# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Java 21 java.security properties file override for JVM
# base properties derived from:
# openjdk version "21-ea" 2023-09-19
# OpenJDK Runtime Environment (build 21-ea+23-1988)
# OpenJDK 64-Bit Server VM (build 21-ea+23-1988, mixed mode, sharing)

# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
# legacy algorithms list to allow it to be used if something better is not
# available (e.g. TLSv1.2). This will prevent breakages for existing users
# (for example JDBC with MySQL). See
# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
# for additional details.
jdk.tls.disabledAlgorithms=SSLv3, DTLSv1.0, RC4, DES, \
    MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
    ECDH

# The raw value from 21-ea for legacyAlgorithms is
#  NULL, anon, RC4, DES, 3DES_EDE_CBC
# Because these values are in disabledAlgorithms, it is erroneous to include
# them in legacy (they are disabled in Java 8, 11, and 17 as well). Here we 
# only include TLSv1 and TLSv1.1 which were removed from disabledAlgorithms
jdk.tls.legacyAlgorithms=TLSv1, TLSv1.1

# /dev/random blocks in virtualized environments due to lack of
# good entropy sources, which makes SecureRandom use impractical.
# In particular, that affects the performance of HTTPS that relies
# on SecureRandom.
#
# Due to that, /dev/urandom is used as the default.
#
# See http://www.2uo.de/myths-about-urandom/ for some background
# on security of /dev/urandom on Linux.
securerandom.source=file:/dev/./urandom