diff --git a/SECURITY.md b/SECURITY.md index 5aeff1353494..631b4396fce0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -232,14 +232,9 @@ import java.security.Security; ... // Somewhere in main() -Security.insertProviderAt( - Conscrypt.newProviderBuilder().provideTrustManager(false).build(), 1); +Security.insertProviderAt(Conscrypt.newProvider(), 1); ``` -Note: according to [Conscrypt Implementation Notes](https://github.com/google/conscrypt/blob/2.4.0/IMPLEMENTATION_NOTES.md#hostname-verification), -its default `HostnameVerifier` on OpenJDK always fails. This can be worked -around by disabling its default `TrustManager` implementation as shown above. - ### TLS with Jetty ALPN **Please do not use Jetty ALPN**