Also accept FAILED SSL verify header (for self signed).

RIPE-NCC · Jun 22, 2020 · 5381762 · 5381762 · eshryane · Jun 22, 2020
1 parent 9ffb842
commit 5381762
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/whois-api/src/main/java/net/ripe/db/whois/api/rest/ClientCertificateExtractor.java b/whois-api/src/main/java/net/ripe/db/whois/api/rest/ClientCertificateExtractor.java
@@ -26,14 +26,22 @@ public static Optional<X509CertificateWrapper> getClientCertificate(final HttpSe
             return Optional.empty();
         }
 
-        final String sslClientVerify = request.getHeader(HEADER_SSL_CLIENT_VERIFY);
-        if (!"GENEROUS".equals(sslClientVerify) && !"SUCCESS".equals(sslClientVerify)) {
+        if (!hasAcceptableVerifyHeader(request)) {
             return Optional.empty();
         }
 
         return getX509Certificate(sslClientCert, dateTimeProvider);
     }
 
+    private static boolean hasAcceptableVerifyHeader(final HttpServletRequest request) {
+        final String sslClientVerify = request.getHeader(HEADER_SSL_CLIENT_VERIFY);
+
+        return StringUtils.isNotEmpty(sslClientVerify) &&
+                ("GENEROUS".equals(sslClientVerify) ||
+                "SUCCESS".equals(sslClientVerify) ||
+                sslClientVerify.startsWith("FAILED"));
+    }
+
     private static Optional<X509CertificateWrapper> getX509Certificate(final String certificate,
                                                                 final DateTimeProvider dateTimeProvider) {
         String fingerprint;