true" be the default behavior?

@ChristopherSchultz

Copy link
Copy Markdown
Contributor

Shouldn't certificateSelectByKeyUsage="true" be the default behavior?

No: we do not want to change the default behavior at the moment. We may change the default behavior in Tomcat 12 but we do not want to change it in older versions.

@ChristopherSchultz

Copy link
Copy Markdown
Contributor

@dsoumis I think maybe this would be better if it were:

  1. Always ignoring incompatible key usages
  2. Only failing after all certificates matching aliases (from a PEM file, where alias == DN) fail

@dsoumis
dsoumis marked this pull request as draft October 17, 2026 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants