[ https://issues.redhat.com/browse/WFCORE-5226?page=com.atlassian.jira.plug... ] Farah Juma edited comment on WFCORE-5226 at 12/11/20 11:56 AM: --------------------------------------------------------------- [~szaldana] I think the underlying issue here is in {{X509RevocationTrustManager}}: * Notice that the {{trustStore}} that is specified using the {{X509RevocationTrustManager.Builder}} is successfully used to instantiate the {{trustManager}} in the {{X509RevocationTrustManager}} [constructor|https://github.com/wildfly-security/wildfly-elytron/blob/1.x/...]. * A call to {{trustManager.getAcceptedIssuers()}} would return the correct accepted issuers. * However, the {{X509RevocationTrustManager#getAcceptedIssuers}} method actually returns the value of {{builder.acceptedIssuers}}. This means that if no accepted issuers have been explicitly configured using the {{builder}}, {{X509RevocationTrustManager#getAcceptedIssuers}} returns {{X500.NO_CERTIFICATES}}. * If no accepted issuers have been explicitly configured, I think we should delegate to the {{trustManager#getAcceptedIssuers}} method instead of using {{X500.NO_CERTIFICATES}}. * We should also deprecate the {{X509RevocationTrustManager.Builder#setAcceptedIssuers}} method. It's not clear why it was added in the first place. There's no need for this method since we should always be delegating to {{trustManager#getAcceptedIssuers}}. was (Author: fjuma): [~szaldana] I think the underlying issue here is in {{X509RevocationTrustManager}}: * Notice that the {{trustStore}} that is specified using the {{X509RevocationTrustManager.Builder}} is successfully used to instantiate the {{trustManager}} in the {{X509RevocationTrustManager}} [constructor|https://github.com/wildfly-security/wildfly-elytron/blob/1.x/...]. * A call to {{trustManager.getAcceptedIssuers()}} would return the correct accepted issuers. * However, the {{X509RevocationTrustManager#getAcceptedIssuers}} method actually returns the value of {{builder.acceptedIssuers}}. This means that if no accepted issuers have been explicitly configured using the {{builder}}, {{X509RevocationTrustManager#getAcceptedIssuers}} returns {{X500.NO_CERTIFICATES}}. * If no accepted issuers have been explicitly configured, I think we should delegate to the {{trustManager#getAcceptedIssuers}} method instead of using {{X500.NO_CERTIFICATES}}. -- This message was sent by Atlassian Jira (v7.13.8#713008)