Fix double-layered DER decoding when reading X.509 certificate extension OIDs

[george-mcintyre]

Problem

X509Certificate.getExtensionValue(oid) returns a DER-encoded OCTET STRING whose payload is itself another DER-encoded value (the actual extension content). The previous code only unwrapped one DER layer, so the certificate status PV name stored under OID 1.3.6.1.4.1.37427.1 was never correctly extracted.

Fix

Unwrap both DER layers: first strip the outer OCTET STRING tag/length, then strip the inner OCTET STRING tag/length to reach the raw UTF-8 string payload. This is required to correctly read any X.509v3 extension value via getExtensionValue().

This fix is only relevant when the client needs to locate the cert-status PV name from the peer's certificate; it has no effect on connections that do not use certificate status gating.

Files Changed

• core/pva/src/main/java/org/epics/pva/common/SecureSockets.java

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE