OpenSSL security provider seems to be used when not defined with JDK8 now ------------------------------------------------------------------------- Key: WFWIP-339 URL: https://issues.redhat.com/browse/WFWIP-339 Project: WildFly WIP Issue Type: Bug Components: Security Reporter: Jan Stourac Assignee: Farah Juma Priority: Major Attachments: client.jks, server.jks, standalone-full.xml It looks like the OpenSSL security provider is now used as a default when I configure reverse-proxy feature on the server. Not sure what is the root-cause for this change of behavior. I also see this change of behavior only with JDK8. JDK11 works as expected! Attaching relevant configuration. There can be also seen that during the startup, relevant log message about OpenSSL provider is logged during the server boot, e.g.: {quote} 16:44:42,676 INFO [org.wildfly.openssl.SSL] (MSC service thread 1-3) WFOPENSSL0002 OpenSSL Version OpenSSL 1.0.2h-fips 3 May 2016 {quote} This INFO message starts to occur in the server log since 'server-ssl-context' or 'client-ssl-contexts' are added into the server configuration and server is started with JDK8: {code} <server-ssl-contexts> <server-ssl-context name="server-ssl-context" need-client-auth="true" key-manager="server-ssl-contextKM" trust-manager="server-ssl-contextTM"/> </server-ssl-contexts> <client-ssl-contexts> <client-ssl-context name="proxy-ssl-context" key-manager="proxy-ssl-contextKM" trust-manager="proxy-ssl-contextTM"/> </client-ssl-contexts> {code} There are two questions from this: # Is this change of OpenSSL provider being initialized during the boot in this configuration case expected? # I believe that even in case that answer to question above is `yes`, then we should not change default security provider, which in this case it should be JSSE. Not to mention that we don't want to behave differently for JDK8 and JDK11. Hope I don't have any misconfiguration in the configuration itself.