jdk/src/share/lib/security/java.security-solaris
author chegar
Sat, 13 Apr 2013 20:16:00 +0100
changeset 16901 d98c53659845
parent 16744 b3ca7ed8e44f
parent 16895 2f7edbd000c4
child 16920 d062d91d9dec
permissions -rw-r--r--
Merge
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
     2
# This is the "master security properties file".
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
#
13159
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     4
# An alternate java.security properties file may be specified
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     5
# from the command line via the system property
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     6
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     7
#    -Djava.security.properties=<URL>
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     8
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     9
# This properties file appends to the master security properties file.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    10
# If both properties files specify values for the same key, the value
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    11
# from the command-line properties file is selected, as it is the last
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    12
# one loaded.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    13
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    14
# Also, if you specify
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    15
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    16
#    -Djava.security.properties==<URL> (2 equals),
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    17
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    18
# then that properties file completely overrides the master security
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    19
# properties file.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    20
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    21
# To disable the ability to specify an additional properties file from
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    22
# the command line, set the key security.overridePropertiesFile
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    23
# to false in the master security properties file. It is set to true
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    24
# by default.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    25
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
# In this file, various security properties are set for use by
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
# java.security classes. This is where users can statically register
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
# Cryptography Package Providers ("providers" for short). The term
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
# "provider" refers to a package or set of packages that supply a
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
# concrete implementation of a subset of the cryptography aspects of
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
# the Java Security API. A provider may, for example, implement one or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
# more digital signature algorithms or message digest algorithms.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
# Each provider must implement a subclass of the Provider class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
# To register a provider in this master security properties file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
# specify the Provider subclass name and priority in the format
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
#    security.provider.<n>=<className>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    39
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
# This declares a provider, and specifies its preference
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
# order n. The preference order is the order in which providers are
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
# searched for requested algorithms (when no specific provider is
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
# requested). The order is 1-based; 1 is the most preferred, followed
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
# by 2, and so on.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
# <className> must specify the subclass of the Provider class whose
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
# constructor sets the values of various properties that are required
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
# for the Java Security API to look up the algorithms or other
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
# facilities implemented by the provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
# There must be at least one provider specification in java.security.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
# There is a default provider that comes standard with the JDK. It
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
# is called the "SUN" provider, and its Provider subclass
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
# named Sun appears in the sun.security.provider package. Thus, the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
# "SUN" provider is registered via the following:
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
#    security.provider.1=sun.security.provider.Sun
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
# (The number 1 is used for the default provider.)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
# Note: Providers can be dynamically registered instead by calls to
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
# either the addProvider or insertProviderAt method in the Security
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
# class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    66
# List of providers and their preference orders (see above):
90ce3da70b43 Initial load
duke
parents:
diff changeset
    67
#
11523
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    68
security.provider.1=com.oracle.security.ucrypto.UcryptoProvider ${java.home}/lib/security/ucrypto-solaris.cfg
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    69
security.provider.2=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/sunpkcs11-solaris.cfg
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    70
security.provider.3=sun.security.provider.Sun
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    71
security.provider.4=sun.security.rsa.SunRsaSign
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    72
security.provider.5=sun.security.ec.SunEC
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    73
security.provider.6=com.sun.net.ssl.internal.ssl.Provider
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    74
security.provider.7=com.sun.crypto.provider.SunJCE
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    75
security.provider.8=sun.security.jgss.SunProvider
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    76
security.provider.9=com.sun.security.sasl.Provider
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    77
security.provider.10=org.jcp.xml.dsig.internal.dom.XMLDSigRI
85131f3172a1 7088989: Improve the performance for T4 by utilizing the newly provided crypto APIs
valeriep
parents: 8769
diff changeset
    78
security.provider.11=sun.security.smartcardio.SunPCSC
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    79
90ce3da70b43 Initial load
duke
parents:
diff changeset
    80
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    81
