These exceptions may be removed in a future JDK release. Any JAR signed with a SHA-1 certificate that does not chain back to a Root CA included by default in the JDK cacerts keystore will not be restricted.Any JAR signed with SHA-1 algorithms and timestamped prior to Januwill not be restricted.

In order to reduce the compatibility risk for applications that have been previously timestamped or use private CAs, there are two exceptions to this policy: It also applies to the signature and digest algorithms of the certificates in the certificate chain of the code signer and the Timestamp Authority, and any CRLs or OCSP responses that are used to verify if those certificates have been revoked. This applies to the algorithms used to digest, sign, and optionally timestamp the JAR. JARs signed with SHA-1 algorithms are now restricted by default and treated as if they were unsigned. Security-libs/curity ➜ Disable SHA-1 JARs For authorized use only', OU=Class 3 Public Primary Certification Authority - G2, O='VeriSign, Inc.', C=USĭistinguished Name: CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA For authorized use only', OU=Class 2 Public Primary Certification Authority - G2, O='VeriSign, Inc.', C=USĭistinguished Name: OU=Class 3 Public Primary Certification Authority, O='VeriSign, Inc.', C=USĭistinguished Name: OU=VeriSign Trust Network, OU='(c) 1998 VeriSign, Inc. The following root certificates with weak 1024-bit RSA public keys have been removed from the cacerts keystore: + alias name 'thawtepremiumserverca 'ĭistinguished Name: CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZAĭistinguished Name: OU=VeriSign Trust Network, OU='(c) 1998 VeriSign, Inc. Security-libs/curity ➜ Removed Root Certificates with 1024-bit Keys

Installing java runtime on mac