The java.security.debug system property (Java SE 25 & JDK 25)

# `java.security.debug`

To monitor security access, you can set the `java.security.debug` system property, which determines what trace messages are printed during execution. The value of the property is one or more options separated by a comma. Each trace message includes the thread id, caller information, and timestamp.

The following table lists the `java.security.debug` options:

Security Debug Options
Option | Description
--- | ---
`all` | Turn on all the debugging options
`certpath` | Turns on debugging for the PKIX `CertPathValidator` and `CertPathBuilder` implementations. The following sub-options can be used with the `certpath` option: `ocsp`: Dump OCSP protocol exchanges `verbose`: A hexadecimal dump of the OCSP request and response bytes is displayed.
`configfile` | JAAS (Java Authentication and Authorization Service) configuration file loading
`configparser` | JAAS configuration file parsing
`gssloginconfig` | Java GSS (Generic Security Services) login configuration file debugging
`jar` | JAR file verification
`jca` | JCA engine class debugging
`KeyStore` | `KeyStore` debugging
`logincontext` | `LoginContext` results
`pcsc` | Java Smart Card I/O and SunPCSC provider debugging
`pkcs11` | PKCS11 session manager debugging
`pkcs11keystore` | PKCS11 `KeyStore` debugging
`pkcs12` | PKCS12 `KeyStore` debugging
`properties` | `java.security` configuration file debugging
`provider` | Security provider debugging. The following sub-option can be used with the `provider` option: `engine=(engines)` : The output is displayed only for a specified list of one or more JCA engines, separated by a comma. The supported values for (engines) are: `Cipher` `KDF` `KeyAgreement` `KeyGenerator` `KeyPairGenerator` `KeyStore` `Mac` `MessageDigest` `SecureRandom` `Signature`
`securerandom` | `SecureRandom` debugging
`sunpkcs11` | SunPKCS11 provider debugging
`ts` | Timestamping debugging
`x509` | X.509 certificate debugging. The following sub-option can be used with the `X.509` option. `ava`: Embed non-printable/non-escaped characters in AVA components as hex strings