[zheng1771]

Description

Validate client certificate signatures with the configured Root CA when
strict authentication is enabled.

Run this check before the existing revocation, validity and ownership
checks. Reject the certificate if signature verification fails or the
Root CA certificate is missing. Rejected certificates are not added to
the active certificate map.

Keep the current non-strict authentication and expired certificate
settings. Add six tests using real certificates.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Strict authentication must verify certificates against the configured CA.

Screenshots (if appropriate):

Not applicable.

How Has This Been Tested?

Tested with OpenJDK 17 and Maven 3.8.7.

All 28 tests in RootCACustomTrustManagerTest and RootCAProviderTest passed.
Required modules compiled and Checkstyle passed.

Full project build and live TLS handshake testing were not run.

How did you try to break this feature and the system with this change?

Added tests for:

• A valid client certificate signed by the configured Root CA.
• A self-signed client certificate in strict mode.
• A client certificate signed by a different CA with the same subject.
• An untrusted client certificate with the trusted root added to its chain.
• A missing Root CA certificate.
• A self-signed client certificate in non-strict mode.

Four rejection tests failed before the change and passed after it.
Rejected certificates leave the active certificate map empty.
Existing expiry, revocation and ownership tests also passed.