Try to compare certs before replacement.

jruby · Nov 2, 2017 · 80f4b85 · 80f4b85
1 parent affc285
commit 80f4b85
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/src/main/java/org/jruby/ext/openssl/x509store/StoreContext.java b/src/main/java/org/jruby/ext/openssl/x509store/StoreContext.java
@@ -674,10 +674,14 @@ public int verifyCertificate() throws Exception {
                 int ok = getBySubject(X509Utils.X509_LU_X509, new Name(principal), objTmp);
                 if (ok == X509Utils.X509_LU_X509) {
                     // replace old with new and clear rest of untrusted
-                    iter.set(((Certificate) objTmp[0]).x509);
-                    while (iter.hasNext()) {
-                        iter.next();
-                        iter.remove();
+                    Certificate certificate = (Certificate) objTmp[0];
+                    if (certificate.x509.equals(skCert)) {
+                        iter.set(certificate.x509);
+                        while (iter.hasNext()) {
+                            iter.next();
+                            iter.remove();
+                        }
+                        break;
                     }
                 }
             }