JVM debugging

Verbose everything

Network, TLS handshake, cert chain, session resumption. Useful for “the connection just hangs / fails” diagnostics, very noisy:

JAVA_OPTS="$JAVA_OPTS -Djavax.net.debug=all"

TLS handshake only

Most of the time you only want the handshake — much less noise:

JAVA_OPTS="$JAVA_OPTS -Djavax.net.debug=ssl:handshake:verbose"

Common TLS knobs (JDK 21+)

When the handshake fails on a modern JDK (TLS 1.3 by default):

# Force TLS 1.2 only — quickly rules out a 1.3-specific issue.
-Djdk.tls.client.protocols=TLSv1.2

# Restrict the curves offered in the ClientHello (some middleboxes drop
# unexpected curves). Default in JDK 21+ includes x25519, secp256r1, etc.
-Djdk.tls.namedGroups="secp256r1,secp384r1"

Re-enabling a disabled algorithm

The disabled-algorithm list lives in $JAVA_HOME/conf/security/java.security under jdk.tls.disabledAlgorithms. Read it before overriding so you know what you are re-enabling.

Caution

jdk.tls.disabledAlgorithms is a security property, not a system property — -Djdk.tls.disabledAlgorithms=... on the command line is silently ignored. Override it with a properties file instead:

tls-override.properties

jdk.tls.disabledAlgorithms=

java -Djava.security.properties=tls-override.properties -jar app.jar

One = merges the file over java.security, overriding only the properties you list. Two (-Djava.security.properties==...) discard the master file entirely — almost never what you want, since it drops every other security default with it.

This is for one-off diagnostics only. Do not ship it.