Properties (Bouncy Castle Library 1.85 API Specification)

java.lang.Object
- org.bouncycastle.util.Properties

```
public class Properties
extends java.lang.Object
```
Utility method for accessing properties values - properties can be set in java.security, thread local, and system properties. They are checked for in the same order with checking stopped as soon as a value is found.

Field Summary

Fields
Modifier and Type	Field and Description
`static java.lang.String`	`ASN1_ALLOW_NON_DER_TIME` Controls whether an ASN.1 `UTCTime` / `GeneralizedTime` carrying non-DER contents may be serialized through a `DEROutputStream`.
`static java.lang.String`	`ASN1_MAX_CONS_DEPTH` Maximum depth of nested constructed ASN.1 objects the parser will descend before failing with "maximum nested construction level reached", guarding against stack exhaustion from deeply nested crafted input.
`static java.lang.String`	`ASN1_MAX_LIMIT` Overrides the maximum length accepted for a single definite-length ASN.1 object read from a stream whose length is not otherwise known.
`static java.lang.String`	`BCFKS_MAX_IT_COUNT` Upper bound on the PBKDF2 iteration count honoured when deriving the integrity-MAC key of a BCFKS keystore during load.
`static java.lang.String`	`BCFKS_MAX_SCRYPT_MEMORY` Upper bound, in bytes, on the working memory (~128 * N * r) of the scrypt KDF honoured when deriving the integrity-MAC key of a BCFKS keystore during load.
`static java.lang.String`	`BKS_ENABLE_V1` Opt in to handling legacy version 0/1 BKS keystores.
`static java.lang.String`	`BKS_MAX_IT_COUNT` Upper bound on the PKCS#12-PBE iteration count honoured when loading a BKS keystore.
`static java.lang.String`	`DH_MAX_SIZE` Upper bound (in bits) on the prime modulus p accepted when validating an imported Diffie-Hellman public key.
`static java.lang.String`	`DRBG_EFFECTIVE_256BITS_ENTROPY` Effective bits-of-entropy assumed per real bit when the BC DRBG provider seeds for a 256-bit security level — used to compute the byte-oriented samples requested from the underlying entropy source.
`static java.lang.String`	`DRBG_ENTROPY_SOURCE` Fully-qualified name of an `EntropySourceProvider` class to use as the BC DRBG provider's seed source.
`static java.lang.String`	`DRBG_ENTROPY_THREAD` If set to "true", the BC DRBG provider runs a background thread that samples the platform entropy source on a fixed schedule and feeds the DRBG, rather than blocking on a fresh sample at each reseed.
`static java.lang.String`	`DRBG_GATHER_PAUSE_SECS` Pause, in seconds, between background entropy-thread samples (see `DRBG_ENTROPY_THREAD`).
`static java.lang.String`	`DSA_MAX_SIZE` Upper bound (in bits) on the prime modulus p accepted when validating an imported DSA public key.
`static java.lang.String`	`EMULATE_ORACLE` If set the provider will attempt, where possible, to behave the same way as the oracle one.
`static java.lang.String`	`GCM_ALLOW_SHORT_TAGS` Opt in to short AEAD authentication tags for AES-GCM parameters.
`static java.lang.String`	`JSSE_HOSTNAME_CHECK_CN_FALLBACK` Opt-in to the legacy "use the subject CN as a fallback identifier" behaviour in the BC JSSE provider's hostname verifier.
`static java.lang.String`	`PBE_MAX_ITERATION_COUNT` Upper bound on the PBKDF2 iteration count honoured when decrypting a PBES2-protected PKCS#8 / PEM private key.
`static java.lang.String`	`PBE_MAX_SCRYPT_MEMORY` Upper bound, in bytes, on the scrypt working memory (~128 * N * r) honoured when decrypting a PBES2-protected PKCS#8 / PEM private key.
`static java.lang.String`	`PKCS1_STRICT_DIGESTINFO` If set to "true", RSA PKCS#1 v1.5 signature verification rejects DigestInfo encodings whose AlgorithmIdentifier omits the `NULL` parameters octets required by RFC 8017 sec. 9.2 / Appendix A.2.4.
`static java.lang.String`	`PKCS12_ALLOW_SUN_SECRET_KEYS` If set to "true", the BC PKCS#12 KeyStore will additionally accept (on load only) SafeBags of type secretBag that use SunJCE's non-standard nested encoding — a SecretBag whose secretTypeId is pkcs8ShroudedKeyBag and whose secretValue is an EncryptedPrivateKeyInfo wrapping a PKCS#8 PrivateKeyInfo carrying the raw secret-key bytes.
`static java.lang.String`	`PKCS12_IGNORE_USELESS_PASSWD` A PKCS12 file which does not require a password will normally throw an exception if a password is provided.
`static java.lang.String`	`PKCS12_MAX_IT_COUNT` If set, a PKCS12 file with a larger iteration count on PBE processing will rejected.
`static java.lang.String`	`PKMAC_MAX_ITERATION_COUNT` Upper bound on the RFC 4211 PKMAC / CMP password-based-MAC iteration count honoured when no explicit ceiling was supplied to `org.bouncycastle.cert.crmf.PKMACBuilder`.
`static java.lang.String`	`X509_ALLOW_LENIENT_RFC822_NAME` Fall back to the legacy lenient parsing of rfc822Name values in X.509 name-constraint checks.
`static java.lang.String`	`X509_CRL_CACHE_TTL` Maximum time, in seconds, that a downloaded CRL is cached by the internal CrlCache used by the CertPath validator and X509RevocationChecker.
`static java.lang.String`	`X509_ENABLE_CRLDP` If set to "true", the BC CertPath validator and X509RevocationChecker will attempt to download CRLs over the network using URIs from each certificate's CRL Distribution Points extension when no PKIXCRLStore on the supplied PKIXParameters can satisfy the lookup.
`static java.lang.String`	`X509_MAX_POLICY_NODES` Upper bound on the total number of valid-policy-tree nodes retained (across all depth levels) during PKIX certification-path validation.
`static java.lang.String`	`X509_SGP22_NAME_CONSTRAINTS` Opt in to the relaxed directoryName name-constraint matching required by GSMA SGP.22 v2.5 (Remote SIM Provisioning), sections 4.5.2.1.0.2 / 4.5.2.1.0.3.

