[java-shib-shared] branch main updated: JSSH-50 Stop including CA:true in generated certificates

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=fd94f2f5f8946b300ae906cff6981db20b47c0ed

The following commit(s) were added to refs/heads/main by this push:
     new fd94f2f5 JSSH-50 Stop including CA:true in generated certificates
fd94f2f5 is described below

commit fd94f2f5f8946b300ae906cff6981db20b47c0ed
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Mar 17 14:39:34 2025 +0000

    JSSH-50 Stop including CA:true in generated certificates
    
    https://shibboleth.atlassian.net/browse/JSSH-50
    
    We weren't doing aythingto explicitly include CA:true, but now we explicitly say
    CA:FALSE
---
 .../shared/security/impl/SelfSignedCertificateGenerator.java         | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
index c6fb1651..58bdd350 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
@@ -37,6 +37,7 @@ import javax.annotation.Nullable;
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.DERSequence;
 import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.BasicConstraints;
 import org.bouncycastle.asn1.x509.Extension;
 import org.bouncycastle.asn1.x509.GeneralName;
 import org.bouncycastle.asn1.x509.GeneralNames;
@@ -317,6 +318,8 @@ public class SelfSignedCertificateGenerator {
         builder.addExtension(Extension.subjectAlternativeName, false,
                 GeneralNames.getInstance(new DERSequence(buildSubjectAltNames())));
 
+        builder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));
+
         final X509CertificateHolder certHldr = builder.build(
                 new JcaContentSignerBuilder(args.certAlg).build(keypair.getPrivate()));
         final X509Certificate cert = new JcaX509CertificateConverter().getCertificate(certHldr);
@@ -489,4 +492,4 @@ public class SelfSignedCertificateGenerator {
         @Nullable private String keystorePassword;
     }
     
-}
\ No newline at end of file
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.