Cert parsing issue

[Cantor, Scott]

The X509Support class uses this method from cryptacular instead of the old 
BC manual ASN.1 parsing:

final Attributes attrs = NameReader.readX500Principal(dn);


I used the same code for client cert subject extraction.

It turns out that code crashes with an IllegalArgumentException if the DN 
contains something "unknown". I have a client cert from StartCom that 
triggers the breakage because there's a weird OID in the DN (I signed this 
email with it).

I don't know how much that matters for server certs, it seems more likely 
to break on client certs I guess, but really you never know what you're 
getting. I don't really understand why it's breaking, but that's typical 
cert nonsense.

We use that support method a fair amount in the trust code, so this may be 
a problem...

>From my tracing, it's throwing the exception in Bouncy Castle's code that 
cryptacular is calling, rather than cryptacular itself.

-- Scott
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5805 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20141118/201f6c2c/attachment-0001.bin