From 1414f8993a616a8dc2d5430e3a646e3075b87b57 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Thu, 03 Sep 2026 08:07:08 +0000
Subject: [PATCH] [#905] Warn when a replication handshake fails and document CA-signed certificates (#906)
---
opendj-server-legacy/src/main/java/org/opends/server/util/SelectableCertificateKeyManager.java | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/SelectableCertificateKeyManager.java b/opendj-server-legacy/src/main/java/org/opends/server/util/SelectableCertificateKeyManager.java
index 57b2f5f..e6f1e78 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/SelectableCertificateKeyManager.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/SelectableCertificateKeyManager.java
@@ -13,6 +13,7 @@
*
* Copyright 2008-2010 Sun Microsystems, Inc.
* Portions Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.util;
@@ -105,6 +106,11 @@
return clientAlias;
}
}
+ // Every key type requested by the peer has been tried, so no client certificate is
+ // sent at all. The peer may well accept the connection, as client authentication is
+ // optional for most of them, so keep this at debug level. The components which build
+ // their SSL context from a configured nickname, the crypto manager and the connection
+ // handlers, report a nickname missing from their key store when they build it.
logger.debug(INFO_MISSING_KEY_TYPE_IN_ALIASES, componentName, aliases.toString(), Arrays.toString(keyType));
return null;
}
@@ -181,6 +187,9 @@
return serverAlias;
}
}
+ // The peer is asked for one key type at a time, so returning no alias here is part
+ // of a normal negotiation, for instance an EC key type against an RSA only key
+ // store. Keep this at debug level to avoid warning about healthy handshakes.
logger.debug(INFO_MISSING_KEY_TYPE_IN_ALIASES, componentName, aliases.toString(), Arrays.toString(keyType));
return null;
}
--
Gitblit v1.10.0