From cae292bd84d7397e7ebc97ca7bd471154b7f18b9 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 29 Jul 2026 14:31:11 +0000
Subject: [PATCH] Fix java/equals-on-unrelated-types CodeQL alerts (#781)

---
 opendj-server-legacy/src/main/java/org/opends/server/util/cli/LDAPConnectionConsoleInteraction.java |   26 ++++++++++++++++++++------
 1 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/util/cli/LDAPConnectionConsoleInteraction.java b/opendj-server-legacy/src/main/java/org/opends/server/util/cli/LDAPConnectionConsoleInteraction.java
index 8282adf..35cd4ae 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/util/cli/LDAPConnectionConsoleInteraction.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/util/cli/LDAPConnectionConsoleInteraction.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2008-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.util.cli;
 
@@ -1603,12 +1604,10 @@
     {
       logger.warn(ERROR_CERTIFICATE_NULL_AUTH_TYPE.get());
     }
-    else
-    {
-      app.println(ApplicationTrustManager.Cause.NOT_TRUSTED.equals(authType)
-          ? INFO_CERTIFICATE_NOT_TRUSTED_TEXT_CLI.get(host, port)
-          : INFO_CERTIFICATE_NAME_MISMATCH_TEXT_CLI.get(host, port, host, host, port));
-    }
+    // The explanation only depends on the cause of the rejection, so it must be displayed even
+    // when the authentication type is unknown: otherwise the user is prompted to accept a
+    // certificate without being told what is wrong with it.
+    app.println(getCertificateRejectionMessage(cause, host, port));
 
     final X509Certificate[] chain = usedTrustManager.getLastRefusedChain();
     if (chain == null)
@@ -1625,6 +1624,21 @@
   }
 
   /**
+   * Returns the message explaining why the certificate presented by the server was rejected.
+   *
+   * @param cause the reason why the certificate was rejected.
+   * @param host the host name of the server.
+   * @param port the port of the server.
+   * @return the message explaining why the certificate was rejected.
+   */
+  static LocalizableMessage getCertificateRejectionMessage(ApplicationTrustManager.Cause cause, String host, int port)
+  {
+    return cause == ApplicationTrustManager.Cause.NOT_TRUSTED
+        ? INFO_CERTIFICATE_NOT_TRUSTED_TEXT_CLI.get(host, port)
+        : INFO_CERTIFICATE_NAME_MISMATCH_TEXT_CLI.get(host, port, host, host, port);
+  }
+
+  /**
    * Sets the heading that is displayed in interactive mode.
    *
    * @param heading

--
Gitblit v1.10.0