5

I have imported internal Certificate Authorities into Java's CA keystore. (Using keytool to import into the "cacerts" store) This works fine and dandy, until I update the Java RPM. At which point all of those imported certs are not carried over to the new install. So applications bomb when attempting to make SSL connections.

Is there any way to make these certificates persist through Java upgrades? Or an easy way to rerun the import commands on an upgrade trigger? I can obviously script these commands into my upgrade process, but I'm hoping there's a more elegant solution.

For reference, this is a RHEL 5.10 equivalent (technically Oracle Linux). I'm using java-1.7.0-openjdk through the official repositories, and just upgraded to U65.

Improve this question
2
  • scripting is not elegant but doing it every time by hand is it?
    – Giovanni Toraldo
    Oct 20, 2014 at 6:06
  • Obviously not. I'm clearly aiming for a third, more elegant, option.
    – Christopher Karel
    Oct 20, 2014 at 14:51

2 Answers 2

Reset to default
5
+50

It may be helpful to keep your site-specific or host-specific key-store / trust-store outside the java installation-directory, and instead point to it when you need to consume trust. Presuming your trust-store is at /opt/site/cacerts.JKS, you would do that one of two ways:

In your Java code, add a line like: System.setProperty("javax.net.ssl.trustStore","/opt/site/cacerts.JKS");

At run-time, add a definition to your startup script: java -D'javax.net.ssl.trustStore'="/opt/site/cacerts.JKS" /opt/site/myClass.class

Improve this answer
2
  • 2
    Interesting work around. The downside is that you will never get certificate store updates (eg: new CAs) as part of a java upgrade. But it does definitely fix my issue.
    – Christopher Karel
    Oct 23, 2014 at 13:47
  • This is true. I had assumed you had a predefined trust-store that is managed by security, and which could be pushed-out when new versions are built by your security team.
    – DTK
    Oct 24, 2014 at 22:36
2

The way I do (maybe not the best?): save cacerts before upgrade and restore after, I scripted it in my update script like this:

1) save:

javaexe=`readlink -f  /usr/bin/java`
jredir=`dirname $javaexe`
cacertsfile=${jredir}/../lib/security/cacerts
[ -f $cacertsfile ] && cp -p $cacertsfile /tmp/cacerts

2) install updates (yum update or other way).

3) restore: 

[ -f /tmp/cacerts ] && cp -p /tmp/cacerts $cacertsfile
Improve this answer
2
  • 1
    I haven't tried this but you might be able to put your cacerts file somewhere else and create a symlink to it from the lib/security directory.
    – shonky linux user
    Oct 22, 2014 at 3:01
  • 1
    this effectively overwites the keystore changes that comes from time to time
    – andrej
    Feb 18, 2020 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .