Try to compare certs before replacement.

headius · headius · commit 80f4b8507480 · 2017-11-02T14:30:06.000-05:00
diff --git a/src/main/java/org/jruby/ext/openssl/x509store/StoreContext.java b/src/main/java/org/jruby/ext/openssl/x509store/StoreContext.java
@@ -674,10 +674,14 @@ public int verifyCertificate() throws Exception {
                 int ok = getBySubject(X509Utils.X509_LU_X509, new Name(principal), objTmp);
                 if (ok == X509Utils.X509_LU_X509) {
                     // replace old with new and clear rest of untrusted
-                    iter.set(((Certificate) objTmp[0]).x509);
-                    while (iter.hasNext()) {
-                        iter.next();
-                        iter.remove();
+                    Certificate certificate = (Certificate) objTmp[0];
+                    if (certificate.x509.equals(skCert)) {
+                        iter.set(certificate.x509);
+                        while (iter.hasNext()) {
+                            iter.next();
+                            iter.remove();
+                        }
+                        break;
                     }
                 }
             }

Original file line number	Diff line number	Diff line change
`@@ -674,10 +674,14 @@ public int verifyCertificate() throws Exception {`
`674`	`674`	`int ok = getBySubject(X509Utils.X509_LU_X509, new Name(principal), objTmp);`
`675`	`675`	`if (ok == X509Utils.X509_LU_X509) {`
`676`	`676`	`// replace old with new and clear rest of untrusted`
`677`		`- iter.set(((Certificate) objTmp[0]).x509);`
`678`		`- while (iter.hasNext()) {`
`679`		`- iter.next();`
`680`		`- iter.remove();`
	`677`	`+ Certificate certificate = (Certificate) objTmp[0];`
	`678`	`+ if (certificate.x509.equals(skCert)) {`
	`679`	`+ iter.set(certificate.x509);`
	`680`	`+ while (iter.hasNext()) {`
	`681`	`+ iter.next();`
	`682`	`+ iter.remove();`
	`683`	`+ }`
	`684`	`+ break;`
`681`	`685`	`}`
`682`	`686`	`}`
`683`	`687`	`}`