[JM-1394] More improvements from Corey Wright.

git-svn-id: http://svn.igniterealtime.org/svn/repos/openfire/trunk@10546 b35dd754-fafc-0310-a699-88a17e54d16e

src/java/org/jivesoftware/openfire/net/SASLAuthentication.java

@@ -460,7 +460,12 @@ public class SASLAuthentication {
             
             for (Certificate certificate : connection.getPeerCertificates()) {
                 for (String identity : CertificateManager.getPeerIdentities((X509Certificate) certificate)) {
-                    if (identity.equals(hostname) || identity.equals("*." + hostname)) {
+                    // Verify that either the identity is the same as the hostname, or for wildcarded
+                    // identities that the hostname ends with .domainspecified or -is- domainspecified.
+                    if ((identity.startsWith("*.")
+                         && (hostname.endsWith(identity.replace("*.", "."))
+                             || hostname.equals(identity.replace("*.", ""))))
+                            || hostname.equals(identity)) {
                         authenticationSuccessful(session, hostname, null);
                         return Status.authenticated;
                     }

src/java/org/jivesoftware/openfire/net/ServerTrustManager.java

@@ -140,23 +140,15 @@ public class ServerTrustManager implements X509TrustManager {
             // a wildcard.
             Boolean found = false;
             for (String identity : peerIdentities) {
-                if (identity.startsWith("*.")) {
-                    // strip off asterisks, but keep leading dot
-                    // to insure endsWith() only matches a subdomain
-                    // of the intended domain
-                    identity = identity.replace("*.", ".");
-                    if (server.endsWith(identity)) {
-                        found = true;
-                        break;
-                    }
-                }
-                else {
-                    if (server.equals(identity)) {
-                        found = true;
-                        break;
-                    }
+                // Verify that either the identity is the same as the hostname, or for wildcarded
+                // identities that the hostname ends with .domainspecified or -is- domainspecified.
+                if ((identity.startsWith("*.")
+                        && (server.endsWith(identity.replace("*.", "."))
+                        || server.equals(identity.replace("*.", ""))))
+                        || server.equals(identity)) {
+                    found = true;
+                    break;
                 }
-
             }
 
             if (!found) {