Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We need to have a certificate in Java's cacerts keystore for one of our servers that is authenticated by LDAP. We are using Ubuntu server.

We have successfully done this by updating the cacerts file in /usr/lib/jvm/java-6-openjdk-amd64/jre/lib/security but occasionally a Java update is installed and the cacerts file seems to be getting replaced by a default one that doesn't contain our changes.

This doesn't happen very often but it is becoming a bit of a pain when it does happen. Is there a better way of adding things to cacerts so that they don't get lost when a Java update happens?

Thanks, Alan

share|improve this question
depending on distribution, you can force the packet manager not to update the file – Hubert Kario Oct 6 '12 at 15:45
up vote 2 down vote accepted

Get the server certificate signed by a CA, then you don't have do it at all.

If you really can't do that, which you really should, Java installs its own cacerts file when it updates so you will just have to cope with it.

share|improve this answer
OK, thanks for confirming what I thought. – Alan Spark Sep 18 '12 at 8:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.