# Select the source of seed data for SecureRandom. By default an
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    82
# attempt is made to use the entropy gathering device specified by
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    83
# the securerandom.source property. If an exception occurs when
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    84
# accessing the URL then the traditional system/thread activity
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    85
# algorithm is used.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    86
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    87
# On Solaris and Linux systems, if file:/dev/urandom is specified and it
90ce3da70b43 Initial load
duke
parents:
diff changeset
    88
# exists, a special SecureRandom implementation is activated by default.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
# This "NativePRNG" reads random bytes directly from /dev/urandom.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    91
# On Windows systems, the URLs file:/dev/random and file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    92
# enables use of the Microsoft CryptoAPI seed functionality.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    93
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
securerandom.source=file:/dev/urandom
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
# The entropy gathering device is described as a URL and can also
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
# be specified with the system property "java.security.egd". For example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
#   -Djava.security.egd=file:/dev/urandom
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
    99
# Specifying this system property will override the securerandom.source
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
# setting.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
# Class to instantiate as the javax.security.auth.login.Configuration
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
# provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
login.configuration.provider=com.sun.security.auth.login.ConfigFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
# Default login configuration file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
#login.config.url.1=file:${user.home}/.java.login.config
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
# Class to instantiate as the system Policy. This is the name of the class
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
# that will be used as the Policy object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
policy.provider=sun.security.provider.PolicyFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
# The default is to have a single system-wide policy file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
# and a policy file in the user's home directory.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
policy.url.1=file:${java.home}/lib/security/java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
policy.url.2=file:${user.home}/.java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
# whether or not we expand properties in the policy file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
# if this is set to false, properties (${...}) will not be expanded in policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
# files.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
policy.expandProperties=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
# whether or not we allow an extra policy to be passed on the command line
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
# with -Djava.security.policy=somefile. Comment out this line to disable
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
# this feature.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
policy.allowSystemProperty=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
# whether or not we look into the IdentityScope for trusted Identities
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
# when encountering a 1.1 signed JAR file. If the identity is found
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
# and is trusted, we grant it AllPermission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
policy.ignoreIdentityScope=false
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
# Default keystore type.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
keystore.type=jks
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
# passed to checkPackageAccess unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
# corresponding RuntimePermission ("accessClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
# been granted.
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   150
package.access=sun.,\
16895
2f7edbd000c4 8005432: Update access to JAX-WS
mkos
parents: 16894
diff changeset
   151
               com.sun.xml.internal.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   152
               com.sun.imageio.,\
16101
0229685a801f 8004175: Restricted packages added in java.security are missing in java.security-{macosx, solaris, windows}
mchung
parents: 16100
diff changeset
   153
               com.sun.istack.internal.,\
16109
eb00701a5769 8006446: Restrict MBeanServer access
dfuchs
parents: 16108
diff changeset
   154
               com.sun.jmx.,\
16108
e5fcdadc69b2 8006882: Proxy generated classes in sun.proxy package breaks JMockit
mchung
parents: 16106
diff changeset
   155
               com.sun.proxy.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   156
               com.sun.org.apache.bcel.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   157
               com.sun.org.apache.regexp.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   158
               com.sun.org.apache.xerces.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   159
               com.sun.org.apache.xpath.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   160
               com.sun.org.apache.xalan.internal.extensions.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   161
               com.sun.org.apache.xalan.internal.lib.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   162
               com.sun.org.apache.xalan.internal.res.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   163
               com.sun.org.apache.xalan.internal.templates.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   164
               com.sun.org.apache.xalan.internal.utils.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   165
               com.sun.org.apache.xalan.internal.xslt.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   166
               com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   167
               com.sun.org.apache.xalan.internal.xsltc.compiler.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   168
               com.sun.org.apache.xalan.internal.xsltc.trax.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   169
               com.sun.org.apache.xalan.internal.xsltc.util.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   170
               com.sun.org.apache.xml.internal.res.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   171
               com.sun.org.apache.xml.internal.serializer.utils.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   172
               com.sun.org.apache.xml.internal.utils.,\
16893
5bed2c2c97dc 8003445: Adjust JAX-WS to focus on API
mullan
parents: 16109
diff changeset
   173
               com.sun.org.glassfish.,\
16744
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16505
diff changeset
   174
               com.oracle.xmlns.internal.,\
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16505
diff changeset
   175
               com.oracle.webservices.internal.,\
