search

UKHomeOffice / vaultjks

Create JAVA keystore and truststore using certs from vault
MIT License
19 stars 5 forks source link

Fix order of certs in bundle #7

Closed devth closed 7 years ago

devth commented 7 years ago

RFC 5246 says:

certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case.

That means this line is concatenating them in reverse. Apparently it doesn't matter when using the bundle to gen a keystore, but it does matter if you try to use bundle.pem directly.

Found via StackOverflow after observing that bundle.pem does not work when trying to use it directly along with key.pem.

vaijab commented 7 years ago

@devth please let me know if #8 fixes the issue.