fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# This is the "master security properties file".

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# In this file, various security properties are set for use by

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# java.security classes. This is where users can statically register

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Cryptography Package Providers ("providers" for short). The term

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# "provider" refers to a package or set of packages that supply a

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# concrete implementation of a subset of the cryptography aspects of

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# the Java Security API. A provider may, for example, implement one or

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# more digital signature algorithms or message digest algorithms.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Each provider must implement a subclass of the Provider class.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# To register a provider in this master security properties file,

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# specify the Provider subclass name and priority in the format

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# security.provider.<n>=<className>

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# This declares a provider, and specifies its preference

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# order n. The preference order is the order in which providers are

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# searched for requested algorithms (when no specific provider is

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# requested). The order is 1-based; 1 is the most preferred, followed

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# by 2, and so on.

91cfa10a8e55050a5103c4b2e83b0bf8d783a7cbtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# <className> must specify the subclass of the Provider class whose

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# constructor sets the values of various properties that are required

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# for the Java Security API to look up the algorithms or other

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# facilities implemented by the provider.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# There must be at least one provider specification in java.security.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# There is a default provider that comes standard with the JDK. It

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# is called the "SUN" provider, and its Provider subclass

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# named Sun appears in the sun.security.provider package. Thus, the

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# "SUN" provider is registered via the following:

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# security.provider.1=sun.security.provider.Sun

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# (The number 1 is used for the default provider.)

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Note: Providers can be dynamically registered instead by calls to

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# either the addProvider or insertProviderAt method in the Security

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# class.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# List of providers and their preference orders (see above):

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.1=com.oracle.security.ucrypto.UcryptoProvider ${java.home}/lib/security/ucrypto-solaris.cfg

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.2=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/sunpkcs11-solaris.cfg

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.3=sun.security.provider.Sun

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.4=sun.security.rsa.SunRsaSign

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.5=sun.security.ec.SunEC

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.6=com.sun.net.ssl.internal.ssl.Provider

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.7=com.sun.crypto.provider.SunJCE

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.8=sun.security.jgss.SunProvider

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.9=com.sun.security.sasl.Provider

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.10=org.jcp.xml.dsig.internal.dom.XMLDSigRI

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.provider.11=sun.security.smartcardio.SunPCSC

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Select the source of seed data for SecureRandom. By default an

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# attempt is made to use the entropy gathering device specified by

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# the securerandom.source property. If an exception occurs when

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# accessing the URL then the traditional system/thread activity

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# algorithm is used.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# On Solaris and Linux systems, if file:/dev/urandom is specified and it

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# exists, a special SecureRandom implementation is activated by default.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# This "NativePRNG" reads random bytes directly from /dev/urandom.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# On Windows systems, the URLs file:/dev/random and file:/dev/urandom

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# enables use of the Microsoft CryptoAPI seed functionality.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurerandom.source=file:/dev/urandom

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# The entropy gathering device is described as a URL and can also

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# be specified with the system property "java.security.egd". For example,

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# -Djava.security.egd=file:/dev/urandom

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Specifying this system property will override the securerandom.source

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# setting.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Class to instantiate as the javax.security.auth.login.Configuration

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# provider.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeelogin.configuration.provider=com.sun.security.auth.login.ConfigFile

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Default login configuration file

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#login.config.url.1=file:${user.home}/.java.login.config

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Class to instantiate as the system Policy. This is the name of the class

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# that will be used as the Policy object.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepolicy.provider=sun.security.provider.PolicyFile

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# The default is to have a single system-wide policy file,

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# and a policy file in the user's home directory.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepolicy.url.1=file:${java.home}/lib/security/java.policy

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepolicy.url.2=file:${user.home}/.java.policy

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

91cfa10a8e55050a5103c4b2e83b0bf8d783a7cbtomee# whether or not we expand properties in the policy file

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# if this is set to false, properties (${...}) will not be expanded in policy

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# files.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepolicy.expandProperties=true

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# whether or not we allow an extra policy to be passed on the command line

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# with -Djava.security.policy=somefile. Comment out this line to disable

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# this feature.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepolicy.allowSystemProperty=true

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# whether or not we look into the IdentityScope for trusted Identities

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# when encountering a 1.1 signed JAR file. If the identity is found

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# and is trusted, we grant it AllPermission.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepolicy.ignoreIdentityScope=false

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Default keystore type.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeekeystore.type=jks

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# List of comma-separated packages that start with or equal this string

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# will cause a security exception to be thrown when

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# passed to checkPackageAccess unless the

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# corresponding RuntimePermission ("accessClassInPackage."+package) has

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# been granted.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepackage.access=sun.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.xml.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.imageio.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.istack.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.jmx.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.proxy.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.bcel.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.regexp.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xerces.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xpath.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.extensions.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.lib.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.res.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.templates.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.utils.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xslt.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.cmdline.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.compiler.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.trax.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.util.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.res.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.serializer.utils.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.utils.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.security.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.glassfish.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee org.jcp.xml.dsig.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee oracle.jrockit.jfr.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# List of comma-separated packages that start with or equal this string