16901
chegar
parents: 16744 16895
diff changeset
   176
               jdk.internal.,\
chegar
parents: 16744 16895
diff changeset
   177
               jdk.nashorn.internal.,\
chegar
parents: 16744 16895
diff changeset
   178
               jdk.nashorn.tools.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
# passed to checkPackageDefinition unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
# corresponding RuntimePermission ("defineClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
# been granted.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
#
13035
27b066eebe1f 7145239: Finetune package definition restriction
mullan
parents: 8769
diff changeset
   187
# by default, none of the class loaders supplied with the JDK call
27b066eebe1f 7145239: Finetune package definition restriction
mullan
parents: 8769
diff changeset
   188
# checkPackageDefinition.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
#
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   190
package.definition=sun.,\
16895
2f7edbd000c4 8005432: Update access to JAX-WS
mkos
parents: 16894
diff changeset
   191
                   com.sun.xml.internal.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   192
                   com.sun.imageio.,\
16101
0229685a801f 8004175: Restricted packages added in java.security are missing in java.security-{macosx, solaris, windows}
mchung
parents: 16100
diff changeset
   193
                   com.sun.istack.internal.,\
16109
eb00701a5769 8006446: Restrict MBeanServer access
dfuchs
parents: 16108
diff changeset
   194
                   com.sun.jmx.,\
16108
e5fcdadc69b2 8006882: Proxy generated classes in sun.proxy package breaks JMockit
mchung
parents: 16106
diff changeset
   195
                   com.sun.proxy.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   196
                   com.sun.org.apache.bcel.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   197
                   com.sun.org.apache.regexp.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   198
                   com.sun.org.apache.xerces.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   199
                   com.sun.org.apache.xpath.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   200
                   com.sun.org.apache.xalan.internal.extensions.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   201
                   com.sun.org.apache.xalan.internal.lib.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   202
                   com.sun.org.apache.xalan.internal.res.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   203
                   com.sun.org.apache.xalan.internal.templates.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   204
                   com.sun.org.apache.xalan.internal.utils.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   205
                   com.sun.org.apache.xalan.internal.xslt.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   206
                   com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   207
                   com.sun.org.apache.xalan.internal.xsltc.compiler.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   208
                   com.sun.org.apache.xalan.internal.xsltc.trax.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   209
                   com.sun.org.apache.xalan.internal.xsltc.util.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   210
                   com.sun.org.apache.xml.internal.res.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   211
                   com.sun.org.apache.xml.internal.serializer.utils.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   212
                   com.sun.org.apache.xml.internal.utils.,\
16893
5bed2c2c97dc 8003445: Adjust JAX-WS to focus on API
mullan
parents: 16109
diff changeset
   213
                   com.sun.org.glassfish.,\
16744
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16505
diff changeset
   214
                   com.oracle.xmlns.internal.,\
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16505
diff changeset
   215
                   com.oracle.webservices.internal.,\
16901
chegar
parents: 16744 16895
diff changeset
   216
                   jdk.internal.,\
chegar
parents: 16744 16895
diff changeset
   217
                   jdk.nashorn.internal.,\
chegar
parents: 16744 16895
diff changeset
   218
                   jdk.nashorn.tools.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
# Determines whether this properties file can be appended to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
# or overridden on the command line via -Djava.security.properties
90ce3da70b43 Initial load
duke
parents:
diff changeset
   223
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
security.overridePropertiesFile=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
#
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   227
# Determines the default key and trust manager factory algorithms for
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
# the javax.net.ssl package.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
ssl.KeyManagerFactory.algorithm=SunX509
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
ssl.TrustManagerFactory.algorithm=PKIX
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
# The Java-level namelookup cache policy for successful lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
# any negative value: caching forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
# any positive value: the number of seconds to cache an address for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
# default value is forever (FOREVER). For security reasons, this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   241
# caching is made forever when a security manager is set. When a security
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   242
# manager is not set, the default behavior in this implementation
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   243
# is to cache for 30 seconds.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
# NOTE: setting this to anything other than the default value can have
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   246
#       serious security implications. Do not set it unless
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
#       you are sure you are not exposed to DNS spoofing attack.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
#
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   249
#networkaddress.cache.ttl=-1
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   250
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
# The Java-level namelookup cache policy for failed lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   252
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
# any negative value: cache forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
# any positive value: the number of seconds to cache negative lookup results
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
# In some Microsoft Windows networking environments that employ
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
# the WINS name service in addition to DNS, name service lookups
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
# that fail may take a noticeably long time to return (approx. 5 seconds).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
# For this reason the default caching policy is to maintain these
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   261
# results for 10 seconds.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
networkaddress.cache.negative.ttl=10
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
90ce3da70b43 Initial load
duke
parents:
diff changeset
   266
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
# Properties to configure OCSP for certificate revocation checking
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   269
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   270
# Enable OCSP
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
# By default, OCSP is not used for certificate revocation checking.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
# This property enables the use of OCSP when set to the value "true".
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
# NOTE: SocketPermission is required to connect to an OCSP responder.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
#   ocsp.enable=true
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   279
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   281
# Location of the OCSP responder
90ce3da70b43 Initial load
duke
parents:
diff changeset
   282
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   283
# By default, the location of the OCSP responder is determined implicitly
90ce3da70b43 Initial load
duke
parents:
diff changeset
   284
# from the certificate being validated. This property explicitly specifies
90ce3da70b43 Initial load
duke
parents:
diff changeset
   285
# the location of the OCSP responder. The property is used when the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   286
# Authority Information Access extension (defined in RFC 3280) is absent
90ce3da70b43 Initial load
duke
parents:
diff changeset
   287
# from the certificate or when it requires overriding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   288
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   289
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   290
#   ocsp.responderURL=http://ocsp.example.net:80
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   291
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   292
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   293
# Subject name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   294
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
# of the certificate being validated. This property identifies the certificate
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   297
# of the OCSP responder when the default does not apply. Its value is a string
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   298
# distinguished name (defined in RFC 2253) which identifies a certificate in
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   299
# the set of certificates supplied during cert path validation. In cases where
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
# the subject name alone is not sufficient to uniquely identify the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   301
# then both the "ocsp.responderCertIssuerName" and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   302
# "ocsp.responderCertSerialNumber" properties must be used instead. When this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   303
# property is set then those two properties are ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   305
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   306
#   ocsp.responderCertSubjectName="CN=OCSP Responder, O=XYZ Corp"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   307
90ce3da70b43 Initial load
duke
parents:
diff changeset
   308
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   309
# Issuer name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   310
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   311
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   312
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   314
# distinguished name (defined in RFC 2253) which identifies a certificate in
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   315
# the set of certificates supplied during cert path validation. When this
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   316
# property is set then the "ocsp.responderCertSerialNumber" property must also
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   317
# be set. When the "ocsp.responderCertSubjectName" property is set then this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
# property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   321
#   ocsp.responderCertIssuerName="CN=Enterprise CA, O=XYZ Corp"
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   322
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
# Serial number of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   328
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   329
# of hexadecimal digits (colon or space separators may be present) which
90ce3da70b43 Initial load
duke
parents:
diff changeset
   330
# identifies a certificate in the set of certificates supplied during cert path
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
# validation. When this property is set then the "ocsp.responderCertIssuerName"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
# property must also be set. When the "ocsp.responderCertSubjectName" property
90ce3da70b43 Initial load
duke
parents:
diff changeset
   333
# is set then this property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   335
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
#   ocsp.responderCertSerialNumber=2A:FF:00
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   337
6311
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   338
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   339
# Policy for failed Kerberos KDC lookups:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   340
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   341
# When a KDC is unavailable (network error, service failure, etc), it is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   342
# put inside a blacklist and accessed less often for future requests. The
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   343
# value (case-insensitive) for this policy can be:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   344
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   345
# tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   346
#    KDCs in the blacklist are always tried after those not on the list.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   347
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   348
# tryLess[:max_retries,timeout]
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   349
#    KDCs in the blacklist are still tried by their order in the configuration,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   350
#    but with smaller max_retries and timeout values. max_retries and timeout
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   351
#    are optional numerical parameters (default 1 and 5000, which means once
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   352
#    and 5 seconds). Please notes that if any of the values defined here is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   353
#    more than what is defined in krb5.conf, it will be ignored.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   354
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   355
# Whenever a KDC is detected as available, it is removed from the blacklist.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   356
# The blacklist is reset when krb5.conf is reloaded. You can add
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   357
# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   358
# reloaded whenever a JAAS authentication is attempted.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   359
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   360
# Example,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   361
#   krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   362
#   krb5.kdc.bad.policy = tryLess:2,2000
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   363
krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   364
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   365
# Algorithm restrictions for certification path (CertPath) processing
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   366
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   367
# In some environments, certain algorithms or key lengths may be undesirable
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   368
# for certification path building and validation.  For example, "MD2" is
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   369
# generally no longer considered to be a secure hash algorithm.  This section
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   370