Method Summary

All Methods Static Methods Concrete Methods
Modifier and Type	Method and Description
`static java.math.BigInteger`	`asBigInteger(java.lang.String propertyName)` Return propertyName as a BigInteger.
`static int`	`asInteger(java.lang.String propertyName, int defaultValue)` Return propertyName as an integer, defaultValue used if not defined.
`static java.util.Set<java.lang.String>`	`asKeySet(java.lang.String propertyName)`
`static java.lang.String`	`getPropertyValue(java.lang.String propertyName)` Return the String value of the property propertyName.
`static java.lang.String`	`getPropertyValue(java.lang.String propertyName, java.lang.String defValue)`
`static boolean`	`isOverrideSet(java.lang.String propertyName)` Return whether a particular override has been set to true.
`static boolean`	`isOverrideSet(java.lang.String propertyName, boolean defIsTrue)` Return whether a particular override has been set to true.
`static boolean`	`isOverrideSetTo(java.lang.String propertyName, boolean isTrue)` Return whether a particular override has been set to false.
`static boolean`	`removeThreadOverride(java.lang.String propertyName)` Remove any value for the specified override property for the current thread only.
`static boolean`	`setThreadOverride(java.lang.String propertyName, boolean enable)` Enable the specified override property for the current thread only.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - EMULATE_ORACLE
```
public static final java.lang.String EMULATE_ORACLE
```
    If set the provider will attempt, where possible, to behave the same way as the oracle one.
    
    See Also:
    
    Constant Field Values
  - PKCS12_IGNORE_USELESS_PASSWD
```
public static final java.lang.String PKCS12_IGNORE_USELESS_PASSWD
```
    A PKCS12 file which does not require a password will normally throw an exception if a password is provided. Setting PKCS12_IGNORE_USELESS_PASSWD to "true" will result in the provider ignoring a password if one is provided and not required.
    
