////
    Licensed to the Apache Software Foundation (ASF) under one or more
    contributor license agreements.  See the NOTICE file distributed with
    this work for additional information regarding copyright ownership.
    The ASF licenses this file to You under the Apache License, Version 2.0
    (the "License"); you may not use this file except in compliance with
    the License.  You may obtain a copy of the License at

         http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
////
:jsse-default-keystores: https://docs.oracle.com/en/java/javase/21/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-7D9F43B8-AABF-4C5B-93E6-3AFB18B66150

[id=log4j2.configurationAllowedProtocols]
== `log4j2.configurationAllowedProtocols`

[cols="1h,5"]
|===
| Env. variable
| `LOG4J_CONFIGURATION_ALLOWED_PROTOCOLS`

| Type
| Comma-separated list of https://docs.oracle.com/javase/{java-target-version}/docs/api/java/net/URL.html[`URL`] protocols

| Default value
|
`file, https, jar` (JVM)

`file, https, jar, resource` (GraalVM)
|===

A comma separated list of https://docs.oracle.com/javase/{java-target-version}/docs/api/java/net/URL.html[`URL`] protocols that may be used to load any kind of configuration source.

To completely prevent accessing the configuration via the Java `URL` class specify a value of `_none`.

NOTE:: Since Log4j does not use `URL` to access `file:` resources, this protocol can not be effectively disabled.

[id=log4j2.configurationAuthorizationProvider]
== `log4j2.configurationAuthorizationProvider`

[cols="1h,5"]
|===
| Env. variable
| `LOG4J_CONFIGURATION_AUTHORIZATION_PROVIDER`

| Type
| link:../javadoc/log4j-core/org/apache/logging/log4j/core/util/AuthorizationProvider.html[`Class<? extends AuthorizationProvider>`]

| Default value
| link:../javadoc/log4j-core/org/apache/logging/log4j/core/util/BasicAuthorizationProvider.html[`BasicAuthorizationProvider`]
|===

The fully qualified class name of the
link:../javadoc/log4j-core/org/apache/logging/log4j/core/util/AuthorizationProvider.html[`AuthorizationProvider`]
implementation to use with `http` and `https` URL protocols.

[id=log4j2.configurationAuthorizationEncoding]
== `log4j2.configurationAuthorizationEncoding`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_CONFIGURATION_AUTHORIZATION_ENCODING`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/nio/charset/Charset.html[`Charset`]
| Default value | `UTF-8`
|===

The encoding used in Basic Authentication (cf. https://datatracker.ietf.org/doc/html/rfc7617[RFC 7617]).

[id=log4j2.configurationPassword]
== `log4j2.configurationPassword`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_CONFIGURATION_PASSWORD`
| Type          | `String`
| Default value | `null`
|===

The password to use in HTTP Basic authentication.

If used in conjunction with <<log4j2.configurationPasswordDecryptor>> the contents of this variable are interpreted by the decryptor.

[id=log4j2.configurationPasswordDecryptor]
== `log4j2.configurationPasswordDecryptor`

[cols="1h,5"]
|===
| Env. variable
| `LOG4J_CONFIGURATION_PASSWORD_DECRYPTOR`

| Type
| link:../javadoc/log4j-core/org/apache/logging/log4j/core/util/PasswordDecryptor.html[`Class<? extends PasswordDecryptor>`]

| Default value
| `null`
|===

Fully qualified class name of an implementation of
link:../javadoc/log4j-core/org/apache/logging/log4j/core/util/PasswordDecryptor.html[`PasswordDecryptor`]
to use for the value of the <<log4j2.configurationPassword>> property.

If `null`, the literal value of the password is used.

[id=log4j2.configurationUsername]
== `log4j2.configurationUsername`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_CONFIGURATION_USERNAME`
| Type          | `String`
| Default value | `null`
|===

The username used in HTTP Basic authentication.

[id=log4j2.trustStoreLocation]
== `log4j2.trustStoreLocation`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_TRUST_STORE_LOCATION`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/nio/file/Path.html[`Path`] or https://docs.oracle.com/javase/{java-target-version}/docs/api/java/net/URI.html[`URI`]
| Default value | see link:{jsse-default-keystores}[Default Java trust store]
|===

The location of the trust store.

include::partial$manual/trust-store-guideline.adoc[]

[id=log4j2.trustStorePassword]
== `log4j2.trustStorePassword`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_TRUST_STORE_PASSWORD`
| Type          | `String`
| Default value | `null`
|===

The password for the trust store.

