From e089ceaadca78029c7c984eeb0ff199b2fbd78b4 Mon Sep 17 00:00:00 2001 From: Chengyuan Zhang Date: Wed, 22 Apr 2020 18:28:24 +0000 Subject: [PATCH] SECURITY.md: add instruction for disabling Conscrypt's default TrustManager (#6962) --- SECURITY.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 5b4c75f485f..45d75542bb4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -232,9 +232,14 @@ import java.security.Security; ... // Somewhere in main() -Security.insertProviderAt(Conscrypt.newProvider(), 1); +Security.insertProviderAt( + Conscrypt.newProviderBuilder().provideTrustManager(false).build(), 1); ``` +Note: according to [Conscrypt Implementation Notes](https://github.com/google/conscrypt/blob/2.4.0/IMPLEMENTATION_NOTES.md#hostname-verification), +its default `HostnameVerifier` on OpenJDK always fails. This can be worked +around by disabling its default `TrustManager` implementation as shown above. + ### TLS with Jetty ALPN **Please do not use Jetty ALPN**