RELEASE NOTES: JDK 11.0.30

Disabled TLS_RSA Cipher Suites

The TLSRSA cipher suites have been disabled by default, by adding "TLSRSA_" to the jdk.tls.disabledAlgorithms security property in the java.security configuration file. The TLSRSA cipher suites do not preserve forward-secrecy and are not commonly used. Some TLSRSA cipher suites are already disabled because they use DES, 3DES, RC4, or NULL, which are disabled. This action disables all remaining TLSRSA cipher suites. Any attempts to use cipher suites starting with "TLSRSA" will fail with an SSLHandshakeException. Users can, at their own risk, re-enable these cipher suites by removing "TLSRSA_" from the jdk.tls.disabledAlgorithms security property. The following previously enabled cipher suites are now disabled:

TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA

Mechanism to Disable TLS Cipher Suites by Pattern Matching

TLS cipher suites can be disabled with the jdk.tls.disabledAlgorithms security property in the java.security configuration file using one or more * wildcard characters. For example, "TLSRSA*" disables all cipher suites that start with "TLSRSA". Only cipher suites starting with "TLS_" are allowed to have wildcard characters.

Disable "best-fit" Mapping on Windows Command Line

Command line arguments to the Java launcher are no longer converted with Windows' "best-fit" mapping when the arguments include unmappable characters for the ANSI code page. This mapping has been intervening in the Java launcher's argument parsing. Unmappable characters are now replaced with the default replacement character, such as '?' in some cases. For rare cases, where applications need those unmappable characters on the command line, select UTF-8 in Windows Regional Settings.

Print 'rss' and 'cache' As Part of the Container Information

The HotSpot runtime code has been updated to additionally print a container's 'rss' and 'cache'. The additional output can be found in the JVM's response to a "jcmd [PID] VM.info" request and in the hs_err file generated in case of JVM abrupt termination.

This will help monitoring and troubleshooting OutOfMemory situations as OOM killer can terminate a process if its rss + cache usage reaches the max memory limit of the container.