Chapter 4. Red Hat build of OpenJDK new features and enhancements

The Red Hat build of OpenJDK 11.0.30 release includes the following new features or enhancements to existing features that were introduced in earlier releases.

Improved JMX connections

From Red Hat build of OpenJDK 11.0.30 onward, SSL connections created by javax.rmi.ssl.SslRMIClientSocketFactory objects enable HTTPS-based endpoint identification by default.

You can disable this feature by setting the jdk.rmi.ssl.client.enableEndpointIdentification property to false.

JDK bug system reference ID: JDK-8341496

Enhanced certificate checking

When the com.sun.security.enableAIAcaIssuers system property is set to true, Red Hat build of OpenJDK supports the authorityInfoAccess extension in X.509 certificates.

Red Hat build of OpenJDK 11.0.30 adds a new system and security property, com.sun.security.allowedAIALocations, that acts as a filter on the Uniform Resource Identifiers (URIs) that are specified in the authorityInfoAccess extension. By default, this property has an empty value, which means all URIs are denied when the extension is enabled. If you want to allow all URIs, set this property to any.

For more granular control, you can specify a whitespace-separated list of filters. The java.security file provides information on the syntax for the list of filters.

JDK bug system reference ID: JDK-8368032

Mechanism for disabling different parts of the TLS cipher suite based on pattern matching

In earlier releases, the mechanisms for disabling TLS algorithms were either too general or too specific. For example, if you disabled an algorithm such as RSA, the JDK disabled all cipher suites that used this algorithm. In this situation, the only alternative was to disable each cipher suite specifically.

From Red Hat build of OpenJDK 11.0.30 onward, the jdk.tls.disabledAlgorithms security property in the java.security configuration file supports asterisk (*) wildcard characters for patterns that start with "TLS_". For example, TLS_RSA_* disables all cipher suites that start with TLS_RSA_.

See JDK-8341964 (JDK Bug System).

TLS_RSA cipher suites are disabled by default

The TLS Rivest-Shamir-Adleman (TLS_RSA) cipher suites do not preserve forward secrecy and they are rarely used. Red Hat build of OpenJDK 11.0.30 disables the TLS_RSA cipher suites by adding the TLS_RSA_* option to the jdk.tls.disabledAlgorithms security property in the java.security configuration file. If you attempt to use the TLS_RSA cipher suites, Red Hat build of OpenJDK now throws an SSLHandshakeException error.

If you want to continue using the TLS_RSA cipher suites, you can remove TLS_RSA_* from the jdk.tls.disabledAlgorithms security property either by modifying the java.security configuration file or by using the java.security.properties system property.

See JDK-8245545 (JDK Bug System).

"Best-fit" mapping disabled in Windows command prompt

In earlier releases, on Windows platforms, the Java launcher used the American National Standards Institute (ANSI) version of the GetCommandLine() Win32 API call to obtain command-line arguments. In this situation, if the command-line arguments contained Unicode characters that did not exist in the ANSI code page, these arguments were converted to other characters based on the Windows "best fit" mapping. However, this mapping could have introduced unexpected characters and differed between code pages.

From Red Hat build of OpenJDK 11.0.30 onward, the JDK reads command-line arguments as Unicode characters and then converts them to the ANSI code page, using the default replacement for any unmappable character. If applications need to use unmappable characters as is, without replacement, ensure that you select UTF-8 in the Windows regional settings.

See JDK-8337506 (JDK Bug System).

Information improvements for container memory usage

From Red Hat build of OpenJDK 11.0.30 onward, the JDK provides additional information for containers by also including memory usage details for both the Resident Set Size (RSS) and the cache. These memory usage details are specified in bytes.

This additional information is visible in both of the following locations:

See JDK-8313083 (JDK Bug System).