<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!DOCTYPE document [
  <!ENTITY project SYSTEM "project.xml">
]>
<?xml-stylesheet type="application/xslt+xml" href="../style.xsl"?>
<document url="changelog.html">

  &project;

<body>

<section name="Preface">
  <p>
  This is the Changelog for Apache Tomcat Native 2.0.x. The Tomcat Native 2.0.x
  branch started from the 1.2.33 tag.
  </p>
</section>
<section name="2.0.14" rtext="">
  <changelog>
    <scode>
      Refactor access to ASN1_OCTET_STRING to use setters to fix errors when
      building against the latest OpenSSL 4.0.x code. (markt)
    </scode>
    <fix>
      Fix the handling of OCSP requests with multiple responder URIs. (jfclere)
    </fix>
    <fix>
      Fix the handling of <code>TRY_AGAIN</code> responses to OCSP requests when
      soft fail is disabled. (jfclere)
    </fix>
  </changelog>
</section>
<section name="2.0.13" rtext="2026-02-11">
  <changelog>
    <scode>
      Due to various refactorings, the 2.0.x code no longer compiles with
      LibreSSL. Without a volunteer to maintain LibreSSL support, the LibreSSL
      code will be removed no earlier than 30 September 2026. (markt)</scode>
    <fix>
      Remove group write permissions from the files in the tar.gz source
      archive. (markt)
    </fix>
    <scode>
      Refactor the SSL_CONF_CTX clean-up to align it with SSL and SSL_CTX
      clean-up. (markt)
    </scode>
    <fix>
      Fix unnecessarily large buffer allocation when filtering out NULL and
      export ciphers. Pull requests <pr>35</pr> and <pr>37</pr> provided by
      chenjp. (markt)
    </fix>
    <fix>
      Fix a potential memory leak if an invalid <code>OpenSSLConf</code> is
      provided. Pull request <pr>36</pr> provided by chenjp. (markt)
    </fix>
    <fix>
      Refactor setting of OCSP configuration defaults as they were only applied
      if the SSL_CONF_CTX was used. While one was always used with Tomcat
      versions aware of the OCSP configuration options, one was not always used
      with Tomcat versions unaware of the OCSP configuration options leading to
      OCSP verification being enabled by default when the expected behaviour was
      disabled by default. (markt)
    </fix>
    <scode>
      Improve performance for the rare case of handling large OCSP responses.
      (markt)
    </scode>
    <fix>
      <bug>69939</bug>: Fix the cause of a crash with OpenSSL 3.0.x when a
      certificate PEM file does not contain explicit DH parameters. (markt)
    </fix>
    <fix>
      Refactor extraction of ECDH curve name from the Certificate to avoid
      deprecated OpenSSL methods.
    </fix>
    <fix>
      Refactor the native implementation of <code>SSL.getTime()</code> to avoid
      the Y2038 problem in <code>SSL_SESSION_get_time()</code> when running on a
      version of OpenSSL that includes the new
      <code>SSL_SESSION_get_time_ex()</code> method. (markt)
    </fix>
  </changelog>
</section>
<section name="2.0.12" rtext="2026-01-12">
  <changelog>
    <fix>
      Refactor the addition of TLS 1.3 cipher suite configuration to avoid a
      regression when running a version of Tomcat that pre-dates this change.
      (markt)
    </fix>
  </changelog>
</section>
<section name="2.0.11" rtext="not released">
  <changelog>
    <fix>
      Fix a reference to an uninitialized variable. (schultz)
    </fix>
    <fix>
      Correct file names and update versions in native build instructions.
      (markt)
    </fix>
    <update>
      Remove references to deprecated engine configuration. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.10" rtext="not released">
  <changelog>
    <update>
      The Windows binaries are now built with OCSP support enabled by default.
      (markt)
    </update>
    <add>
      Include a nonce with OCSP requests and check the nonce, if any, in the
      OCSP response. (markt)
    </add>
    <add>
      Expand verification of OCSP responses. (markt)
    </add>
    <add>
      Add the ability to configure the OCSP checks to soft-fail - i.e. if the
      responder cannot be contacted or fails to respond in a timely manner the
      OCSP check will not fail. (markt)
    </add>
    <add>
      Add a configurable timeout to the writing of OCSP requests and reading of
      OCSP responses. (markt)
    </add>
    <add>
      Add the ability to control the OCSP verification flags. (markt)
    </add>
    <add>
      Configure TLS 1.3 connections from the provided ciphers list as well as
      connections using TLS 1.2 and earlier. Pull request provided by gastush.
      (markt)
    </add>
    <update>
      Remove out of date options from make file. (markt)
    </update>
    <update>
      Use automated configuration of DH parameters rather than deprecated
      callback. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.9" rtext="2025-05-29">
  <changelog>
    <update>
      Update the Windows build environment to use Visual Studio 2022. (markt)
    </update>
    <update>
      Update the recommended minimum version of OpenSSL to 3.5.0. (markt)
    </update>
    <update>
      Update the recommended minimum version of APR to 1.7.6. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.8" rtext="2024-07-24">
  <changelog>
    <fix>
      Fix a crash on Windows when <code>SSLContext.setCACertificate()</code>
      is invoked with a <code>null</code> value for <code>caCertificateFile</code>
      and a non-<code>null</code> value for <code>caCertificatePath</code>
      until properly addressed with
      https://github.com/openssl/openssl/issues/24416. (michaelo)
    </fix>
    <add>
      Use ERR_error_string_n with a definite buffer length as a named constant.
      (schultz)
    </add>
    <add>
      Ensure local reference capacity is available when creating new arrays
      and Strings. (schultz)
    </add>
    <update>
      Update the recommended minimum version of OpenSSL to 3.0.14. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.7" rtext="2024-02-08">
  <changelog>
    <add>
      <bug>67538</bug>: Make use of Ant's <code>&lt;javaversion /&gt;</code>
      task to enforce the mininum Java build version. (michaelo)
    </add>
    <fix>
      <bug>67615</bug>: Windows binary for version 2 has incorrect version
      suffix compared to the GNU autoconf version. (michaelo)
    </fix>
    <update>
      Align default pass phrase prompt with HTTPd on Windows as well. (michaelo)
    </update>
    <fix>
      <bug>67616</bug>: o.a.tomcat.jni.SSL contains useless check for old
      OpenSSL version. (michaelo)
    </fix>
    <update>
      Drop useless <code>compile.optimize</code> option. (michaelo)
    </update>
    <update>
      Align Java source compile configuration with Tomcat. (michaelo)
    </update>
    <add>
      Add Ant version (1.10.2) requirement identical to Tomcat. (michaelo)
    </add>
    <update>
      Remove an unreachable if condition around CRLs in sslcontext.c. (michaelo)
    </update>
    <fix>
      <bug>67818</bug>: When calling <code>SSL.setVerify()</code> or
      <code>SSLContext.setVerify()</code>, the default verify paths are no
      longer set. Only the explicitly configured trust store, if any, will be
      used. (michaelo)
    </fix>
    <update>
      Update the recommended minimum version of OpenSSL to 3.0.13. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.6" rtext="2023-10-02">
  <changelog>
    <fix>
      <bug>67061</bug>: If the insecure optionalNoCA certificate verification
      mode is used, disable OCSP if enabled else client certificates from
      unknown certificate authorities will be rejected. (markt)
    </fix>
    <update>
      Update the recommended minimum version of OpenSSL to 3.0.11. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.5" rtext="2023-08-07">
  <changelog>
    <update>
      <bug>66666</bug>: Remove non-reachable functions from ssl.c. (michaelo)
    </update>
    <update>
      Align default pass phrase prompt with HTTPd. (michaelo)
    </update>
    <update>
      Rename configure.in to modern autotools style configure.ac. (rjung)
    </update>
    <update>
      Fix incomplete updates for autotools generated files during "buildconf" execution. (rjung)
    </update>
    <update>
      Improve quoting in tcnative.m4. (rjung)
    </update>
    <update>
      Update the minimum version of autoconf for releasing to 2.68. (rjung)
    </update>
    <fix>
      <bug>66669</bug>: Fix memory leak in SNI processing. (markt)
    </fix>
    <update>
      Update the recommended minimum version of OpenSSL to 3.0.10. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.4" rtext="not released">
  <changelog>
    <update>
      Update the recommended minimum version of APR to 1.7.4. (markt)
    </update>
    <update>
      Update the recommended minimum version of OpenSSL to 3.0.9. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.3" rtext="2023-02-13">
  <changelog>
    <update>
      Update the recommended minimum version of APR to 1.7.2. (markt)
    </update>
    <update>
      Update the recommended minimum version of OpenSSL to 3.0.8. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.2" rtext="2022-11-08">
  <changelog>
    <update>
      Update the minimum supported version of LibreSSL to 3.5.2. Based on pull
      request <pr>13</pr> provided by orbea. (markt)
    </update>
    <fix>
      Fix build when building with rlibtool. Pull request <pr>14</pr> provided
      by orbea. (markt)
    </fix>
  </changelog>
</section>