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# will cause a security exception to be thrown when

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# passed to checkPackageDefinition unless the

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# corresponding RuntimePermission ("defineClassInPackage."+package) has

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# been granted.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# by default, none of the class loaders supplied with the JDK call

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# checkPackageDefinition.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeepackage.definition=sun.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.xml.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.imageio.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.istack.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.jmx.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.proxy.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.bcel.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.regexp.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xerces.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xpath.internal.,\

4ae67516a1d5dc4a5dbc761762bad5b596647388tomee com.sun.org.apache.xalan.internal.extensions.,\

4ae67516a1d5dc4a5dbc761762bad5b596647388tomee com.sun.org.apache.xalan.internal.lib.,\

4ae67516a1d5dc4a5dbc761762bad5b596647388tomee com.sun.org.apache.xalan.internal.res.,\

4ae67516a1d5dc4a5dbc761762bad5b596647388tomee com.sun.org.apache.xalan.internal.templates.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.utils.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xslt.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.cmdline.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.compiler.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.trax.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xalan.internal.xsltc.util.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.res.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.serializer.utils.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.utils.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.apache.xml.internal.security.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee com.sun.org.glassfish.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee org.jcp.xml.dsig.internal.,\

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee oracle.jrockit.jfr.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

4ae67516a1d5dc4a5dbc761762bad5b596647388tomee# Determines whether this properties file can be appended to

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# or overridden on the command line via -Djava.security.properties

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeesecurity.overridePropertiesFile=true

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# Determines the default key and trust manager factory algorithms for

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee# the javax.net.ssl package.

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomee#

fb3fb4f3d76d55b64440afd0af72775dfad3bd1dtomeessl.KeyManagerFactory.algorithm=SunX509

