原文地址:https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.tec1698523.html

Introduction/Summary: 

The base Java JVM and SDK installs from Oracle are limited in strength for the cryptographic functions that they can perform.  Oracle also provide a patch the "Java  JCE Unlimited Strength Jurisdiction Policy Files" patch which when applied to the base JDK or JVM install allows for unlimited strength cryptographic functions.

Background:  

Although the patch is a simple zip file there are often problems associated with installing it and installing it in the right location.  This article covers how to do the install of the patch, and also some of the mis-install pitfalls that can occur.

Environment:  

all (windows, linux, solaris)

Instructions: 

  1. Have an existing Java JRE or JDK Installation. 
    First you will need a Java, either the Java Runtime (JVM) or the Java Development KIt (JDK) installation. 
    Many of the Siteminder (SSO) components require a specific 32bit rather than a 64bit version of the JDK/JRE so it is worth verifying you have the correct one installed.
  2. Download the "JCE Unlimited Strength Jurisdiction Policy Files" 
    The "JCE Unlimited Strength Jurisdiction Policy Files" are available as a .zip file from :

    http://www.oracle.com/technetwork/java/javase/downloads/index.html

    Only the version is applicable (ie., the one jce_policy-8.zip applies to both the 32bit and 64bit editions of java 8 ) .

    The version of the Jurisdiction file depends on the version of Java you have installed, as per:

    • Java 8 : jce_policy-8.zip
    • Java 7 : UnlimitedJCEPolicyJDK7.zip
    • Java 6 : jce-policy-6.zip
    • etc.
  3. The contents of the  .zip file:

    The zip file contain two jar files : local_policy.jar, US_export_policy.jar a README.txt and a COPYRIGHT.html file


     
    The two .jar files are the important ones.

  4. Determine the version of java to install the .jar files 

    We need to apply these .jar files into the actual JDK that is being run.

    As well as 64bit and 32bit version of java, appearing under directories C:\Program Files\Java and C:\Program Files (x86)\  respectively, a user may also have several minor versions of java installed and both JRE and JDK's installed.   The same is true of Unix/Linux installs as well.

    Note: There are two directories, both a JDK and a JRE directory:  jdk1.6.0_37 and jre6 both have an embedded jre and it is good policy to update both. 
    Note2: There can also be several JDK/JRE versions installed - not necessarily in the expected directories.

    Technically we only need to update the one that we are going to run, but it is good policy to update both the JDK and JRE, and a number of support cases have been solved because the JDK/JRE version being run was not the expected one, and solved once the correct version was updated.

    Below we cover updating the JDK and the JRE. 
     

  5. Update the distribution policy  .jar files in the JDK distribution.

    We need to copy the two .jar files from the "JCE Unlimited Strength Jurisdiction Policy Files" zip file, and replace the ones in the JDK distribution of the JRE. : /jdk1.6.0_37/jre/lib/security directories.

    Note: Make sure you replace the .jar files.  There have been cases where the .zip file was uncompressed from the cmd line, and the new  .jar files were left in a sub-directory, rather than replacing the existing ones. This can easily be done on unix systems. 

  6. Update the distribution policy  .jar files in the JRE distribution.

    We need to copy the two .jar files from the "JCE Unlimited Strength Jurisdiction Policy Files" zip file, and replace the ones in the distribution for the JRE distribution  /jre6/lib/security directories.

  7. How can I check they have been installed correctly?

    Fails with Strong Crypto operations:
    If it is not correctly installed the main problem will be that strong cryptography will be disabled usually giving an error when you want to use it.

    Add -verbose to java startup:
    If you add "-verbose" to the java startup printed to stdout will be a list of the absolute path to the .jar file where it loads each .class file.  This is also useful to determine which JDK/JRE is actually loaded, so you can ensure you've patched the right version.

    Some programs will also check at their startup and tell you if Unlimited Cryptography  is available.

  8. Program to Check if installed Correctly

    Attached to this article is a simple java program that will check if unlimited strength cryptography is enabled.  The core function is as follows:

    Where it gets the max length of the key allowed for AES encryption and compares that to the unlimited number (Integer.MAX_VALUE).

Additional Information:

Within CA Single Sign On, as well as install of the "Unlimited Strength Jurisdiction Policy Files" there can be issued with installing the RSA JSafe components cryptoj.jar and cryptoJFIPS.jar - these will be the topic of another knowledge base article.

