Hsnmohd commented on PR #933: URL: https://github.com/apache/httpcomponents-client/pull/933#issuecomment-6723534997
Agreed, the walk only proves signatures; it isn't path validation. It skips basicConstraints, validity and name constraints, takes the first candidate that matches, and nothing ties it to where the trust manager's path ended, so it can still be steered. A trusted interception CA can issue the leaf through an intermediate whose subject and key match a CA=false DV certificate it obtained for that same key from the pinned CA. Send the DV cert ahead of the intermediate and the walk goes through it to the pinned key, while JSSE validates the leaf through the intermediate to the interception root. Matching against the validated path needs the trust anchors, and an `SSLContext` doesn't expose its trust manager. What I'd do is add a builder overload that takes the `X509TrustManager`, rebuild the path with PKIX `CertPathBuilder` against its accepted issuers, and match pins only on that path and its anchor. If you'd rather not grow the API for this, I'll close the PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
