update the security hardening doc to recommend to use the PKIX

[ramkumar-k-9286]

Please describe the problem you are having with the documentation. Is information missing, inaccurate, or unclear? Tell us about the context where you encountered the problem so we can understand how to address it.

For context, please check WL issue: https://github.ibm.com/websphere/liberty-docs/issues/4556

utle commented on Dec 11, 2025
Hi @Ramkumar-K
We also need to update the security hardening doc to recommend to use the PKIX
https://openliberty.io/docs/latest/security-hardening.html

[ramkumar-k-9286]

Hi @utle

I was looking at the page: https://openliberty.io/docs/latest/security-hardening.html

This page acts as a hub that links to three detailed child pages:

• Server configuration
• Network
• Application configuration

I think any update I make should be in the TLS connectivity section.

Do you agree?

Also..

The content I was planning to add in this section:

Recommendation: Use the PKIX algorithm for key and trust manager factories

Open Liberty supports both the PKIX and SunX509 algorithms. For better security, use PKIX, as it provides enhanced certificate validation based on modern industry standards.

Starting in Open Liberty 25.0.0.12, you can explicitly set these algorithms in your server.xml file:

<ssl id="defaultSSLConfig" 
     keyManagerFactoryAlgorithm="PKIX" 
     trustManagerFactoryAlgorithm="PKIX" />

Regards,
Ramkumar.

[utle]

I agreed with your suggestion. But the example is not right:

Starting in Open Liberty 25.0.0.12, you can explicitly set these algorithms in your server.xml file:

<ssl id="defaultSSLConfig" 
     keyManagerFactoryAlgorithm="PKIX" 
     trustManagerFactoryAlgorithm="PKIX" />

The only way to configure the PKIX is in the java.security file.

Starting in Open Liberty 25.0.0.12, you can configure PKIX algorithms in the JDK java.security file

[ramkumar-k-9286]

Update - incorporating your comment:

Recommendation: Use the PKIX algorithm for key and trust manager factories

Open Liberty supports both the PKIX and SunX509 algorithms. For better security, use PKIX, as it provides enhanced certificate validation based on modern industry standards.

Starting in Open Liberty 25.0.0.12, you can configure Liberty to use the PKIX algorithm by setting it in the JDK java.security file:

ssl.KeyManagerFactory.algorithm=PKIX
ssl.TrustManagerFactory.algorithm=PKIX

[ramkumar-k-9286]

Hi @utle

As discussed, I have made the update to the Network security hardening page.

Draft link: https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/network-hardening.html#tls

Please review and add the Developer Reviewed label if you are satisfied with the changes.

Regards,
Ramkumar.