    See Also:
    
    Constant Field Values
  - PKCS12_MAX_IT_COUNT
```
public static final java.lang.String PKCS12_MAX_IT_COUNT
```
    If set, a PKCS12 file with a larger iteration count on PBE processing will rejected.
    
    See Also:
    
    Constant Field Values
  - X509_CRL_CACHE_TTL
```
public static final java.lang.String X509_CRL_CACHE_TTL
```
    Maximum time, in seconds, that a downloaded CRL is cached by the internal CrlCache used by the CertPath validator and X509RevocationChecker. When set to a positive value, cached entries are evicted whichever expires sooner: the configured TTL or the CRL's own nextUpdate. Default (or 0) preserves the legacy behaviour of evicting only when nextUpdate has passed.
    
    See Also:
    
    Constant Field Values
  - X509_ENABLE_CRLDP
```
public static final java.lang.String X509_ENABLE_CRLDP
```
    If set to "true", the BC CertPath validator and X509RevocationChecker will attempt to download CRLs over the network using URIs from each certificate's CRL Distribution Points extension when no PKIXCRLStore on the supplied PKIXParameters can satisfy the lookup. Default (unset / "false") preserves the legacy behaviour of relying entirely on caller-supplied CertStore / PKIXCRLStore registrations — "No CRLs found for issuer ..." is the result when the caller hasn't registered a store and this property is off.
    
    See Also:
    
    Constant Field Values
  - PKCS12_ALLOW_SUN_SECRET_KEYS
```
public static final java.lang.String PKCS12_ALLOW_SUN_SECRET_KEYS
```
    If set to "true", the BC PKCS#12 KeyStore will additionally accept (on load only) SafeBags of type secretBag that use SunJCE's non-standard nested encoding — a SecretBag whose secretTypeId is pkcs8ShroudedKeyBag and whose secretValue is an EncryptedPrivateKeyInfo wrapping a PKCS#8 PrivateKeyInfo carrying the raw secret-key bytes. Off by default; the BC keystore always writes the standards compliant RFC 7292 sec. 4.2.5 form regardless.
    
    See Also:
    
    Constant Field Values
  - PKCS1_STRICT_DIGESTINFO
```
public static final java.lang.String PKCS1_STRICT_DIGESTINFO
```
    If set to "true", RSA PKCS#1 v1.5 signature verification rejects DigestInfo encodings whose AlgorithmIdentifier omits the NULL parameters octets required by RFC 8017 sec. 9.2 / Appendix A.2.4. By default (or "false") the verifier falls back to accepting that two-byte-shorter encoding for compatibility with implementations that have historically produced it; setting this property to "true" disables the fallback so only strictly RFC-compliant signatures verify (github #2273). Affects both the BC JCE provider's DigestSignatureSpi and the lightweight RSADigestSigner.
    
    See Also:
    
    Constant Field Values
  - JSSE_HOSTNAME_CHECK_CN_FALLBACK
```
public static final java.lang.String JSSE_HOSTNAME_CHECK_CN_FALLBACK
```
    Opt-in to the legacy "use the subject CN as a fallback identifier" behaviour in the BC JSSE provider's hostname verifier. When the property is set to "true", a TLS server certificate that carries no SAN dNSName entries falls back to the most specific commonName attribute of the subject DN — this matches SunJSSE and historical OpenSSL behaviour.
    Default ("false" / unset) follows RFC 9525 sec. 6.3 (which deprecates CN-based identity for TLS) and CAB Forum Baseline Requirements 7.1.4.2 (which requires SAN dNSName entries for publicly-trusted TLS server certs). It also closes a Name-Constraint bypass surface (the 2026-03 cross-implementation X.509 audit): a constrained intermediate CA can omit dNSName SAN entries entirely so the path validator's Name-Constraint dNSName checks never fire, then embed an attacker-controlled hostname in CN — the JSSE verifier would have accepted the connection. Setting the property "false" (or leaving it unset) disables this fallback path and the JSSE verifier rejects any cert that doesn't carry a matching SAN identifier.
    
