The Apache Tomcat Native Library 2.0 - Miscellaneous Documentation -

This is the Changelog for Apache Tomcat Native 2.0.x. The Tomcat Native 2.0.x branch started from the 1.2.33 tag.

Refactor the addition of TLS 1.3 cipher suite configuration to avoid a regression when running a version of Tomcat that pre-dates this change. (markt)

The Windows binaries are now built with OCSP support enabled by default. (markt)
Include a nonce with OCSP requests and check the nonce, if any, in the OCSP response. (markt)
Expand verification of OCSP responses. (markt)
Add the ability to configure the OCSP checks to soft-fail - i.e. if the responder cannot be contacted or fails to respond in a timely manner the OCSP check will not fail. (markt)
Add a configurable timeout to the writing of OCSP requests and reading of OCSP responses. (markt)
Add the ability to control the OCSP verification flags. (markt)
Configure TLS 1.3 connections from the provided ciphers list as well as connections using TLS 1.2 and earlier. Pull request provided by gastush. (markt)
Remove out of date options from make file. (markt)
Use automated configuration of DH parameters rather than deprecated callback. (markt)

Fix a crash on Windows when SSLContext.setCACertificate() is invoked with a null value for caCertificateFile and a non-null value for caCertificatePath until properly addressed with https://github.com/openssl/openssl/issues/24416. (michaelo)
Use ERR_error_string_n with a definite buffer length as a named constant. (schultz)
Ensure local reference capacity is available when creating new arrays and Strings. (schultz)
Update the recommended minimum version of OpenSSL to 3.0.14. (markt)

67538: Make use of Ant's <javaversion /> task to enforce the mininum Java build version. (michaelo)
67615: Windows binary for version 2 has incorrect version suffix compared to the GNU autoconf version. (michaelo)
Align default pass phrase prompt with HTTPd on Windows as well. (michaelo)
67616: o.a.tomcat.jni.SSL contains useless check for old OpenSSL version. (michaelo)
Drop useless compile.optimize option. (michaelo)
Align Java source compile configuration with Tomcat. (michaelo)
Add Ant version (1.10.2) requirement identical to Tomcat. (michaelo)
Remove an unreachable if condition around CRLs in sslcontext.c. (michaelo)
67818: When calling SSL.setVerify() or SSLContext.setVerify(), the default verify paths are no longer set. Only the explicitly configured trust store, if any, will be used. (michaelo)
Update the recommended minimum version of OpenSSL to 3.0.13. (markt)

67061: If the insecure optionalNoCA certificate verification mode is used, disable OCSP if enabled else client certificates from unknown certificate authorities will be rejected. (markt)
Update the recommended minimum version of OpenSSL to 3.0.11. (markt)

66666: Remove non-reachable functions from ssl.c. (michaelo)
Align default pass phrase prompt with HTTPd. (michaelo)
Rename configure.in to modern autotools style configure.ac. (rjung)
Fix incomplete updates for autotools generated files during "buildconf" execution. (rjung)
Improve quoting in tcnative.m4. (rjung)
Update the minimum version of autoconf for releasing to 2.68. (rjung)
66669: Fix memory leak in SNI processing. (markt)
Update the recommended minimum version of OpenSSL to 3.0.10. (markt)

Update the minimum supported version of LibreSSL to 3.5.2. Based on pull request #13 provided by orbea. (markt)
Fix build when building with rlibtool. Pull request #14 provided by orbea. (markt)

Update the minimum required version of OpenSSL to 3.0.0 and make it a madatory dependency. (markt)
Update the minimum required version of APR to 1.7.0. (markt)
Remove NPN support as NPN was never standardised and browser support was removed in 2019. (markt)
Add support for using OpenSSL when the FIPS provider is configured as the default provider. (markt)
Remove all API methods (and supporting code) that are not used by Tomcat 10.1.x to support the use of OpenSSL as a replacement for JSSE to provide TLS functionality. (markt)
Document the TLS rengotiation behaviour. (markt)
Update the minimum required Java version to Java 11. (markt)
Remove support for Windows 2000, Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008. The minimum Windows version is now Windows 7 / Windows Server 2008 R2. (markt)
Add HOWTO-RELEASE.txt that describes the release process. (markt)
Fix the autoconf warnings when creating a release. (markt)

Please see the 1.3.x changelog.

Please see the 1.2.x changelog.

Please see the 1.1.x changelog.