A Reproducible Java Certificate Bypass

TL;DR Sonatype’s tests found that Java’s blocked.certs rejected the listed certificate encodings but accepted re-encoded versions that still validated in the tested configurations. We reproduced […]