< prev index next >

src/share/lib/security/java.security-solaris

Print this page
rev 13457 : 8207258: Distrust TLS server certificates anchored by Symantec Root CAs
Reviewed-by: weijun, shade
rev 13458 : 8216280: Allow later Symantec Policy distrust date for two Apple SubCAs
Reviewed-by: coffeys, shade

*** 976,980 **** --- 976,1010 ---- # The filter pattern uses the same format as jdk.serialFilter. The default # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type, # and javax.crypto.spec.SecretKeySpec and rejects all the others. jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\ java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!* + + # + # Policies for distrusting Certificate Authorities (CAs). + # + # This is a comma separated value of one or more case-sensitive strings, each + # of which represents a policy for determining if a CA should be distrusted. + # The supported values are: + # + # + # SYMANTEC_TLS : Distrust TLS Server certificates anchored by a Symantec + # root CA and issued after April 16, 2019 unless issued by one of the + # following subordinate CAs which have a later distrust date: + # 1. Apple IST CA 2 - G1, SHA-256 fingerprint: + # AC2B922ECFD5E01711772FEA8ED372DE9D1E2245FCE3F57A9CDBEC77296A424B + # Distrust after December 31, 2019. + # 2. Apple IST CA 8 - G1, SHA-256 fingerprint: + # A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED + # Distrust after December 31, 2019. + # Leading and trailing whitespace surrounding each value are ignored. + # Unknown values are ignored. If the property is commented out or set to the + # empty String, no policies are enforced. + # + # Note: This property is currently used by the JDK Reference implementation. + # It is not guaranteed to be supported by other SE implementations. Also, this + # property does not override other security properties which can restrict + # certificates such as jdk.tls.disabledAlgorithms or + # jdk.certpath.disabledAlgorithms; those restrictions are still enforced even + # if this property is not enabled. + # + jdk.security.caDistrustPolicies=SYMANTEC_TLS
< prev index next >