Changeset 19650 in josm

Timestamp:

2026-10-21T16:58:33+02:00 (27 hours ago)

Author:

gaben

Message:

fix #24962 - use a TLSv1.3 context when installing amended root certificates

Location:

trunk

Files:

• src/org/openstreetmap/josm/io/CertificateAmendment.java (modified) (1 diff)
• test/unit/org/openstreetmap/josm/io/CertificateAmendmentTest.java (modified) (2 diffs)

trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java

@@ -235 +235 @@
             TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
             tmf.init(keyStore);
-            SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
+            SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
             sslContext.init(null, tmf.getTrustManagers(), null);
             SSLContext.setDefault(sslContext);

trunk/test/unit/org/openstreetmap/josm/io/CertificateAmendmentTest.java

@@ -6 +6 @@
 import net.trajano.commons.testing.UtilityClassTestUtil;
 import org.junit.jupiter.api.Test;
+
+import javax.net.ssl.SSLContext;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.util.Arrays;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
@@ -20 +28 @@
         UtilityClassTestUtil.assertUtilityClassWellDefined(CertificateAmendment.class);
     }
+
+    /**
+     * Non-regression test for <a href="https://josm.openstreetmap.de/ticket/24962">Bug #24962</a>.
+     * Adding missing certificates must not restrict HTTPS connections to TLS 1.2.
+     * @throws IOException if an I/O error occurs
+     * @throws GeneralSecurityException if a security error occurs
+     */
+    @Test
+    void testTicket24962() throws IOException, GeneralSecurityException {
+        CertificateAmendment.addMissingCertificates();
+        List<String> protocols = Arrays.asList(SSLContext.getDefault().getDefaultSSLParameters().getProtocols());
+        assertTrue(protocols.contains("TLSv1.3"), protocols::toString);
+    }
 }