Skip to content

Commit 9a2b06a

Browse files
authored
Do not warn for certificates missing both SAN and CN (#6477)
Motivation: Both CN and SAN would be absent if a certicate is public root CA. Warning for CA is false positive and noisy. In addition, since this is related to metrics, strict validation isn’t necessary. If there’s an issue with the certificate, it will fail at the TLS handshake level and the user will notice it. Discord discussion: https://discord.com/channels/1087271586832318494/1390342361770365020/1433043355566211254 Modifications: - Change the log level in `CertificateUtil` to debug from warn. Result: You no longer see false positive warnings for certificate metrics.
1 parent 33d2d8f commit 9a2b06a

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

core/src/main/java/com/linecorp/armeria/internal/common/util/CertificateUtil.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,8 @@ public final class CertificateUtil {
7171
return commonName;
7272
}
7373

74-
logger.warn("No common name or subject alternative name found " +
74+
// Public root CA certificates may not have both CN and SAN.
75+
logger.debug("No common name or subject alternative name found " +
7576
"in certificate: {}", cert);
7677
return null;
7778
} catch (Exception e) {

0 commit comments

Comments
 (0)