From cd9108a44e288f5f30c8455b6bab823d2cd60a29 Mon Sep 17 00:00:00 2001 From: Chengyuan Zhang Date: Tue, 15 Sep 2020 23:25:14 -0700 Subject: [PATCH] Revert "SECURITY.md: add instruction for disabling Conscrypt's default TrustManager (#6962)" This reverts commit e089ceaadca78029c7c984eeb0ff199b2fbd78b4. --- SECURITY.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 5aeff135349..631b4396fce 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -232,14 +232,9 @@ import java.security.Security; ... // Somewhere in main() -Security.insertProviderAt( - Conscrypt.newProviderBuilder().provideTrustManager(false).build(), 1); +Security.insertProviderAt(Conscrypt.newProvider(), 1); ``` -Note: according to [Conscrypt Implementation Notes](https://github.com/google/conscrypt/blob/2.4.0/IMPLEMENTATION_NOTES.md#hostname-verification), -its default `HostnameVerifier` on OpenJDK always fails. This can be worked -around by disabling its default `TrustManager` implementation as shown above. - ### TLS with Jetty ALPN **Please do not use Jetty ALPN**