[cconlon]

This PR includes one Fenrir fix:

• F-15740: Check certificate extensions before certManagerVerify loads chain certificates as issuers, with tests.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #443

Scan targets checked: wolfssljni-src, wolfssljni-bugs
Coverage: 1 of 3 in-scope changed file(s) opened by the reviewer; not opened: src/test/com/wolfssl/provider/jsse/test/WolfSSLTestFactory.java, src/test/com/wolfssl/provider/jsse/test/WolfSSLTrustX509Test.java

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

Dismissing following the reasoning of @cconlon, see reply to Fenrir finding:

"This exception is intentional and keeps the existing trusted peer cert behavior from PR #154. With WOLFSSL_TRUST_PEER_CERT enabled, CertManagerLoadCAKeyStore already loads every KeyStore entry into the CertManager at init regardless of cA, so a non-CA store entry can sign leaves whether or not the peer resends it in the chain. The suggested sortedCerts[0] check would reject the chain only when the entry is resent and still accept the same leaf sent alone."