javax.net ssl debugging java.security plus plus

JSSE extends this facility by consulting the javax.net.debug property for the following options:

all
Turn on all options and sub-options.
ssl
Turn on SSL debugging. This option has the following sub-options (all of which are in force if none are specified):
record
Print a trace of each SSL record (at the SSL protocol level).
handshake
Print each handshake message as it is received.
keygen
Print key generation data for the secret key exchange.
session
Print SSL session activity.
defaultctx
Print the default SSL initialization information.
sslctx
Print information about the SSL context.
sessioncache
Print information about the SSL session cache.
keymanager
Print information about calls to the key manager.
trustmanager
Print information about calls to the trust manager.
data
For handshake tracing, print out a hex dump of each message.
verbose
For handshake tracing, print out verbose information.
plaintext

For record tracing, print out a hex dump of the record. As you progress through the samples in the book, you can turn various options on in order to see more information about what's going on.

java.security single vs double 'equals' specifying java.policy

Just because I have seen conflicting messages regarding '=' vs '==' as in

-Djava.security.policy==my.policy

or

-Djava.security.policy=my.policy

. The names of the default policy files When the default implementation of the Policy class reads in permissions, it will read them from the URLs listed as this set of properties:

policy.url.1=file:${java.home}/lib/security/java.policy
policy.url.2=file:${user.home}/.java.policy

You may specify any number of files in this manner, but the list must start at 1 and be numbered consecutively. The set of permissions will be the aggregate of all permissions found in these URLs. Remember that these URLs contain only global permissions. You may also specify on the command line a file containing policies with the -Djava.security.policy argument. If the name following the -Djava.security.policy argument begins with an equals sign, the URLs listed in the java.security file are ignored:

-Djava.security.policy=/globals/java.policy (NO APPEND)

adds the policies in the /globals/java.policy file to the set of policies in force, but:

-Djava.security.policy==/globals/java.policy (APPEND AFTER policy.url's listed in java.security)

sets the policy only to the entries contained in the /globals/java.policy file. The -Djava.security.policy argument must be with the -Djava.security.manager; if you want to use only the files listed in the java.security file, specify -Djava.security.manager without -Djava.security.policy. Other implementations of the Policy class may or may not use these properties.

java.security.debug property syntax logging

A number of Java debugging flags are available to assist you in determining how the security manager is using your security policy file, and what policy files are contributing permissions. Running the VM as follows shows the possible debugging flag settings:

[bin]$ java -Djava.security.debug=help

all            turn on all debugging
access         print all checkPermission results
combiner       SubjectDomainCombiner debugging
configfile     JAAS ConfigFile loading
configparser   JAAS ConfigFile parsing
gssloginconfig GSS LoginConfigImpl debugging
jar            jar verification
logincontext   login context results
policy         loading and granting
provider       security provider debugging
scl            permissions SecureClassLoader assigns

The following can be used with access:

stack         include stack trace
domain        dump all domains in context
failure       before throwing exception, dump stack
              and domain that didn't have permission

The following can be used with stack and domain:

permission=
              only dump output if specified permission
              is being checked
codebase=
              only dump output if specified codebase
              is being checked

Running with -Djava.security.debug=all provides the most output, but the output volume is acutely verbose. This might be a good place to start if you don't understand a given security failure at all. For less verbose output that will still assist with debugging permission failures, use -Djava.security.debug=access,failure.