Repository: netty/netty
File: handler/src/main/java/io/netty/handler/ssl/EnhancingX509ExtendedTrustManager.java (Java)

Code before:
                    }
                    if (hasNames) {
                        // Strip of the last separator
                        sb.setLength(sb.length() - SEPARATOR.length());
                    }
                }
                sb.append("], CN=").append(getCommonName(cert)).append('.');
            }
            throw new CertificateException(sb.toString(), e);
        }
        throw e;
    }

    private static String getCommonName(X509Certificate cert) {
        try {
            // 1. Get the X500Principal (better than getSubjectDN which is implementation dependent and deprecated)
            X500Principal principal = cert.getSubjectX500Principal();
            // 2. Parse the DN using LdapName
            LdapName ldapName = new LdapName(principal.getName());
            // 3. Iterate over the Relative Distinguished Names (RDNs) to find CN
            for (Rdn rdn : ldapName.getRdns()) {
                if (rdn.getType().equalsIgnoreCase("CN")) {
                    return rdn.getValue().toString();
                }
            }
        } catch (Exception e) {
            // ignore
        }
        return "null";
    }
}


Review comment (suggestion):
nit:

```suggestion
        } catch (Exception ignore) {
```

Code after:
                X509Certificate cert = chain[i];
                Collection<List<?>> collection = cert.getSubjectAlternativeNames();
                sb.append(' ').append(i + 1).append(". subjectAlternativeNames=[");
                if (collection != null) {
                    boolean hasNames = false;
                    for (List<?> altNames : collection) {
                        if (altNames.size() < 2) {
                            // We expect at least a pair of 'nameType:value' in that list.
                            continue;
                        }
                        final int nameType = ((Integer) altNames.get(0)).intValue();
                        if (nameType == ALTNAME_DNS) {
                            sb.append("DNS");
                        } else if (nameType == ALTNAME_IP) {
                            sb.append("IP");
                        } else if (nameType == ALTNAME_URI) {
                            // URI names are common in some environments with gRPC services that use SPIFFEs.
                            // Though the hostname matcher won't be looking at them, having them there can help
                            // debugging cases where hostname verification was enabled when it shouldn't be.
                            sb.append("URI");
                        } else {
                            continue;
                        }
                        sb.append(':').append((String) altNames.get(1)).append(SEPARATOR);
                        hasNames = true;
                    }
                    if (hasNames) {
                        // Strip of the last separator
                        sb.setLength(sb.length() - SEPARATOR.length());
                    }
                }
                sb.append("], CN=").append(getCommonName(cert)).append('.');
            }
            throw new CertificateException(sb.toString(), e);
        }
        throw e;
    }

    private static String getSNIHostName(SSLSession session) {
        if (!(session instanceof ExtendedSSLSession)) {
            return null;
        }
        List<SNIServerName> names = ((ExtendedSSLSession) session).getRequestedServerNames();
        for (SNIServerName sni : names) {
            if (sni instanceof SNIHostName) {
                SNIHostName hostName = (SNIHostName) sni;
                return hostName.getAsciiName();
            }
        }
        return null;
    }