com.sun.security.enableCRLDP Java System Property

Default Value

false

Support for the CRL Distribution Points extension is available. It is disabled by default for compatibility and can be enabled by setting the system property com.sun.security.enableCRLDP to the value true.
via: Java PKI API Programmer's Guide

Overview of com.sun.security.enableCRLDP

A Certificate Revocation List (CRL) is a list, published by a certificate authority, of certificates that have been revoked before their expiration date. Most certificates include a CRL Distribution Points extension which contains the location (typically an http URL) where the CRL for that certificate can be downloaded.

When com.sun.security.enableCRLDP is set to true, the JDK's PKIX implementation uses the information in a certificate's CRL Distribution Points extension (in addition to any CertStores that are specified) to find the CRL, provided the distribution point is an X.500 distinguished name or a URI of type ldap, http, or ftp.

This property only has an effect when revocation checking is actually performed. For TLS connections that use the default trust manager, revocation checking is disabled unless the com.sun.net.ssl.checkRevocation system property is set to true. When using the CertPathValidator API directly, revocation checking is controlled by PKIXParameters.setRevocationEnabled().

Depending on your network and firewall setup, you may also need to configure proxy servers (for example with the http.proxyHost and http.proxyPort system properties) so that the JDK can reach the CRL download locations.

Related Properties

• com.sun.net.ssl.checkRevocation - enables certificate revocation checking for TLS connections.
• com.sun.security.crl.timeout - the maximum connection timeout for CRL retrievals, in seconds. If not set, or if the value is negative, the default of 15 seconds is used. A value of 0 means an infinite timeout.
• com.sun.security.enableAIAcaIssuers - when set to true, allows the PKIX CertPathBuilder to use a certificate's Authority Information Access (AIA) extension to download the issuing CA certificate. Disabled by default.
• ocsp.enable - a security property that enables OCSP checking (instead of, or in addition to, CRLs) when revocation checking is enabled.

Other Networking System Properties

Here are some other networking Java system properties:

• com.sun.net.ssl.checkRevocation
• http.agent
• http.keepAlive
• http.maxConnections
• http.nonProxyHosts
• http.proxyHost
• http.proxyPort
• https.protocols
• https.proxyHost
• https.proxyPort
• java.net.preferIPv4Stack
• java.net.preferIPv6Addresses
• java.net.useSystemProxies
• javax.net.debug
• javax.net.ssl.trustStore
• jdk.http.maxHeaderSize
• jdk.net.hosts.file
• jdk.tls.client.protocols
• jdk.tls.server.newSessionTicketCount
• jdk.crypto.disabledAlgorithms
• jdk.tls.disabledAlgorithms
• networkaddress.cache.negative.ttl
• networkaddress.cache.ttl
• ocsp.enable
• sun.net.client.defaultConnectTimeout
• sun.net.client.defaultReadTimeout
• sun.net.inetaddr.ttl

References

• Java PKI API Programmer's Guide - Support for the CRL Distribution Points Extension

Supported Since

Java has supported the com.sun.security.enableCRLDP system property since at least Java 8.

Setting com.sun.security.enableCRLDP on Startup

You can set the com.sun.security.enableCRLDP java system property during startup of the java runtime using the -D command line argument:

java -Dcom.sun.security.enableCRLDP=true MyAppMain

You may also be able to specify com.sun.security.enableCRLDP via the JAVA_TOOL_OPTIONS environment variable:

JAVA_TOOL_OPTIONS=-Dcom.sun.security.enableCRLDP=true

Setting / Reading com.sun.security.enableCRLDP at Runtime

You can set com.sun.security.enableCRLDP at runtime with the following Java code:

System.setProperty("com.sun.security.enableCRLDP", "true");

WARNING: Depending on the property and JVM version using setProperty may or may not work if the JDK Java class that uses this variable has already been loaded. The value of the com.sun.security.enableCRLDP system property may be cached within an internal private static variable of the implementing class.

To read the value of com.sun.security.enableCRLDP at runtime, you can use this Java code:

String propertyValue = System.getProperty("com.sun.security.enableCRLDP");
if (propertyValue != null) {
    System.out.println("com.sun.security.enableCRLDP = " + propertyValue);
} else {
    System.out.println("com.sun.security.enableCRLDP was null");
}