Skip to content

8285827: Describe the keystore.pkcs12.legacy system property in the java.security file #8452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

8285827: Describe the keystore.pkcs12.legacy system property in the java.security file #8452

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0870038
add description
wangweij Apr 28, 2022
8a24c74
clearer text
wangweij Apr 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 24 additions & 4 deletions src/java.base/share/conf/security/java.security
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1166,10 +1166,30 @@ jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep
# If a system property of the same name is also specified, it supersedes the
# security property value defined here.
#
# If the property is set to an illegal value,
# an iteration count that is not a positive integer, or an unknown algorithm
# name, an exception will be thrown when the property is used.
# If the property is not set or empty, a default value will be used.
# If the property is set to an illegal value, an iteration count that is not
# a positive integer, or an unknown algorithm name, an exception will be thrown
# when the property is used. If the property is not set or empty, a default
# value will be used.
#
# Some PKCS12 tools and libraries may not support algorithms based on PBES2
# and AES. To create a PKCS12 keystore which they can load, set the system
# property "keystore.pkcs12.legacy" which overrides the values of the properties
# defined below with legacy algorithms. Setting this system property (which can
# only be enabled and has no value) is equivalent to
#
# -Dkeystore.pkcs12.certProtectionAlgorithm=PBEWithSHA1AndRC2_40
# -Dkeystore.pkcs12.keyProtectionAlgorithm=PBEWithSHA1AndDESede
# -Dkeystore.pkcs12.macAlgorithm=HmacPBESHA1
# -Dkeystore.pkcs12.certPbeIterationCount=50000
# -Dkeystore.pkcs12.keyPbeIterationCount=50000
# -Dkeystore.pkcs12.macIterationCount=100000
#
# Also, you can downgrade an existing PKCS12 keystore created with stronger
# algorithms to legacy algorithms with
#
# keytool -J-Dkeystore.pkcs12.legacy -importkeystore -srckeystore ks -destkeystore ks
#
# This system property should be used at your own risk.
#
# Note: These properties are currently used by the JDK Reference implementation.
# They are not guaranteed to be examined and used by other implementations.
Expand Down