Re: RFR: 8272875: Change the default key manager to PKIX [v3]

2025-05-05 Thread Artur Barashev
On Mon, 5 May 2025 08:50:07 GMT, Daniel Jeliński wrote: > Well, technically the current 1ms takes into account both the client side and > the server side of the handshake. Last time I checked, they were more or less > evenly split. The 1ms slowdown will happen entirely on the server side, so >

Re: RFR: 8272875: Change the default key manager to PKIX [v3]

2025-05-05 Thread Daniel Jeliński
On Tue, 29 Apr 2025 21:51:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v3]

2025-04-30 Thread Artur Barashev
On Tue, 29 Apr 2025 21:51:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v3]

2025-04-29 Thread Daniel Jeliński
On Tue, 29 Apr 2025 21:51:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v3]

2025-04-29 Thread Anthony Scarpino
On Tue, 29 Apr 2025 21:51:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v3]

2025-04-29 Thread Artur Barashev
> The current key manager is SunX509, which is configured in the java.security. > The SunX509 algorithm does not check the local certificate. The PKIX > algorithm should be preferred now so that the default key manager could be > more robust. > > Compatibility considerations: > > 1) Customers

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-29 Thread Artur Barashev
On Tue, 29 Apr 2025 19:58:42 GMT, Sean Mullan wrote: >> Artur Barashev has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Skip explicit KeyPair initialization and let the provider default set it > > test/jdk/javax/rmi/ssl/SSLSocketParameter

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-29 Thread Artur Barashev
On Tue, 29 Apr 2025 18:51:58 GMT, Sean Mullan wrote: >> Artur Barashev has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Skip explicit KeyPair initialization and let the provider default set it > > test/jdk/sun/security/tools/keytool/Print

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-29 Thread Sean Mullan
On Thu, 24 Apr 2025 18:30:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-29 Thread Sean Mullan
On Thu, 24 Apr 2025 18:30:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-24 Thread Daniel Jeliński
On Thu, 24 Apr 2025 18:30:00 GMT, Artur Barashev wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be more

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-24 Thread Artur Barashev
On Wed, 23 Apr 2025 23:28:29 GMT, Anthony Scarpino wrote: > Do we understand why this is so much slower? I wouldn't have thought extra > checking would cause this big of a performance hit. Yes, it looks that way. `SunX509` KeyManager is really simple, so adding certificate validation can decr

Re: RFR: 8272875: Change the default key manager to PKIX [v2]

2025-04-24 Thread Artur Barashev
> The current key manager is SunX509, which is configured in the java.security. > The SunX509 algorithm does not check the local certificate. The PKIX > algorithm should be preferred now so that the default key manager could be > more robust. > > Compatibility considerations: > > 1) Customers

Re: RFR: 8272875: Change the default key manager to PKIX

2025-04-24 Thread Artur Barashev
On Wed, 23 Apr 2025 17:54:38 GMT, Anthony Scarpino wrote: >> The current key manager is SunX509, which is configured in the >> java.security. The SunX509 algorithm does not check the local certificate. >> The PKIX algorithm should be preferred now so that the default key manager >> could be m

Re: RFR: 8272875: Change the default key manager to PKIX

2025-04-23 Thread Anthony Scarpino
On Fri, 18 Apr 2025 17:04:56 GMT, Artur Barashev wrote: > The current key manager is SunX509, which is configured in the java.security. > The SunX509 algorithm does not check of the local certificate. The PKIX > algorithm should be preferred now so that the default key manager could be > more

RFR: 8272875: Change the default key manager to PKIX

2025-04-18 Thread Artur Barashev
The current key manager is SunX509, which is configured in the java.security. The SunX509 algorithm does not check of the local certificate. The PKIX algorithm should be preferred now so that the default key manager could be more robust. - Commit messages: - Rework unit tests - U