SECURITY.md: add instruction for disabling Conscrypt's default TrustM…

…anager (grpc#6962)
dfawley · Jan 15, 2021 · e23a445 · e23a445
1 parent 627aaeb
commit e23a445
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/SECURITY.md b/SECURITY.md
@@ -232,9 +232,14 @@ import java.security.Security;
 ...
 
 // Somewhere in main()
-Security.insertProviderAt(Conscrypt.newProvider(), 1);
+Security.insertProviderAt(
+    Conscrypt.newProviderBuilder().provideTrustManager(false).build(), 1);
 ```
 
+Note: according to [Conscrypt Implementation Notes](https://github.com/google/conscrypt/blob/2.4.0/IMPLEMENTATION_NOTES.md#hostname-verification),
+its default `HostnameVerifier` on OpenJDK always fails. This can be worked 
+around by disabling its default `TrustManager` implementation as shown above.
+
 ### TLS with Jetty ALPN
 
 **Please do not use Jetty ALPN**