# describes the mechanism for disabling algorithms based on algorithm name
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   371
# and/or key length.  This includes algorithms used in certificates, as well
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   372
# as revocation information such as CRLs and signed OCSP Responses.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   373
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   374
# The syntax of the disabled algorithm string is described as this Java
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   375
# BNF-style:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   376
#   DisabledAlgorithms:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   377
#       " DisabledAlgorithm { , DisabledAlgorithm } "
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   378
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   379
#   DisabledAlgorithm:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   380
#       AlgorithmName [Constraint]
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   381
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   382
#   AlgorithmName:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   383
#       (see below)
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   384
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   385
#   Constraint:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   386
#       KeySizeConstraint
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   387
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   388
#   KeySizeConstraint:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   389
#       keySize Operator DecimalInteger
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   390
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   391
#   Operator:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   392
#       <= | < | == | != | >= | >
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   393
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   394
#   DecimalInteger:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   395
#       DecimalDigits
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   396
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   397
#   DecimalDigits:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   398
#       DecimalDigit {DecimalDigit}
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   399
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   400
#   DecimalDigit: one of
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   401
#       1 2 3 4 5 6 7 8 9 0
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   402
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   403
# The "AlgorithmName" is the standard algorithm name of the disabled
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   404
# algorithm. See "Java Cryptography Architecture Standard Algorithm Name
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   405
# Documentation" for information about Standard Algorithm Names.  Matching
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   406
# is performed using a case-insensitive sub-element matching rule.  (For
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   407
# example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   408
# "ECDSA" for signatures.)  If the assertion "AlgorithmName" is a
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   409
# sub-element of the certificate algorithm name, the algorithm will be
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   410
# rejected during certification path building and validation.  For example,
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   411
# the assertion algorithm name "DSA" will disable all certificate algorithms
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   412
# that rely on DSA, such as NONEwithDSA, SHA1withDSA.  However, the assertion
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   413
# will not disable algorithms related to "ECDSA".
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   414
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   415
# A "Constraint" provides further guidance for the algorithm being specified.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   416
# The "KeySizeConstraint" requires a key of a valid size range if the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   417
# "AlgorithmName" is of a key algorithm.  The "DecimalInteger" indicates the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   418
# key size specified in number of bits.  For example, "RSA keySize <= 1024"
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   419
# indicates that any RSA key with key size less than or equal to 1024 bits
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   420
# should be disabled, and "RSA keySize < 1024, RSA keySize > 2048" indicates
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   421
# that any RSA key with key size less than 1024 or greater than 2048 should
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   422
# be disabled. Note that the "KeySizeConstraint" only makes sense to key
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   423
# algorithms.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   424
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   425
# Note: This property is currently used by Oracle's PKIX implementation. It
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   426
# is not guaranteed to be examined and used by other implementations.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   427
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   428
# Example:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   429
#   jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   430
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   431
#
14929
59377f4b9919 7109274: Restrict the use of certificates with RSA keys less than 1024 bits
xuelei
parents: 14229
diff changeset
   432
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   433
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   434
# Algorithm restrictions for Secure Socket Layer/Transport Layer Security
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   435
# (SSL/TLS) processing
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   436
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   437
# In some environments, certain algorithms or key lengths may be undesirable
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   438
# when using SSL/TLS.  This section describes the mechanism for disabling
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   439
# algorithms during SSL/TLS security parameters negotiation, including cipher
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   440
# suites selection, peer authentication and key exchange mechanisms.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   441
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   442
# For PKI-based peer authentication and key exchange mechanisms, this list
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   443
# of disabled algorithms will also be checked during certification path
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   444
# building and validation, including algorithms used in certificates, as
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   445
# well as revocation information such as CRLs and signed OCSP Responses.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   446
# This is in addition to the jdk.certpath.disabledAlgorithms property above.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   447
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   448
# See the specification of "jdk.certpath.disabledAlgorithms" for the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   449
# syntax of the disabled algorithm string.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   450
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   451
# Note: This property is currently used by Oracle's JSSE implementation.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   452
# It is not guaranteed to be examined and used by other implementations.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   453
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   454
# Example:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   455
#   jdk.tls.disabledAlgorithms=MD5, SHA1, DSA, RSA keySize < 2048
7047
38b1365f95b2 6945529: Apply fix for CR 6921001 to platform-specific java.security configuration files
vinnie
parents: 7040
diff changeset
   456
i