[id=log4j2.trustStorePasswordFile]
== `log4j2.trustStorePasswordFile`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_TRUST_STORE_PASSWORD_FILE`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/nio/file/Path.html[`Path`]
| Default value | `null`
|===

The name of a file that contains the password for the trust store.

[id=log4j2.trustStorePasswordEnvironmentVariable]
== `log4j2.trustStorePasswordEnvironmentVariable`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_TRUST_STORE_PASSWORD_ENVIRONMENT_VARIABLE`
| Type          | `String`
| Default value | `null`
|===

The name of the environment variable that contains password for the trust store.

[id=log4j2.trustStoreType]
== `log4j2.trustStoreType`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_TRUST_STORE_TYPE`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/technotes/guides/security/StandardNames.html#KeyStore[`KeyStore` type]
| Default value | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/security/KeyStore.html#getDefaultType--[Default Java `KeyStore` type]
|===

The type of trust store.

[id=log4j2.trustStoreKeyManagerFactoryAlgorithm]
== `log4j2.trustStoreKeyManagerFactoryAlgorithm`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_TRUST_STORE_KEY_MANAGER_FACTORY_ALGORITHM`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/technotes/guides/security/StandardNames.html#KeyManagerFactory[`KeyManagerFactory`]
| Default value | https://docs.oracle.com/javase/{java-target-version}/docs/api/javax/net/ssl/KeyManagerFactory.html#getDefaultAlgorithm--[Default Java `KeyManagerFactory` algorithm]
|===

Name of the https://docs.oracle.com/javase/{java-target-version}/docs/api/javax/net/ssl/KeyManagerFactory.html[`KeyManagerFactory`] implementation to use for the trust store.

[id=log4j2.sslVerifyHostName]
== `log4j2.sslVerifyHostName`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_SSL_VERIFY_HOST_NAME`
| Type          | `boolean`
| Default value | `false`
|===

If `true` enables verification of the name of the TLS server.

[id=log4j2.keyStoreLocation]
== `log4j2.keyStoreLocation`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_KEY_STORE_LOCATION`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/nio/file/Path.html[`Path`] or
https://docs.oracle.com/javase/{java-target-version}/docs/api/java/net/URI.html[`URI`]
| Default value | see link:{jsse-default-keystores}[Default Java key store]
|===

The location of the private key store.

[id=log4j2.keyStorePassword]
== `log4j2.keyStorePassword`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_KEY_STORE_PASSWORD`
| Type          | `String`
| Default value | `null`
|===

The password for the private key store.

[id=log4j2.keyStorePasswordFile]
== `log4j2.keyStorePasswordFile`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_KEY_STORE_PASSWORD_FILE`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/nio/file/Path.html[`Path`]
| Default value | `null`
|===

The name of a file that contains the password for the private key store.

[id=log4j2.keyStorePasswordEnvironmentVariable]
== `log4j2.keyStorePasswordEnvironmentVariable`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_KEY_STORE_PASSWORD_ENVIRONMENT_VARIABLE`
| Type          | `String`
| Default value | `null`
|===

The name of the environment variable that contains the password for the private key store.

[id=log4j2.keyStoreType]
== `log4j2.keyStoreType`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_KEY_STORE_TYPE`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/technotes/guides/security/StandardNames.html#KeyStore[`KeyStore`]
| Default value | https://docs.oracle.com/javase/{java-target-version}/docs/api/java/security/KeyStore.html#getDefaultType--[Default Java `KeyStore` type]
|===

The type of private key store.
See https://docs.oracle.com/javase/{java-target-version}/docs/technotes/guides/security/StandardNames.html#KeyStore[`KeyStore`].

[id=log4j2.keyStoreKeyManagerFactoryAlgorithm]
== `log4j2.keyStoreKeyManagerFactoryAlgorithm`

[cols="1h,5"]
|===
| Env. variable | `LOG4J_KEY_STORE_KEY_MANAGER_FACTORY_ALGORITHM`
| Type          | https://docs.oracle.com/javase/{java-target-version}/docs/technotes/guides/security/StandardNames.html#KeyManagerFactory[`KeyManagerFactory`]
| Default value | https://docs.oracle.com/javase/{java-target-version}/docs/api/javax/net/ssl/KeyManagerFactory.html#getDefaultAlgorithm--[Default Java `KeyManagerFactory` algorithm]
|===

Name of the https://docs.oracle.com/javase/{java-target-version}/docs/api/javax/net/ssl/KeyManagerFactory.html[`KeyManagerFactory`] implementation to use for the private key store.
See https://docs.oracle.com/javase/{java-target-version}/docs/technotes/guides/security/StandardNames.html#KeyManagerFactory[`KeyManagerFactory`].