Is there a way to load a different cacerts than the one specified in the java_home/jre/lib/security folder?

java security ssl jsse
feniix picture feniix · Apr 15, 2010 · Viewed 66.5k times · Source

I have a single installation of java in a system that runs 2 or 3 applications.

All the applications use the same runtime.

Is there a way to specify a different keystores for the ca certs than the one in java_home/jre/lib/security. That is, is there an option to specify an "extra" keystore that is loaded and added to the certs loaded from java_home/jre/lib/security/cacerts?

What I want to avoid is having to re-import our local ca every time I upgrade the jdk in the box.

Answer

Gene Gotimer picture Gene Gotimer · Apr 15, 2010

I think you want to specify the truststore:

java -Djavax.net.ssl.trustStore=/home/gene/mycacerts ...

Or if you are using certs through JSSE (you probably are), you can copy your truststore to jssecacerts in the $JAVA_HOME/jre/lib/security/ directory (although you'd still have to do that each time a JDK got installed/reinstalled). Sun's JSSE looks for $JAVA_HOME/jre/lib/security/jssecacerts before $JAVA_HOME/jre/lib/security/cacerts.

See http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#X509TrustManager

Related questions

Keystore type: which one to use?

By looking at the file java.security of my JRE, I see that the keystore type to use by default is set to JKS. Here, there is a list of the keystore types that can be used. Is there a …

Read More
SSLContext initialization

I'm looking at the JSSE reference guide, I need to obtain an instance of SSLContext in order to create a SSLEngine, so I can use it with Netty to enable security. To obtain an instance of SSLContext, I use SSLContext.…

Read More
SSL Server socket want auth option

Concerning SSLServerSocket.setWantClientAuth: If this is set to true if the client chooses to not send a certificate the negotiation continues. Also I noticed this also happens if the client sends a certificate but is not part of the truststore.…

Read More