why does Quarkus return a deprecated X509Certificate?

[serrodcal]

Description
I'm not sure where to put this question. I hope I am in the right place.

The question is, why does Quarkus return a deprecated X509Certificate?

When I want to get the certificate from the request, I get a javax.security.cert.X509Certificate instead of java.security.cert.X509Certificate.

Implementation ideas
I was wondering if with Vert.x v4, this issue will be fixed or not. But, Quarkus/Vert.x should work with no deprecated objects. Mainly, trying to build in native with filters, a serialization is needed as given below:

CertificateFactory cf = CertificateFactory.getInstance("X.509");
ByteArrayInputStream bais = new ByteArrayInputStream(request.peerCertificateChain()[0].getEncoded());
X509Certificate clientCertificate =  (X509Certificate) cf.generateCertificate(bais);

This is needed because to be able to use libraries to validate a JWT token I need the java.security.cert.X509Certificate, but in native I got an error in runtime because the serialization doesn't work.

[gsmet]

In which context, does Quarkus return a deprecated X509Certificate? It's not clear from your report. Thanks!

[serrodcal]

For instance, making a filter using Reactive Routes:

import java.security.*;
public class Filters {

    @RouteFilter(100) 
    void filter1(RoutingContext rc) {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        ByteArrayInputStream bais = new ByteArrayInputStream(rc.request.peerCertificateChain()[0].getEncoded());
        X509Certificate clientCertificate =  (X509Certificate) cf.generateCertificate(bais);
       ...
    }

From request.peerCertificateChain()[0] I get an javax.security.cert.X509Certificate which is deprecated.

Do you need futher information? I'm using 1.8.1.Final of quarkus-vertx-web.

[sberyozkin]

@serrodcal it is off-topic, but do you do an access token binding to the client cert check ? We've been thinking to do it for a while for quarkus-oidc bearer tokens (#4482), may be also worth trying for smallrye-jwt...

[serrodcal]

Our problem is building to native, because the only way to convert to the non deprecated X509Certificate (which is needed to be able to use a library to validate the Access Token) is using the serialization. I don't know if there is other way to do that.

[gastaldi]

A small reproducer project would help also

[serrodcal]

I can't share the project because it belong to my company, but I'll try create a small reproducer project as you mentioned as soon as possible :).