    See Also:
    
    Constant Field Values
  - DRBG_EFFECTIVE_256BITS_ENTROPY
```
public static final java.lang.String DRBG_EFFECTIVE_256BITS_ENTROPY
```
    Effective bits-of-entropy assumed per real bit when the BC DRBG provider seeds for a 256-bit security level — used to compute the byte-oriented samples requested from the underlying entropy source. Defaults to 282 bits (about 0.9 effective bits per raw bit) and is rounded up to the next whole byte.
    
    See Also:
    
    Constant Field Values
  - DRBG_ENTROPY_SOURCE
```
public static final java.lang.String DRBG_ENTROPY_SOURCE
```
    Fully-qualified name of an EntropySourceProvider class to use as the BC DRBG provider's seed source. When set, the named class is loaded reflectively and instantiated in place of the platform default. When unset, the BC DRBG falls back to the configured securerandom.source or its own background entropy thread.
    
    See Also:
    
    Constant Field Values
  - DRBG_ENTROPY_THREAD
```
public static final java.lang.String DRBG_ENTROPY_THREAD
```
    If set to "true", the BC DRBG provider runs a background thread that samples the platform entropy source on a fixed schedule and feeds the DRBG, rather than blocking on a fresh sample at each reseed.
    
    See Also:
    
    Constant Field Values
  - DRBG_GATHER_PAUSE_SECS
```
public static final java.lang.String DRBG_GATHER_PAUSE_SECS
```
    Pause, in seconds, between background entropy-thread samples (see DRBG_ENTROPY_THREAD). Parsed as an integer; absent or non-positive values use the implementation default.
    
    See Also:
    
    Constant Field Values
  - ASN1_ALLOW_NON_DER_TIME
```
public static final java.lang.String ASN1_ALLOW_NON_DER_TIME
```
    Controls whether an ASN.1 UTCTime / GeneralizedTime carrying non-DER contents may be serialized through a DEROutputStream. Reading is always lenient: a wire value that is valid ASN.1 but not valid DER - for example a UTCTime without the seconds element ("YYMMDDHHMMZ"), a time terminated with a "+hhmm"/"-hhmm" offset rather than "Z", or a GeneralizedTime fraction carrying trailing zeros - parses without complaint into a usable ASN1UTCTime / ASN1GeneralizedTime.
    Default (unset or "true") preserves BC's historical pass-through: such a primitive may be re-emitted unchanged via either BER or DER. Setting this property to "false" enforces the DER restrictions of X.690 sec. 11.7 / 11.8 (and hence the RFC 5280 sec. 4.1.2.5 profile, which requires seconds and Zulu) on the DER write side: the primitive's toDERObject() throws an IllegalStateException if it would emit non-conformant content, so any attempt to write it to a DEROutputStream fails (github #1973 / #1986). BER serialization is unaffected. Programmatically constructing a time from a Date always produces DER content, so this setting only matters for primitives whose contents arrived non-conformant from the wire.
    
    See Also:
    
    Constant Field Values
  - ASN1_MAX_CONS_DEPTH
```
public static final java.lang.String ASN1_MAX_CONS_DEPTH
```
    Maximum depth of nested constructed ASN.1 objects the parser will descend before failing with "maximum nested construction level reached", guarding against stack exhaustion from deeply nested crafted input. Read as an integer; default 64.
    
    See Also:
    
    Constant Field Values
  - ASN1_MAX_LIMIT
```
public static final java.lang.String ASN1_MAX_LIMIT
```
    Overrides the maximum length accepted for a single definite-length ASN.1 object read from a stream whose length is not otherwise known. The value is a byte count and may carry a trailing 'k', 'm' or 'g' multiplier (e.g. "16m"); when unset the limit falls back to the available heap size. Can also be set per stream via the ASN1InputStream(InputStream, int) constructor.
    
