GUACAMOLE-839: Use BouncyCastle for retrieval of certificate details.

Java's build-in support for reading X.509 certificates does not deal
well with PIV certificates containing the username as a "serialNumber"
attribute. Rather than exposing the string value of that attribute, the
Java implementation exposes a byte array that does not fully match the
string value shown by a tool like OpenSSL.

BouncyCastle, on the other hand, _does_ match the output of OpenSSL, and
provides a predictable means of decoding the certificate.
This commit is contained in:
Michael Jumper committed 2023-03-07 16:36:37 -08:00
1 parent b9958fa331
commit d0574f8d82
5 files changed
+54 -18

No files matched your search

@@ -0,0 +1,8 @@
BouncyCastle PKIX APIs, FIPS Distribution (https://www.bouncycastle.org/fips-java)
-----------------------------------------------------------------------
Version: 1.0.7
From: 'The Legion of Bouncy Castle' (https://www.bouncycastle.org)
License(s):
MIT (bundled/bouncycastle-pkix-fips-1.0.7/LICENSE)