<section name="2.0.1" rtext="2022-07-12">
  <changelog>
    <update>
      Update recommended OpenSSL version to 3.0.5 or later. (markt)
    </update>
  </changelog>
</section>
<section name="2.0.0" rtext="not released">
  <changelog>
    <update>
      Update the minimum required version of OpenSSL to 3.0.0 and make it a
      madatory dependency. (markt)
    </update>
    <update>
      Update the minimum required version of APR to 1.7.0. (markt)
    </update>
    <design>
      Remove NPN support as NPN was never standardised and browser support was
      removed in 2019. (markt)
    </design>
    <add>
      Add support for using OpenSSL when the FIPS provider is configured as the
      default provider. (markt)
    </add>
    <design>
      Remove all API methods (and supporting code) that are not used by Tomcat
      10.1.x to support the use of OpenSSL as a replacement for JSSE to provide
      TLS functionality. (markt)
    </design>
    <docs>
      Document the TLS rengotiation behaviour. (markt)
    </docs>
    <update>
      Update the minimum required Java version to Java 11. (markt)
    </update>
    <update>
      Remove support for Windows 2000, Windows XP, Windows Server 2003, Windows
      Vista and Windows Server 2008. The minimum Windows version is now Windows
      7 / Windows Server 2008 R2. (markt)
    </update>
    <docs>
      Add HOWTO-RELEASE.txt that describes the release process. (markt)
    </docs>
    <fix>
      Fix the autoconf warnings when creating a release. (markt)
    </fix>
  </changelog>
</section>
<section name="Changes in 1.3.x">
<p>Please see the <a href="../../native-1.3-doc/miscellaneous/changelog.html">1.3.x
   changelog</a>.</p>
</section>
<section name="Changes in 1.2.x">
<p>Please see the <a href="../../native-1.2-doc/miscellaneous/changelog.html">1.2.x
   changelog</a>.</p>
</section>
<section name="Changes in 1.1.x">
<p>Please see the <a href="../../native-1.1-doc/miscellaneous/changelog.html">1.1.x
   changelog</a>.</p>
</section>
</body>
</document>