    See Also:
    
    Constant Field Values
  - DH_MAX_SIZE
```
public static final java.lang.String DH_MAX_SIZE
```
    Upper bound (in bits) on the prime modulus p accepted when validating an imported Diffie-Hellman public key. Validation performs a modular exponentiation / Legendre computation whose cost is super-linear in the size of p, so an unbounded p taken from a crafted key encoding would turn key import into a CPU-exhaustion denial of service. The default (16384) is the analogue of org.bouncycastle.rsa.max_size and is well above any standardised DH group. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - DSA_MAX_SIZE
```
public static final java.lang.String DSA_MAX_SIZE
```
    Upper bound (in bits) on the prime modulus p accepted when validating an imported DSA public key. As with DH_MAX_SIZE, validation runs a modular exponentiation whose cost grows super-linearly in the size of p, so an unbounded p from a crafted encoding is an import-time CPU-exhaustion vector. Default 16384. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - BCFKS_MAX_IT_COUNT
```
public static final java.lang.String BCFKS_MAX_IT_COUNT
```
    Upper bound on the PBKDF2 iteration count honoured when deriving the integrity-MAC key of a BCFKS keystore during load. The KDF runs on parameters taken from the (not-yet-verified) keystore, so an unbounded iteration count is a pre-integrity CPU-exhaustion vector. Default 5,000,000 (the BCFKS writer uses ~51,200). Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - BCFKS_MAX_SCRYPT_MEMORY
```
public static final java.lang.String BCFKS_MAX_SCRYPT_MEMORY
```
    Upper bound, in bytes, on the working memory (~128 * N * r) of the scrypt KDF honoured when deriving the integrity-MAC key of a BCFKS keystore during load. As with BCFKS_MAX_IT_COUNT the scrypt cost parameters are taken from the not-yet-verified keystore, so an unbounded cost is a pre-integrity memory-exhaustion vector. Default 1073741824 (1 GiB); the BCFKS writer uses N=16384, r=8 (~16 MiB). Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - PBE_MAX_ITERATION_COUNT
```
public static final java.lang.String PBE_MAX_ITERATION_COUNT
```
    Upper bound on the PBKDF2 iteration count honoured when decrypting a PBES2-protected PKCS#8 / PEM private key. The key-derivation parameters travel inside the (unauthenticated) encrypted-key container, so an unbounded count makes decrypting attacker-supplied key material a CPU-exhaustion vector. Default 10,000,000, generous enough for deliberately strong settings. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - PBE_MAX_SCRYPT_MEMORY
```
public static final java.lang.String PBE_MAX_SCRYPT_MEMORY
```
    Upper bound, in bytes, on the scrypt working memory (~128 * N * r) honoured when decrypting a PBES2-protected PKCS#8 / PEM private key. As with PBE_MAX_ITERATION_COUNT the scrypt cost travels in the unauthenticated container, so an unbounded cost is a memory-exhaustion vector. Default 1073741824 (1 GiB). Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - PKMAC_MAX_ITERATION_COUNT
```
public static final java.lang.String PKMAC_MAX_ITERATION_COUNT
```
    Upper bound on the RFC 4211 PKMAC / CMP password-based-MAC iteration count honoured when no explicit ceiling was supplied to org.bouncycastle.cert.crmf.PKMACBuilder. The count travels in the (unauthenticated) PBMParameter of an incoming CMP message and drives an iterated hash, so an unbounded count makes verifying an attacker-supplied message a CPU-exhaustion vector. Default 10,000,000, generous enough for any legitimate setting. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - X509_MAX_POLICY_NODES
```
public static final java.lang.String X509_MAX_POLICY_NODES
```
