detect algorithm on provided certificate when checking for ca cert
What the developer wrote
Authored by Craig Raw
detect algorithm on provided certificate when checking for ca cert
What changed, and why it matters
This commit fixes a certificate validation bug in Sparrow Wallet's TLS code. Previously, the app always told Java's certificate checker to expect an RSA-based certificate, even when the server presented an Elliptic Curve (EC) certificate. That mismatch could cause valid EC-secured servers to be rejected or, in some situations, weaken the validation path. The patch now detects the certificate's actual algorithm and passes the correct value ('ECDHE_ECDSA' for EC, 'RSA' otherwise).
Review whether any other custom TrustManager implementations in the codebase hardcode 'RSA' as authType. Consider adding tests covering both RSA and EC server certificates for the pinning path. Ensure the chosen authType strings match the trust manager's expected values across supported Java versions.
Security signals we found
Incorrect authType passed to checkServerTrusted
Certificate validation logic change
TLS transport hardening
Potential bypass/rejection of EC certificate chains
Evidence from the diff
In TcpOverTlsTransport.java, the custom certificate-pinning check called X509ExtendedTrustManager.checkServerTrusted(x509Certs, ‘RSA’) unconditionally. The second parameter (authType) should reflect the public-key algorithm of the end-entity certificate. For EC certificates the correct value is ‘ECDHE_ECDSA’ (or ‘ECDSA’); passing ‘RSA’ is incorrect and can lead to trust-manager rejection of otherwise valid chains. The change reads x509Certs[0].getPublicKey().getAlgorithm() and selects ‘ECDHE_ECDSA’ if it equals ‘EC’, otherwise ‘RSA’.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.javaTLS server certificate validation for custom pinned connectionsInspect captured patch +2 / −1
diff --git a/src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.java b/src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.java
index 791626d..01fef26 100644
--- a/src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.java
+++ b/src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.java
@@ -193,7 +193,8 @@ public class TcpOverTlsTransport extends TcpTransport {
x509Certs[i] = (X509Certificate)certs[i];
}
- defaultTm.checkServerTrusted(x509Certs, "RSA");
+ String authType = x509Certs[0].getPublicKey().getAlgorithm().equals("EC") ? "ECDHE_ECDSA" : "RSA";
+ defaultTm.checkServerTrusted(x509Certs, authType);
return true;
} catch(Exception e) {
return false;
Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.