This is an attempt to address the issues described in #113 .

@kares I'm not sure if this is the right approach, and I don't fully understand how .eltOk works, but I was discussing the bug with @enebo in IRC and he suggested that I might need to call that method in order to avoid the implicit call to .toJava.

With this change, I can run the entire MRI test_x509store.rb suite locally and all tests pass.

I think that, if this change is accepted, it would also be a good idea to fix the CI for jruby-openssl and the master/9k branches of jruby to make sure that they are running the MRI openssl tests - I assume that they are expected to pass, since they are still run as part of the CI for JRuby 1.7.x.

If this doesn't seem like the best approach, and if someone who is more familiar than I am with this code isn't going to have time to look into this soon, I might be able to find a little more time to work on it next week if someone can give me some hints on a better implementation approach. Given that the X509Cert.toJava method may be implicitly called during seemingly benign operations like list iteration, it seems like it might be better to avoid having it return a BC object type by default, but I don't have a very good grasp of what other considerations led to that implementation of .toJava to begin with so I was afraid of breaking something else if I tried to make changes there.

This is excellent Chris, thank you! I mostly introduced the toJava for easier debugging (e.g. while testing).
Your PR is just fine -> where in a Ruby method unlikely to get any other Java collection type thus casting to a RubyArray and making sure we extract the raw ruby values seems like the very best approach here.

I haven't looked at the MRI test that identified this bug (somehow assumed its not that crucial since 9K passed fine) - would you consider copy-ing the test to our end to make sure we have a regression test?

The test that failed is, I believe, directly copied from the MRI test suite, and it already exists in both the jruby-openssl source and the jruby source (both 1.7 and master branches):

https://github.com/jruby/jruby-openssl/blob/master/src/test/ossl/1.9/test_x509store.rb#L36
https://github.com/jruby/jruby/blob/jruby-1_7/test/externals/ruby1.9/openssl/test_x509store.rb
https://github.com/jruby/jruby/blob/master/test/mri/openssl/test_x509store.rb

But for whatever reason, this test is being run in CI for JRuby 1.7, and is not being run in CI for jruby-openssl or JRuby 9k. I've run it in 9k and it fails.

You can run it in the jruby-openssl source tree via the following command, but I don't know how to add that to the CI configuration:

jruby -Ilib:. src/test/ossl/1.9/test_x509store.rb

unfortunately the src/test/ossl is not run - never finished the setup (needs working excludes) and we do rely on running the full JRuby suite before the final release push.

anyways, I can handle things from here just fine. thanks for the effort!

on master as b5bec3e