Default CRYPTO_POLICY to unlimited (fixes HTTPS with TLS 1.3)

[edo89b]

The debian and alpine images default CRYPTO_POLICY to limited. With the bundled JDK that makes the server emit a malformed TLS 1.3 NewSessionTicket, which breaks HTTPS for TLS 1.3 clients: the handshake completes and then the connection is dropped (Chrome ERR_SSL_PROTOCOL_ERROR, curl "length mismatch"). Full details and a minimal reproduction are in #495.

This changes the default to unlimited, which is the JDK's own default on current versions and the value the README already recommends. The entrypoint already handles the unlimited case, so the change is limited to the ENV default in debian/Dockerfile and alpine/Dockerfile.

If keeping limited as the default is preferred, I'm fine closing this and adding a note to the docs instead.

[wborn]

Yes, I think this is a better default. It should improve the out-of-the-box experience, especially since the current limited policy can break HTTPS entirely for TLS 1.3 clients with the bundled JDK.

The documentation should be updated as part of this PR as well, particularly the Java cryptographic strength policy section. It currently states that the containers use the limited policy by default, which would no longer be correct.

Preferably, the documentation should remain useful for older releases too. For example, it could explain that:

• new images use unlimited by default, matching the default of current OpenJDK versions;
• older images may still default to limited and require CRYPTO_POLICY=unlimited to be set explicitly;
• users can still explicitly select CRYPTO_POLICY=limited when required.

I would therefore keep CRYPTO_POLICY: "unlimited" in the Docker and Compose examples for now, since those examples would then also continue to work correctly with older image versions. A comment could mention that it is redundant for newer releases.

[florian-h05]

IIRC the reason to default to limited CRYPTO policy is legal reasons (complying with export restriction).

[florian-h05]

It seems the regularory framework has changed and today it isn’t required anymore to default to limited crypto policy.