java.security.debug

To monitor security access, you can set the java.security.debug system property, which determines what trace messages are printed during execution. The value of the property is one or more options separated by a comma. Each trace message includes the thread id, caller information, and timestamp.

The following table lists the java.security.debug options:

Security Debug Options
Option Description
all Turn on all the debugging options
certpath Turns on debugging for the PKIX CertPathValidator and CertPathBuilder implementations. The following sub-options can be used with the certpath option:
  • ocsp: Dump OCSP protocol exchanges
  • verbose: A hexadecimal dump of the OCSP request and response bytes is displayed.
configfile JAAS (Java Authentication and Authorization Service) configuration file loading
configparser JAAS configuration file parsing
gssloginconfig Java GSS (Generic Security Services) login configuration file debugging
jar JAR file verification
jca JCA engine class debugging
KeyStore KeyStore debugging
logincontext LoginContext results
pcsc Java Smart Card I/O and SunPCSC provider debugging
pkcs11 PKCS11 session manager debugging
pkcs11keystore PKCS11 KeyStore debugging
pkcs12 PKCS12 KeyStore debugging
properties java.security configuration file debugging
provider Security provider debugging. The following sub-option can be used with the provider option: engine=(engines) : The output is displayed only for a specified list of one or more JCA engines, separated by a comma. The supported values for (engines) are:
  • Cipher
  • KDF
  • KeyAgreement
  • KeyGenerator
  • KeyPairGenerator
  • KeyStore
  • Mac
  • MessageDigest
  • SecureRandom
  • Signature
securerandom SecureRandom debugging
sunpkcs11 SunPKCS11 provider debugging
ts Timestamping debugging
x509 X.509 certificate debugging. The following sub-option can be used with the X.509 option.
  • ava: Embed non-printable/non-escaped characters in AVA components as hex strings