JSSE: match endpoint identification algorithm names case-insensitively

[cconlon]

This PR matches the SSLParameters endpoint identification algorithm case-insensitively, as SunJSSE does. Apache HttpClient 5 sets it to "https", but wolfJSSE only accepted the exact strings "HTTPS" and "LDAPS", so the handshake failed with CertificateException: Unsupported Endpoint Identification Algorithm: https. Unknown names are still rejected.

Changes

• WolfSSLTrustX509 and WolfSSLInternalVerifyCb: compare with equalsIgnoreCase().
• New WolfSSLTrustX509Test tests, run over SSLSocket, SSLEngine, and a basic X509TrustManager:
  • lowercase and mixed-case names are accepted and still verify the hostname
  • "ldaps" applies LDAPS rules (ignores SNI, left-most wildcard only)
  • near-miss names such as "HTTP" and "https " still fail
• Renamed testX509ExtTrustMgrSSLEngineEndpointAlgFail to testX509ExtTrustMgrSSLEngineLDAPSIgnoresSNIFail and fixed its comments. It tests that LDAPS ignores SNI, not an unsupported algorithm.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #434

Scan targets checked: wolfssljni-src, wolfssljni-bugs
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: src/test/com/wolfssl/provider/jsse/test/WolfSSLTrustX509Test.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

Basic trust-manager LDAPS verification still considers SNI instead of exclusively verifying the peer host.

1 open finding

• Restrict SNI-based certificate validation to HTTPS · New

What changed in this PR

Adds case-insensitive endpoint identification algorithm matching for JSSE hostname verification.

Changes:

• Accepts case variants of HTTPS and LDAPS.
• Preserves rejection of unknown algorithms.
• Adds socket, engine, and trust-manager coverage.

File	Description
WolfSSLTrustX509.java	Uses case-insensitive algorithm matching.
WolfSSLInternalVerifyCb.java	Updates external trust-manager verification matching.
WolfSSLTrustX509Test.java	Adds endpoint identification tests and corrects LDAPS test naming.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.