Resolving Problems installing the Java JCE Unlimited Strength Jurisdiction Policy Files package--转的更多相关文章

  1. JAVA刚碰见的问题( java.lang.SecurityException: The jurisdiction policy files are not signed by a trusted signer)

    原文:刚碰见的问题 1.  failed to load the jni shared library jre bin server jvm.dll 解决:这个主要是eclipse的版本和安装的jdk ...

  2. 安装 Java Cryptography Extension (JCE) Unlimited Strength

    http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html cp ./* /usr/java/ ...

  3. java程序后台报错java.net.SocketException: Too many open files

    问题描述: 今天一个同事反映程序有问题,让帮忙查看后台日志,发现后台日志报错的信息如下: java.net.SocketException: Too many open files at java.n ...

  4. 转:JAVA.NET.SOCKETEXCEPTION: TOO MANY OPEN FILES解决方法

    最近随着网站访问量的提高把web服务器移到linux下了,在移服务器的第二天,tomcat频繁的报 java.net.SocketException: Too many open files错误,错误 ...

  5. java.io.IOException: Too many open files

    1.描述: 每日一样,例行打开hadoop集群的cloudera manager的管理界面.发现出现了多个bad health的服务.那么出现的这个问题就是查看该服务运行的日志,对应的该服务当中,会包 ...

  6. java 文件操作(二)---Files和Path

    自从java 7以来,引入了FIles类和Path接口.他们两封装了用户对文件的所有可能的操作,相比于java 1的File类来说,使用起来方便很多.但是其实一些本质的操作还是很类似的.主要需要知道的 ...

  7. 高并发连接导致打开文件过多:java.io.IOException: Too many open files 解决方法

    用 CentOS 做 API 接口服务器供其他终端调用时,并发量高会报错:java.io.IOException: Too many open files. 其原因是在 Linux 下默认的Socke ...

  8. Java之旅_面向对象_包(Package)

    http://www.runoob.com/java/java-package.html 包的作用: 1.把功能相似或相关的类或接口组织在同一个包中,方便类的查找和使用. 2.如同文件夹一样,包也采用 ...

  9. 异常:java.io.IOException: Too many open files:

    原因: 操作系统的中打开文件的最大句柄数受限所致,常常发生在很多个并发用户访问服务器的时候.因为为了执行每个用户的应用服务器都要加载很多文件(new一个socket就需要一个文件句柄),这就会导致打开 ...

随机推荐

  1. USACO 2.1 Sorting a Three-Valued Sequence

    Sorting a Three-Valued Sequence IOI'96 - Day 2 Sorting is one of the most frequently performed compu ...

  2. 自定义view 之多个引导层动画效果

    SupernatantView 如果我英文还可以的话这个应该叫做漂浮在上层的view---引导层 今天闲来无事看了网上的一些引导层案例总感觉如果不是很舒服,就是类似于很死板的显示和消失 我在想能不能弄 ...

  3. Oracle自制事务

    数据库事务是一种单元操作,要么全部操作成功,要么全部失败.在Oracle中,一个事务是从执行第一个数据操作语言(DML)语句开始的,直到执行一个COMMIT语句,提交保存事务,或执行一个ROLLBAC ...

  4. LeetCode Golang 单向链表相加 反向实现

    LeetCode 两数之和, 反向实现 1 -> 2 -> 3 -> 4 +                  3 -> 4 ------------------------- ...

  5. Eclipse中切换GIT分支

    切换GIT分支: 右击项目——Team——Switch To——选择你要切换的分支.

  6. 使用jq把js代码封装一个自己的插件

    为什么要把js功能封装成插件呢?我觉得有以下几点吧 1.最基本的原因就是便于代码复用. 2.便于维护和管理. 3.提升自身的能力. 4.避免各个相同功能组件的干扰,以及一些作用域会相互影响的问题. j ...

  7. POJ 3122 Pie( 二分搜索 )

    链接:传送门 题意:一个小朋友开生日派对邀请了 F 个朋友,排队上有 N 个 底面半径为 ri ,高度为 1 的派,这 F 个朋友非常不友好,非得"平分"这些派,每个人都不想拿到若 ...

  8. python3 将两个列表生成一个字典

    需求: 存在两个list如下 list1 = ["one", "two", "three"] list2 = ["1", ...

  9. VUE:条件渲染和列表渲染

    条件渲染 <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <titl ...

  10. CF735E Ostap and Tree

    比较毒瘤的树形DP,子状态难想.这是主要是搬运一篇题解. 用\(f[i][j]\)表示\(i\)的子树中离\(i\)最近黑点的距离为\(j\),且距离超过\(j\)的点都被满足的方案数.转移时新建一个 ...