[HTTPCORE-748] Alias selection for EdDSA client certificates broken

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 4.4.15
• Component/s: HttpCore
• Labels: clientcertificate
• Assignee: Unassigned
• Reporter: Philippe Marschall
• Created: 22/May/23 15:23
• Updated: 22/May/23 15:50

Description

Automatic alias selection for EdDSA client certificates broken since only EDDSA are checked.

RFC-8422 Section 3 specifies that the certificate type ECDSA_sign in the certificate request is to be used for both ECDSA and EdDSA certificates but org.apache.http.ssl.SSLContextBuilder.KeyManagerDelegate#getClientAliasMap(String[], Principal[]) only checks with the key type "ECDSA" and therefore does not find EdDSA certificates.

How to reproduce:

• Create a client keystore with only an EcDSA certificate and try to connect to a server that requires a client certificate.