# `java.security.debug`

To monitor security access, you can set the `java.security.debug` system property, which determines what trace messages are printed during execution. The value of the property is one or more options separated by a comma. Each trace message includes the thread id, caller information, and timestamp.

The following table lists the `java.security.debug` options:

Security Debug Options
Option | Description
--- | ---
`all` | Turn on all the debugging options

`certpath`

Turns on debugging for the PKIX `CertPathValidator` and `CertPathBuilder` implementations. The following sub-options can be used with the `certpath` option:

- `ocsp`: Dump OCSP protocol exchanges
- `verbose`: A hexadecimal dump of the OCSP request and response bytes is displayed.

`configfile` | JAAS (Java Authentication and Authorization Service) configuration file loading
`configparser` | JAAS configuration file parsing
`gssloginconfig` | Java GSS (Generic Security Services) login configuration file debugging
`jar` | JAR file verification
`jca` | JCA engine class debugging
`KeyStore` | `KeyStore` debugging
`logincontext` | `LoginContext` results
`pcsc` | Java Smart Card I/O and SunPCSC provider debugging
`pkcs11` | PKCS11 session manager debugging
`pkcs11keystore` | PKCS11 `KeyStore` debugging
`pkcs12` | PKCS12 `KeyStore` debugging
`properties` | `java.security` configuration file debugging

`provider`

Security provider debugging. The following sub-option can be used with the `provider` option: `engine=(engines)` : The output is displayed only for a specified list of one or more JCA engines, separated by a comma. The supported values for (engines) are:

- `Cipher`
- `KDF`
- `KeyAgreement`
- `KeyGenerator`
- `KeyPairGenerator`
- `KeyStore`
- `Mac`
- `MessageDigest`
- `SecureRandom`
- `Signature`

`securerandom` | `SecureRandom` debugging
`sunpkcs11` | SunPKCS11 provider debugging
`ts` | Timestamping debugging

`x509`

X.509 certificate debugging. The following sub-option can be used with the `X.509` option.

- `ava`: Embed non-printable/non-escaped characters in AVA components as hex strings