ssl.TrustManagerFactory.algorithm=PKIX

#

# The Java-level namelookup cache policy for successful lookups:

#

# any negative value: caching forever

# any positive value: the number of seconds to cache an address for

# zero: do not cache

#

# default value is forever (FOREVER). For security reasons, this

# caching is made forever when a security manager is set. When a security

# manager is not set, the default behavior in this implementation

# is to cache for 30 seconds.

#

# NOTE: setting this to anything other than the default value can have

# serious security implications. Do not set it unless

# you are sure you are not exposed to DNS spoofing attack.

#

#networkaddress.cache.ttl=-1

# The Java-level namelookup cache policy for failed lookups:

#

# any negative value: cache forever

# any positive value: the number of seconds to cache negative lookup results

# zero: do not cache

#

# In some Microsoft Windows networking environments that employ

# the WINS name service in addition to DNS, name service lookups

# that fail may take a noticeably long time to return (approx. 5 seconds).

# For this reason the default caching policy is to maintain these

# results for 10 seconds.

#

#

networkaddress.cache.negative.ttl=10

#

# Properties to configure OCSP for certificate revocation checking

#

# Enable OCSP

#

# By default, OCSP is not used for certificate revocation checking.

# This property enables the use of OCSP when set to the value "true".

#

# NOTE: SocketPermission is required to connect to an OCSP responder.

#

# Example,

# ocsp.enable=true

#

# Location of the OCSP responder

#

# By default, the location of the OCSP responder is determined implicitly

# from the certificate being validated. This property explicitly specifies

# the location of the OCSP responder. The property is used when the

# Authority Information Access extension (defined in RFC 3280) is absent

# from the certificate or when it requires overriding.

#

# Example,

# ocsp.responderURL=http://ocsp.example.net:80

#

# Subject name of the OCSP responder's certificate

#

# By default, the certificate of the OCSP responder is that of the issuer

# of the certificate being validated. This property identifies the certificate

# of the OCSP responder when the default does not apply. Its value is a string

# distinguished name (defined in RFC 2253) which identifies a certificate in

# the set of certificates supplied during cert path validation. In cases where

# the subject name alone is not sufficient to uniquely identify the certificate

# then both the "ocsp.responderCertIssuerName" and

# "ocsp.responderCertSerialNumber" properties must be used instead. When this

# property is set then those two properties are ignored.

#

# Example,

# ocsp.responderCertSubjectName="CN=OCSP Responder, O=XYZ Corp"

#

# Issuer name of the OCSP responder's certificate

#

# By default, the certificate of the OCSP responder is that of the issuer

# of the certificate being validated. This property identifies the certificate

# of the OCSP responder when the default does not apply. Its value is a string

# distinguished name (defined in RFC 2253) which identifies a certificate in

# the set of certificates supplied during cert path validation. When this

# property is set then the "ocsp.responderCertSerialNumber" property must also

# be set. When the "ocsp.responderCertSubjectName" property is set then this

# property is ignored.

#

# Example,

# ocsp.responderCertIssuerName="CN=Enterprise CA, O=XYZ Corp"

#

# Serial number of the OCSP responder's certificate

#

# By default, the certificate of the OCSP responder is that of the issuer

# of the certificate being validated. This property identifies the certificate

# of the OCSP responder when the default does not apply. Its value is a string

# of hexadecimal digits (colon or space separators may be present) which

# identifies a certificate in the set of certificates supplied during cert path

# validation. When this property is set then the "ocsp.responderCertIssuerName"

# property must also be set. When the "ocsp.responderCertSubjectName" property

# is set then this property is ignored.

#

# Example,

# ocsp.responderCertSerialNumber=2A:FF:00

#

# Policy for failed Kerberos KDC lookups:

#

# When a KDC is unavailable (network error, service failure, etc), it is

# put inside a blacklist and accessed less often for future requests. The

# value (case-insensitive) for this policy can be:

#

# tryLast

# KDCs in the blacklist are always tried after those not on the list.

#

# tryLess[:max_retries,timeout]

# KDCs in the blacklist are still tried by their order in the configuration,

# but with smaller max_retries and timeout values. max_retries and timeout

# are optional numerical parameters (default 1 and 5000, which means once

# and 5 seconds). Please notes that if any of the values defined here is

# more than what is defined in krb5.conf, it will be ignored.

#

# Whenever a KDC is detected as available, it is removed from the blacklist.

# The blacklist is reset when krb5.conf is reloaded. You can add

# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is

# reloaded whenever a JAAS authentication is attempted.

#

# Example,

# krb5.kdc.bad.policy = tryLast

# krb5.kdc.bad.policy = tryLess:2,2000

krb5.kdc.bad.policy = tryLast

# Algorithm restrictions for certification path (CertPath) processing

#

# In some environments, certain algorithms or key lengths may be undesirable

# for certification path building and validation. For example, "MD2" is

# generally no longer considered to be a secure hash algorithm. This section

# describes the mechanism for disabling algorithms based on algorithm name

# and/or key length. This includes algorithms used in certificates, as well

# as revocation information such as CRLs and signed OCSP Responses.

#

# The syntax of the disabled algorithm string is described as this Java

# BNF-style:

# DisabledAlgorithms:

# " DisabledAlgorithm { , DisabledAlgorithm } "

#

# DisabledAlgorithm:

# AlgorithmName [Constraint]

#

# AlgorithmName:

# (see below)

#

# Constraint:

# KeySizeConstraint

#

# KeySizeConstraint:

# keySize Operator DecimalInteger

#

# Operator:

# <= | < | == | != | >= | >

#

# DecimalInteger:

# DecimalDigits

#

# DecimalDigits:

# DecimalDigit {DecimalDigit}

#

# DecimalDigit: one of

# 1 2 3 4 5 6 7 8 9 0

#

# The "AlgorithmName" is the standard algorithm name of the disabled

# algorithm. See "Java Cryptography Architecture Standard Algorithm Name

# Documentation" for information about Standard Algorithm Names. Matching

# is performed using a case-insensitive sub-element matching rule. (For

# example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and

# "ECDSA" for signatures.) If the assertion "AlgorithmName" is a

# sub-element of the certificate algorithm name, the algorithm will be

# rejected during certification path building and validation. For example,

# the assertion algorithm name "DSA" will disable all certificate algorithms

# that rely on DSA, such as NONEwithDSA, SHA1withDSA. However, the assertion

# will not disable algorithms related to "ECDSA".

#

# A "Constraint" provides further guidance for the algorithm being specified.

# The "KeySizeConstraint" requires a key of a valid size range if the

# "AlgorithmName" is of a key algorithm. The "DecimalInteger" indicates the

# key size specified in number of bits. For example, "RSA keySize <= 1024"

# indicates that any RSA key with key size less than or equal to 1024 bits

# should be disabled, and "RSA keySize < 1024, RSA keySize > 2048" indicates

# that any RSA key with key size less than 1024 or greater than 2048 should

# be disabled. Note that the "KeySizeConstraint" only makes sense to key

# algorithms.

#

# Note: This property is currently used by Oracle's PKIX implementation. It

# is not guaranteed to be examined and used by other implementations.

#

# Example:

# jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048

#

#

jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

# Algorithm restrictions for Secure Socket Layer/Transport Layer Security

# (SSL/TLS) processing

#

# In some environments, certain algorithms or key lengths may be undesirable

# when using SSL/TLS. This section describes the mechanism for disabling

# algorithms during SSL/TLS security parameters negotiation, including cipher

# suites selection, peer authentication and key exchange mechanisms.

#

# For PKI-based peer authentication and key exchange mechanisms, this list

# of disabled algorithms will also be checked during certification path

# building and validation, including algorithms used in certificates, as

# well as revocation information such as CRLs and signed OCSP Responses.

# This is in addition to the jdk.certpath.disabledAlgorithms property above.

#

# See the specification of "jdk.certpath.disabledAlgorithms" for the

# syntax of the disabled algorithm string.

#

# Note: This property is currently used by Oracle's JSSE implementation.

# It is not guaranteed to be examined and used by other implementations.

#

# Example:

# jdk.tls.disabledAlgorithms=MD5, SHA1, DSA, RSA keySize < 2048

i