  Preface

   This is the Changelog for Tomcat Native 1.3.x. The Tomcat Native 1.3.x
   branch started from the 1.2.39 tag.

  1.3.9

     * Code: Remove call to ERR_remove_thread_state() from Windows specific
       code to allow building with OpenSSL 4.0.x. ERR_remove_thread_state()
       is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4. (rjung)
     * Fix: Fix a potential crash when negotiating ALPN. (markt)
     * Fix: If ALPN negotiation fails and failure is configured to use the
       last server protocol in the list, use it rather than the last protocol
       offered by the client. (markt)
     * Fix: Add support for the extended range of options available from
       OpenSSL 3.0.x. The options flag is now a 64-bit unsigned int
       (represented by a Java long) rather than a 32-bit unsigned int
       (represented by a Java int). (markt)
     * Code: Remove unused code. (markt)
     * Fix: Ensure that per connection changes to certificate verification
       settings, e.g. to support client certificate authentication, do not
       modify the certificate verification settings for other connections.
       (markt)
     * Fix: Fix a potential crash when configuring raw certificates. (markt)
     * Fix: Avoid a potential crash with very long ALPN protocol names.
       (markt)
     * Fix: Make the call to a CertificateVerifier more robust. (markt)
     * Fix: Avoid a potential crash when processing OCSP URLs. (markt)
     * Fix: Make the processing of OCSP responses more robust. (markt)
     * Fix: Stricter OCSP handling when soft-fail is disabled. (markt)
     * Fix: Harden against the mis-use of Buffer.address(ByteBuffer). (markt)
     * Fix: Harden against the mis-use of Pool.destroy(long). (markt)
     * Code: The minimum supported OpenSSL version is now 3.0.x. OpenSSL
       1.1.1 support was accidentally broken in 1.3.8. As no bug reports were
       receive for that failure and since both Debian and Ubuntu versions
       that used OpenSSL 1.1.1 have reached end of support, OpenSSL 1.1.1 is
       no longer supported. (markt)
     * Update: OpenSSL 3.0.x is approaching end of support so the recommended
       version of OpenSSL (and the version that windows binaries will be
       built with) now follows the 3.5.x LTS branch. (markt)
     * Fix: Switch to automatic configuration of DH parameters. Manual
       configuration attempts will be ignored. (markt)
     * Code: Make setTmpECDHByCurveName() a NO-OP. (markt)
     * Fix: Refactor extraction of ECDH curve name from the Certificate to
       avoid deprecated OpenSSL methods. (markt)
     * Fix: Refactor the native implementation of SSL.getTime() to avoid the
       Y2038 problem in SSL_SESSION_get_time() when running on a verion of
       OpenSSL that includes the new SSL_SESSION_get_time_ex() method.
       (markt)

  2026-06-15 1.3.8

     * Fix: Fix a memory leak when parsing certificates. Pull request #44
       provided by chenjp. (markt)
     * Fix: Fix two potential memory leaks on error paths identified by
       Copilot. (markt)
     * Fix: 69988: Fix post handshake authentication when Tomcat is
       configured with a trust store using JSSE style configuration. (markt)
     * Fix: 70102: Correct expected size of tickets when calling
       SSLContext.setSessionTicketKeys. (markt)

  2026-03-10 1.3.7

     * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
       errors when building against the latest OpenSSL 4.0.x code. (markt)
     * Fix: Fix the handling of OCSP requests with multiple responder URIs.
       (jfclere)
     * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
       soft fail is disabled. (jfclere)

  2026-02-11 1.3.6

     * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
       SSL_CTX clean-up. (markt)
     * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
       and export ciphers. Pull requests #35 and #37 provided by chenjp.
       (markt)
     * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
       provided. Pull request #36 provided by chenjp. (markt)
     * Fix: Refactor setting of OCSP configuration defaults as they were only
       applied if the SSL_CONF_CTX was used. While one was always used with
       Tomcat versions aware of the OCSP configuration options, one was not
       always used with Tomcat versions unaware of the OCSP configuration
       options leading to OCSP verification being enabled by default when the
       expected behaviour was disabled by default. (markt)
     * Code: Improve performance for the rare case of handling large OCSP
       responses. (markt)

  2026-01-19 1.3.5

     * Fix: Remove group write permissions from the files in the tar.gz
       source archive. (markt)
     * Fix: Clear an additional error in OCSP processing that was preventing
       OCSP soft fail working with Tomcat's APR/native connector. (markt)

  2026-01-12 1.3.4

     * Fix: Correct logic error that prevented the configuration of TLS 1.3
       cipher suites. (markt)

  not released 1.3.3

     * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
       avoid a regression when running a version of Tomcat that pre-dates
       this change. (markt)

  not released 1.3.2

     * Update: Rename configure.in to modern autotools style configure.ac.
       (rjung)
     * Update: Fix incomplete updates for autotools generated files during
       "buildconf" execution. (rjung)
     * Update: Improve quoting in tcnative.m4. (rjung)
     * Update: Update the minimum version of autoconf for releasing to 2.68.
       (rjung)
     * Fix: Fix the autoconf warnings when creating a release. (markt)
     * Update: The Windows binaries are now built with OCSP support enabled
       by default. (markt)
     * Add: Include a nonce with OCSP requests and check the nonce, if any,
       in the OCSP response. (markt)
     * Add: Expand verification of OCSP responses. (markt)
     * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
       if the responder cannot be contacted or fails to respond in a timely
       manner the OCSP check will not fail. (markt)
     * Add: Add a configurable timeout to the writing of OCSP requests and
       reading of OCSP responses. (markt)
     * Add: Add the ability to control the OCSP verification flags. (markt)
     * Add: Configure TLS 1.3 connections from the provided ciphers list as
       well as connections using TLS 1.2 and earlier. Pull request provided
       by gastush. (markt)
     * Update: Update the Windows build environment to use Visual Studio
       2022. (markt)

  2024-07-24 1.3.1

     * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
       invoked with a null value for caCertificateFile and a non-null value
       for caCertificatePath until properly addressed with
       https://github.com/openssl/openssl/issues/24416. (michaelo)
     * Add: Use ERR_error_string_n with a definite buffer length as a named
       constant. (schultz)
     * Add: Ensure local reference capacity is available when creating new
       arrays and Strings. (schultz)
     * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
       (markt)

  2024-02-12 1.3.0

     * Update: Drop useless compile.optimize option. (michaelo)
     * Update: Align Java source compile configuration with Tomcat.
       (michaelo)
     * Fix: Fix version set in DLL header on Windows. (michaelo)
     * Update: Remove an unreachable if condition around CRLs in
       sslcontext.c. (michaelo)
     * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
       the default verify paths are no longer set. Only the explicitly
       configured trust store, if any, will be used. (michaelo)
     * Update: Update the minimum supported version of LibreSSL to 3.5.2.
       (markt)
     * Design: Remove NPN support as NPN was never standardised and browser
       support was removed in 2019. (markt)
     * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
       (markt)

  Changes in 1.2.x

   Please see the 1.2.x changelog.

  Changes in 1.1.x

   Please see the 1.1.x changelog.

   Copyright  2008-2026, The Apache Software Foundation
