TLS trust store does not iterate over multiple CA certificates with the same subject DN

[Sunanda533]

Creating a new issue for this github issue #362, as we are unable to re-open that and the issue is not resolved yet with jruby-openssl 0.16.1 version.

@kares Please find the below analysis and thanks for looking into this.

We attempted to verify the fix on jruby-openssl 0.19.0 in our environment, but ran into internal/unrelated errors when connecting
to our test syslog server (GnuTLS-side unexpected TLS handshake packet / illegal or unsupported version errors during the handshake), which blocked a clean
verification on 0.19.0 in that setup.
But as mentioned in previous comments, the fix was included from 0.11.1.
And we were, however, able to reproduce the original issue on jruby-openssl 0.16.1 using the following steps:
Setup:

1. Generated two CA chains (root + intermediate) sharing the same subject DN, simulating a CA rotation:
   • Old chain: root CA + intermediate CA, subject CN=.gic..se
   • New chain: root CA + intermediate CA, same subject CN=.gic..se, different keys/serials, all with proper subjectKeyIdentifier /
     authorityKeyIdentifier extensions
2. Issued a syslog server leaf certificate signed by the new intermediate CA
3. Built a combined trust bundle with the old CA chain listed first, followed by the new CA chain (the realistic rotation scenario — old+new coexisting, old
   appearing first)
4. Deployed:
   • Syslog server (rsyslog + GnuTLS) presenting the new leaf cert
   • Logstash (with jruby-openssl 0.16.1) configured with:
     • ssl_verify => true
     • ssl_certificate_authorities => [""]
5. Sent log events through Logstash's syslog output toward the server

Result on 0.16.1:
TLS handshake fails with:
[logstash.outputs.syslog] SSL Error {exception: #<OpenSSL::SSL::SSLError: certificate verify failed>, ...
'org/jruby/ext/openssl/SSLSocket.java:280:in connect'
'.../logstash-output-syslog-3.1.0/lib/logstash/outputs/syslog.rb:263:in connect'

Thanks & regards,
Sunanda N.