KNOX-3359 - Support Single-Purpose EKU Certificates#1291

Merged

moresandeep merged 16 commits into

apache:masterfrom

moresandeep:KNOX-3359

Jul 9, 2026

Commits on Jul 7, 2026

Commits on Jul 8, 2026

KNOX-3359: Decouple outbound two-way SSL default from single-EKU
moresandeep
committed
KNOX-3359: Re-scope single-EKU validation to validate only what mTLS uses
moresandeep
committed
KNOX-3359: Add single-EKU-without-mTLS integration scenario
moresandeep
committed
KNOX-3359: Document single-EKU / mTLS independence and config scenarios
moresandeep
committed
KNOX-3359: Make X509CertificateUtil.generateCertificate EKU-aware
moresandeep
committed
KNOX-3359: EKU-aware self-signed generation + single-EKU httpclient keystore fallback
moresandeep
committed
KNOX-3359: Self-bootstrap single-EKU identities at startup with logging
moresandeep
committed
KNOX-3359: Simplify single-EKU no-mTLS integration scenario to self-bootstrap
moresandeep
committed