New JNI Functionality

• Cancel a handshake before it completes: WolfSSLSession.sendUserCanceled()

• Manage native session timeouts: WolfSSLSession.sessionSetTimeout() and related methods

• Get negotiated DH group size in bits: WolfSSLSession.getDhKeySize()

• WolfSSL.wolfssl_chacha and wolfssl_camellia bulk cipher constants for getBulkCipher()

SSLSocket and SSLEngine Fixes

• Windows – SSLSocket.setSoTimeout() read and handshake timeouts now work on Windows, SSLSocket.close() cleanly ends blocked reads on Windows/select() builds, and WolfSSL.getErrno() returns WSAGetLastError().

• TLS 1.3 SSLEngine – Fixed an IllegalArgumentException when retrying unwrap() after BUFFER_OVERFLOW, and truncated JDK HttpClient responses when TLS 1.3 servers send no session ticket.

• Apache HttpClient 5 – Fixed handshake failures caused by lowercase “https” endpoint identification.

• Connection shutdown – A close notify alert is now sent when closing mid-handshake, shutdownSSL() no longer loops on a WANT_READ/WANT_WRITE left from an unfinished handshake, SSLSocket.read() returns -1 when the peer closes without a close notify, and SSLSocket.close() treats SO_LINGER as seconds and does not wait when it is 0.

• Error reporting – getError() now returns the original native error instead of SSL_ERROR_SYSCALL.

Bug Fixes & Reliability Improvements

• FIPS – FIPS CASTs now run once per process, fixing failures when concurrent threads create WolfSSL objects.

• Sessions – Sessions invalidated with SSLSession.invalidate() are no longer resumed or cached, and session IDs and SNI names are kept after close and in sessions from the cache.

• Java properties – jdk.tls.disabledAlgorithms DH key size limits are enforced on the negotiated DH group, jdk.tls.*.SignatureSchemes parsing handles a comma followed by a space.

• Trust and hostname checks – Stricter LDAPS wildcard hostname checks with a basic X509TrustManager, failure on a corrupt system trust store, and subject alternative names containing NUL bytes omitted instead of returned truncated.

• X.509 and CRL – Corrected Extended Key Usage, Key Usage, getExtensionValue(), and subject/issuer DN output in WolfSSLX509, getPublicKey() support for EdDSA and RSASSA-PSS keys, locale-independent date parsing, and revocation dates and signing errors in certificate, CSR, and CRL generation.

• Resource handling and validation – Fixed native resource leaks when SSLSocket.close() overlaps I/O, SSLServerSocket.accept() leaking the accepted socket on wrap failure, and SSLEngine send buffer growth on large wrap() calls. Invalid read()/write() offsets, negative session timeouts, and empty ALPN protocol names are now rejected.

• PSK, ALPN, and DTLS – Fixed PSK handshakes with no identity hint or a maximum-length client identity, ALPN names with commas or non-ASCII bytes in select callbacks, and dtlsSetPeer()/dtlsGetPeer() with IPv6 addresses.

Examples & Testing

• RMI, threaded socket, and dual-provider FIPS example servers now use client certificates, and the RMI TLS client enables HTTPS hostname verification.

• Android example native libraries are linked with 16 KB page alignment for Android 15+.

• New socket read and handshake timeout tests, close interrupt tests on Windows, and test certificates covering EKU, Key Usage, EdDSA, and RSA-PSS public keys.

• Makefile now auto-detects JAVA_HOME and supports JNI include paths with spaces.

wolfSSL JNI/JSSE 1.19.0 can be downloaded from the wolfSSL download page, and an updated version of the wolfSSL JNI/JSSE User Manual can be found here. Full details on this release can be seen in the ChangeLog.md on GitHub. For any questions or to get help using wolfSSL products in your projects, contact us at support@wolfssl.com.

If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

Download wolfSSL Now