Why does java have both the cacerts and jssecacerts files?

java ssl jsse truststore
hooknc picture hooknc · Apr 18, 2011 · Viewed 53.6k times · Source

I'm seriously confused on the differences between cacerts and jssecacerts files.

I know that by default java looks for the jssecacerts file and then the cacerts file.

But what is the point of the jssecacerts file?

My understanding is that if a new truststore needs to be used then a copy of cacerts should be made and all new trusted CAs should be added to that copy. The copy of cacerts (with the new CAs) should then be referenced by the -Djavax.net.ssl.trustStore system property. That way other java applications that run on that machine won't accidently trust non-default CAs.

Answer

Lee Chee Kiam picture Lee Chee Kiam · Jun 5, 2013

From Java™ Secure Socket Extension (JSSE) Reference Guide, TrustManagerFactory uses the following steps to try to find trust material:

  1. system property javax.net.ssl.trustStore
  2. java-home/lib/security/jssecacerts
  3. java-home/lib/security/cacerts (shipped by default)

I think this is based on convention over configuration concept. Without extra coding effort, cacert will be used. For extra private CA/Signing certs, a developer either can use first or second way, where former may just contain a particular cert but later contains a list of certs.

Related questions

java - path to trustStore - set property doesn't work?

I've setup a self-signed certificate to test an ssl java connection - however, it is refusing to locate the java trustStore. I've saved copies of it in /Java/jre6/lib/security in addition to the folder where the classes are …

Read More
How can I use different certificates on specific connections?

A module I'm adding to our large Java application has to converse with another company's SSL-secured website. The problem is that the site uses a self-signed certificate. I have a copy of the certificate to verify that I'm not encountering …

Read More
javax.net.ssl.SSLException: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

I'm looking to parse an XML file that updates said file daily - the only issue I've run into is that they use their own certificate (https://...) and I can't use that specific URL, nor is there an http://... link …

Read More