SslContextFactory may select a wildcard certificate during SNI selection when a more specific SSL certificate is present

[BruceMacD]

Jetty version
Observed in jetty-9.4.35.v20201120 but the code is the same in the jetty-9.4.x branch and the jetty-10.0.x branch so it should have the same behavior.

Java version
Oracle JDK 8u281.

OS type/version
Mac OS 10.14 (this should be OS agnostic)

Description
Scenario
Hosting an application in Jetty with two certificates:

• Certificate 1 with alias *.example.com
• Certificate 2 with alias sub.example.com

Expected behavior
A request to sub.example.com selects certificate 2 (sub.example.com).

Actual behavior
A request to sub.example.com may select certificate 1 (*.example.com).

Details
This happens because SslContextFactory.sniSelect() returns the first certificate that matches the SNI host. If the wildcard cert happens to be stored first in the collection it will be returned with this behavior. I notice that X509.matches() checks wilds as well as hosts for a match, if there was a specific host match check in the SslContext factory before doing the more general match check then this behavior would be fixed.

This may be expected behavior, but it would be pretty simple to correct so I thought it was worth mentioning.

[sbordet]

@BruceMacD as a workaround, you can always set your own SNISelector on SslContextFactory to implement a more precise logic.

I agree that we should try to match the precise domain first, then wildcard domains.

[sbordet]

@BruceMacD can you try #6036?

[BruceMacD]

@sbordet
That change works perfectly in my case. Thanks.