964 # It is not guaranteed to be examined and used by other implementations.
965 #
966 #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name
967
968 #
969 # JCEKS Encrypted Key Serial Filter
970 #
971 # This filter, if configured, is used by the JCEKS KeyStore during the
972 # deserialization of the encrypted Key object stored inside a key entry.
973 # If not configured or the filter result is UNDECIDED (i.e. none of the patterns
974 # matches), the filter configured by jdk.serialFilter will be consulted.
975 #
976 # If the system property jceks.key.serialFilter is also specified, it supersedes
977 # the security property value defined here.
978 #
979 # The filter pattern uses the same format as jdk.serialFilter. The default
980 # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type,
981 # and javax.crypto.spec.SecretKeySpec and rejects all the others.
982 jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\
983 java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*
|
964 # It is not guaranteed to be examined and used by other implementations.
965 #
966 #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name
967
968 #
969 # JCEKS Encrypted Key Serial Filter
970 #
971 # This filter, if configured, is used by the JCEKS KeyStore during the
972 # deserialization of the encrypted Key object stored inside a key entry.
973 # If not configured or the filter result is UNDECIDED (i.e. none of the patterns
974 # matches), the filter configured by jdk.serialFilter will be consulted.
975 #
976 # If the system property jceks.key.serialFilter is also specified, it supersedes
977 # the security property value defined here.
978 #
979 # The filter pattern uses the same format as jdk.serialFilter. The default
980 # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type,
981 # and javax.crypto.spec.SecretKeySpec and rejects all the others.
982 jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\
983 java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*
984
985 #
986 # Policies for distrusting Certificate Authorities (CAs).
987 #
988 # This is a comma separated value of one or more case-sensitive strings, each
989 # of which represents a policy for determining if a CA should be distrusted.
990 # The supported values are:
991 #
992 #
993 # SYMANTEC_TLS : Distrust TLS Server certificates anchored by a Symantec
994 # root CA and issued after April 16, 2019 unless issued by one of the
995 # following subordinate CAs which have a later distrust date:
996 # 1. Apple IST CA 2 - G1, SHA-256 fingerprint:
997 # AC2B922ECFD5E01711772FEA8ED372DE9D1E2245FCE3F57A9CDBEC77296A424B
998 # Distrust after December 31, 2019.
999 # 2. Apple IST CA 8 - G1, SHA-256 fingerprint:
1000 # A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED
1001 # Distrust after December 31, 2019.
1002 # Leading and trailing whitespace surrounding each value are ignored.
1003 # Unknown values are ignored. If the property is commented out or set to the
1004 # empty String, no policies are enforced.
1005 #
1006 # Note: This property is currently used by the JDK Reference implementation.
1007 # It is not guaranteed to be supported by other SE implementations. Also, this
1008 # property does not override other security properties which can restrict
1009 # certificates such as jdk.tls.disabledAlgorithms or
1010 # jdk.certpath.disabledAlgorithms; those restrictions are still enforced even
1011 # if this property is not enabled.
1012 #
1013 jdk.security.caDistrustPolicies=SYMANTEC_TLS
|