2

I need an advice regarding the best practice of storing organisational CA on Linux servers for Java.

Basically, JRE installation contains a list of trusted CAs in cacerts file, which is used by default by java applications running on the server.

In order to support the organisation CA we are currently adding the CAs into the cacerts manually.

This approach works, however, the issue is that when you update the JRE the cacerts gets overwritten and so you have to add the certificates again.

I'm looking for some better solution for the process.

So, is there a way to keep the organisational CAs in some different file and use some global Linux/Java setting that would instruct java applications searching for CA in this file if not found in the cacerts?

Improve this question

2 Answers 2

Reset to default
0

You can use JAVA_OPTS to specify additional parameters when you start Tomcat. You can use -Djavax.net.ssl.keyStore=customkeystore. I use the JAVA_OPTS in tomcat7.conf which is just a symlink to setenv.sh. Hope this helps.

Improve this answer
3
  • 1
    Well, this is not what I'm looking for. I wanna add Organisation CA to the java default ones. This solutions actually complicates things rather than solving the issue as you'll have to maintain all trusted CAs in your custom store.
    – spoonboy
    May 3, 2016 at 22:06
  • Right, when in this case I would just make sure to back up the cacerts file and simply replace the one from the new install. It worked for me when I upgraded from Java7 to Java8. I had loads of certificates stored in cacerts and when I switched to Java8, I simply replaced the cacerts file with my one and it worked.
    – Mugurel
    May 3, 2016 at 22:11
  • So, what you propose is just a variation of the manual task that we're currently doing while I've been asking for some configuration that would allow to avoid the manual task.
    – spoonboy
    May 4, 2016 at 2:41
0

the issue is that when you update the JRE the cacerts gets overwritten and you have to (manually) add the certificates again

That is exactly the use case for a configuration management tool, puppet in our case, which allows you to automate such things.

In pseudo code a simple loop:

  • For every installed Java version (on RHEL easily found with alternatives)
  • Use the associated keytool on the corresponding cacerts file to list installed/available CA certs
  • If custom cert(s) not present
  • Add cert(s) with keytool
  • Done.
Improve this answer
1
  • Yeah, writing a script that would automate what we're currently doing manually is of course an obvious way. But I hoped that there could be some smarter way of doing this via some sort of static configuration for Java.
    – spoonboy
    May 4, 2016 at 2:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .