More fixes to LDAP cert discovery.

Using new filters as a fallback method for looking up LDAP certs.
Also updating expired test certificates.

Author: gm2552

src/main/java/org/nhindirect/stagent/cert/impl/LdapPublicCertUtilImpl.java

@@ -71,7 +71,7 @@ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  */
 public class LdapPublicCertUtilImpl implements LdapCertUtil{
 
-	private static final Log LOGGER = LogFactory.getFactory().getInstance(LdapPublicCertUtilImpl.class);
+	private static final Log LOGGER = LogFactory.getLog(LdapPublicCertUtilImpl.class);
 
 	private static final String DEFAULT_LDAP_TIMEOUT = "5000";
 	private static final String DEFAULT_LDAP_CONNECT_TIMEOUT = "10000";
@@ -134,9 +134,29 @@ public Collection<X509Certificate> ldapSearch(String subjectName){
 
 						NamingEnumeration<SearchResult> searchResult = ctx.search(
 								dn, 
-								"(&(" + EMAIL_ATTRIBUTE + "=" + subjectName  +")(|(userCertificate;binary=*)(userCertificate=*)))",
+								EMAIL_ATTRIBUTE + "=" + subjectName,
 								getDefaultSearchControls());
 
+						/*
+						 * Try again with slightly different filters.  This is what is used by the NIST tooling.  Some servers may not like this
+						 * syntax.
+						 */
+
+						if (!(searchResult != null && searchResult.hasMore()))
+						{
+							try
+							{
+								searchResult = ctx.search(
+									dn, 
+									"(&(" + EMAIL_ATTRIBUTE + "=" + subjectName  +")(|(userCertificate;binary=*)(userCertificate=*)))",
+									getDefaultSearchControls());
+							}
+							catch (Exception e)
+							{
+								LOGGER.warn("Exception when looking up LDAP certificates using alternative search filter: " + e.getMessage());
+							}
+						}
+						
 						while (searchResult != null && searchResult.hasMore()) {
 							final SearchResult certEntry = searchResult.nextElement();
 							if (certEntry != null) {