    Upper bound on the total number of valid-policy-tree nodes retained (across all depth levels) during PKIX certification-path validation. Certificate policy mapping combined with the anyPolicy expansion of RFC 5280 6.1.3/6.1.4 can grow the tree multiplicatively per certificate, so a crafted chain that still chains to a trust anchor could drive the validator into exponential memory/CPU consumption -- a denial of service of the class of CVE-2023-0464. The tree size is checked once per certificate and validation is aborted with a CertPathValidatorException once it exceeds this bound. The default (8192) is far above any legitimate policy tree (a real chain produces a handful of nodes) and is configurable for unusual deployments. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
  - X509_SGP22_NAME_CONSTRAINTS
```
public static final java.lang.String X509_SGP22_NAME_CONSTRAINTS
```
    Opt in to the relaxed directoryName name-constraint matching required by GSMA SGP.22 v2.5 (Remote SIM Provisioning), sections 4.5.2.1.0.2 / 4.5.2.1.0.3. When set, a permitted-subtree RDN is satisfied by any matching subject RDN regardless of position, additional subject attributes beyond those named in the subtree are tolerated, and a serialNumber RDN is matched with a startsWith comparison wherever it appears. This is deliberately looser than the contiguous-prefix DN matching mandated by RFC 5280 7.1, so it defaults to off and must be enabled explicitly; BC's default validation remains RFC 5280 strict. See github #2327. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - X509_ALLOW_LENIENT_RFC822_NAME
```
public static final java.lang.String X509_ALLOW_LENIENT_RFC822_NAME
```
    Fall back to the legacy lenient parsing of rfc822Name values in X.509 name-constraint checks. By default the validator is strict about rfc822Name conformance; today that means a tested rfc822Name with more than one '@' is rejected as ambiguous when email constraints apply (RFC 5321 sec. 4.1.2 allows '@' inside a quoted local part, so the domain is not simply the text after the first '@', and a wrong split could evade a constraint). When this property is set, that strictness (and any future rfc822Name conformance strictness) is disabled and the historical permissive parsing is used instead. Strict is the default; set this only to restore the old behaviour. This is a safety valve, not a recommended mode. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - GCM_ALLOW_SHORT_TAGS
```
public static final java.lang.String GCM_ALLOW_SHORT_TAGS
```
    Opt in to short AEAD authentication tags for AES-GCM parameters. RFC 5084 constrains the AES-GCM ICV (tag) length carried in GCMParameters to 12..16 octets (96..128 bits), and BC enforces that by default. When this property is set, GCMParameters additionally accepts tags down to the NIST SP 800-38D minimum of 4 octets (32 bits; SP 800-38D sec. 5.2.1.2 permits a 32-bit tag for limited applications). Short tags weaken integrity protection, so this defaults to off and must be enabled explicitly; anything below 4 octets or above 16 octets is still rejected. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - BKS_ENABLE_V1
```
public static final java.lang.String BKS_ENABLE_V1
```
    Opt in to handling legacy version 0/1 BKS keystores. Those stores derive the HMAC integrity key at only the digest size in bits (a 16-bit key for SHA-1; CVE-2018-5382), which is brute-forceable offline, so by default the default BKS keystore type refuses to load them and only writes the current version 2 format. Set this property to read or create the weak legacy format (e.g. to migrate an old store); it also gates registration of the separate BKS-V1 keystore type. Read via isOverrideSet(String).
    
