962 # It is not guaranteed to be examined and used by other implementations.
 963 #
 964 #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name
 965 
 966 #
 967 # JCEKS Encrypted Key Serial Filter
 968 #
 969 # This filter, if configured, is used by the JCEKS KeyStore during the
 970 # deserialization of the encrypted Key object stored inside a key entry.
 971 # If not configured or the filter result is UNDECIDED (i.e. none of the patterns
 972 # matches), the filter configured by jdk.serialFilter will be consulted.
 973 #
 974 # If the system property jceks.key.serialFilter is also specified, it supersedes
 975 # the security property value defined here.
 976 #
 977 # The filter pattern uses the same format as jdk.serialFilter. The default
 978 # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type,
 979 # and javax.crypto.spec.SecretKeySpec and rejects all the others.
 980 jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\
 981   java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*

 962 # It is not guaranteed to be examined and used by other implementations.
 963 #
 964 #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name
 965 
 966 #
 967 # JCEKS Encrypted Key Serial Filter
 968 #
 969 # This filter, if configured, is used by the JCEKS KeyStore during the
 970 # deserialization of the encrypted Key object stored inside a key entry.
 971 # If not configured or the filter result is UNDECIDED (i.e. none of the patterns
 972 # matches), the filter configured by jdk.serialFilter will be consulted.
 973 #
 974 # If the system property jceks.key.serialFilter is also specified, it supersedes
 975 # the security property value defined here.
 976 #
 977 # The filter pattern uses the same format as jdk.serialFilter. The default
 978 # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type,
 979 # and javax.crypto.spec.SecretKeySpec and rejects all the others.
 980 jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\
 981   java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*
 982 
 983 #
 984 # Policies for distrusting Certificate Authorities (CAs).
 985 #
 986 # This is a comma separated value of one or more case-sensitive strings, each
 987 # of which represents a policy for determining if a CA should be distrusted.
 988 # The supported values are:
 989 #
 990 # SYMANTEC_TLS : Distrust TLS Server certificates anchored by
 991 #                a Symantec root CA and issued after April 16, 2019.
 992 #
 993 # Leading and trailing whitespace surrounding each value are ignored.
 994 # Unknown values are ignored. If the property is commented out or set to the
 995 # empty String, no policies are enforced.
 996 #
 997 # Note: This property is currently used by the JDK Reference implementation.
 998 # It is not guaranteed to be supported by other SE implementations. Also, this
 999 # property does not override other security properties which can restrict
1000 # certificates such as jdk.tls.disabledAlgorithms or
1001 # jdk.certpath.disabledAlgorithms; those restrictions are still enforced even
1002 # if this property is not enabled.
1003 #
1004 jdk.security.caDistrustPolicies=SYMANTEC_TLS