    See Also:
    
    Constant Field Values
  - BKS_MAX_IT_COUNT
```
public static final java.lang.String BKS_MAX_IT_COUNT
```
    Upper bound on the PKCS#12-PBE iteration count honoured when loading a BKS keystore. The count drives the integrity-MAC key derivation in BcKeyStoreSpi.engineLoad (and the per-entry sealed-key decryption), and is read from the (not-yet-verified) keystore ahead of the HMAC integrity check, so an unbounded value is a pre-integrity CPU-exhaustion vector - the analogue of BCFKS_MAX_IT_COUNT / PKCS12_MAX_IT_COUNT for the BKS format (the sibling UBER store already caps its own count). Default 1048576 (1 << 20); the BKS writer uses ~1024-2047. Read via asInteger(String, int).
    
    See Also:
    
    Constant Field Values
- Method Detail
  - isOverrideSet
```
public static boolean isOverrideSet(java.lang.String propertyName)
```
    Return whether a particular override has been set to true.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    Returns:
    
    true if the property is set to "true", false otherwise.
  - isOverrideSet
```
public static boolean isOverrideSet(java.lang.String propertyName,
                                    boolean defIsTrue)
```
    Return whether a particular override has been set to true.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    Returns:
    
    true if the property is set to "true", false otherwise.
  - isOverrideSetTo
```
public static boolean isOverrideSetTo(java.lang.String propertyName,
                                      boolean isTrue)
```
    Return whether a particular override has been set to false.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    isTrue - true if the override should be true, false otherwise.
    
    Returns:
    
    true if the property is set to the value of isTrue, false otherwise.
  - setThreadOverride
```
public static boolean setThreadOverride(java.lang.String propertyName,
                                        boolean enable)
```
    Enable the specified override property for the current thread only.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    enable - true if the override should be enabled, false if it should be disabled.
    
    Returns:
    
    true if the override was already set true, false otherwise.
  - removeThreadOverride
```
public static boolean removeThreadOverride(java.lang.String propertyName)
```
    Remove any value for the specified override property for the current thread only.
    
    Parameters:
    
    propertyName - the property name for the override.
    
    Returns:
    
    true if the override was already set true in thread local, false otherwise.
  - asInteger
```
public static int asInteger(java.lang.String propertyName,
                            int defaultValue)
```
    Return propertyName as an integer, defaultValue used if not defined.
    
    Parameters:
    
    propertyName - name of property.
    
    defaultValue - integer to return if property not defined.
    
    Returns:
    
    value of property, or default if not found, as an int.
  - asBigInteger
```
public static java.math.BigInteger asBigInteger(java.lang.String propertyName)
```
    Return propertyName as a BigInteger.
    
    Parameters:
    
    propertyName - name of property.
    
    Returns:
    
    value of property as a BigInteger, null if not defined.
  - asKeySet
```
public static java.util.Set<java.lang.String> asKeySet(java.lang.String propertyName)
```
  - getPropertyValue
```
public static java.lang.String getPropertyValue(java.lang.String propertyName)
```
    Return the String value of the property propertyName. Property valuation starts with java.security, then thread local, then system properties.
    
    Parameters:
    
    propertyName - name of property.
    
    Returns:
    
    value of property as a String, null if not defined.
  - getPropertyValue
```
public static java.lang.String getPropertyValue(java.lang.String propertyName,
                                                java.lang.String defValue)
```

Class Properties

Field Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

EMULATE_ORACLE

PKCS12_IGNORE_USELESS_PASSWD

PKCS12_MAX_IT_COUNT

X509_CRL_CACHE_TTL

X509_ENABLE_CRLDP

PKCS12_ALLOW_SUN_SECRET_KEYS

PKCS1_STRICT_DIGESTINFO

JSSE_HOSTNAME_CHECK_CN_FALLBACK

DRBG_EFFECTIVE_256BITS_ENTROPY

DRBG_ENTROPY_SOURCE

DRBG_ENTROPY_THREAD

DRBG_GATHER_PAUSE_SECS

ASN1_ALLOW_NON_DER_TIME

ASN1_MAX_CONS_DEPTH

ASN1_MAX_LIMIT

DH_MAX_SIZE

DSA_MAX_SIZE

BCFKS_MAX_IT_COUNT

BCFKS_MAX_SCRYPT_MEMORY

PBE_MAX_ITERATION_COUNT

PBE_MAX_SCRYPT_MEMORY

PKMAC_MAX_ITERATION_COUNT

X509_MAX_POLICY_NODES

X509_SGP22_NAME_CONSTRAINTS

X509_ALLOW_LENIENT_RFC822_NAME

GCM_ALLOW_SHORT_TAGS

BKS_ENABLE_V1

BKS_MAX_IT_COUNT

Method Detail

isOverrideSet

isOverrideSet

isOverrideSetTo

setThreadOverride

removeThreadOverride

asInteger

asBigInteger

asKeySet

getPropertyValue

getPropertyValue