How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?
On Windows the easiest way is to use the program portecle.
- Download and install portecle.
- First make 100% sure you know which JRE or JDK is being used to run your program. On a 64 bit Windows 7 there could be quite a few JREs. Process Explorer can help you with this or you can use:
System.out.println(System.getProperty("java.home"));
- Copy the file JAVA_HOME\lib\security\cacerts to another folder.
- In Portecle click File > Open Keystore File
- Select the cacerts file
- Enter this password: changeit
- Click Tools > Import Trusted Certificate
- Browse for the file mycertificate.pem
- Click Import
- Click OK for the warning about the trust path.
- Click OK when it displays the details about the certificate.
- Click Yes to accept the certificate as trusted.
- When it asks for an alias click OK and click OK again when it says it has imported the certificate.
- Click save. Don’t forget this or the change is discarded.
- Copy the file cacerts back where you found it.
On Linux:
You can download the SSL certificate from a web server that is already using it like this:
$ echo -n | openssl s_client -connect www.example.com:443 | \ sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/examplecert.crt
Optionally verify the certificate information:
$ openssl x509 -in /tmp/examplecert.crt -text
Import the certificate into the Java cacerts keystore:
$ keytool -import -trustcacerts -keystore /opt/java/jre/lib/security/cacerts \ -storepass changeit -noprompt -alias mycert -file /tmp/examplecert.crt
D:\Java\jdk1.5.0_10\bin\keytool -import -file "D:\Certificates\SDS services\Dev\dev-sdsservices-was8.infavig.com.cer" -keystore "D:\Java\jdk1.5.0_10\jre\lib\security\cacerts" -alias "sds certificate"
I ended up writing a small script that adds the certificates to the keystores, so it is much easier to use.
You can get the latest version from https://github.com/ssbarnea/keytool-trust
#!/bin/bash# version 1.0# https://github.com/ssbarnea/keytool-trustREMHOST=$1REMPORT=${2:-443}KEYSTORE_PASS=changeitKEYTOOL="sudo keytool"# /etc/java-6-sun/security/cacertsfor CACERTS in /usr/lib/jvm/java-8-oracle/jre/lib/security/cacerts \ /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts \ "/System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/lib/security/cacerts" \ "/Applications/Xcode.app/Contents/Applications/Application Loader.app/Contents/MacOS/itms/java/lib/security/cacerts"doif [ -e "$CACERTS" ]then echo --- Adding certs to $CACERTS# FYI: the default keystore is located in ~/.keystoreif [ -z "$REMHOST" ] then echo "ERROR: Please specify the server name to import the certificatin from, eventually followed by the port number, if other than 443." exit 1 fiset -erm -f $REMHOST:$REMPORT.pemif openssl s_client -connect $REMHOST:$REMPORT 1>/tmp/keytool_stdout 2>/tmp/output </dev/null then : else cat /tmp/keytool_stdout cat /tmp/output exit 1 fiif sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' </tmp/keytool_stdout > /tmp/$REMHOST:$REMPORT.pem then : else echo "ERROR: Unable to extract the certificate from $REMHOST:$REMPORT ($?)" cat /tmp/output fiif $KEYTOOL -list -storepass ${KEYSTORE_PASS} -alias $REMHOST:$REMPORT >/dev/null then echo "Key of $REMHOST already found, skipping it." else $KEYTOOL -import -trustcacerts -noprompt -storepass ${KEYSTORE_PASS} -alias $REMHOST:$REMPORT -file /tmp/$REMHOST:$REMPORT.pem fiif $KEYTOOL -list -storepass ${KEYSTORE_PASS} -alias $REMHOST:$REMPORT -keystore "$CACERTS" >/dev/null then echo "Key of $REMHOST already found in cacerts, skipping it." else $KEYTOOL -import -trustcacerts -noprompt -keystore "$CACERTS" -storepass ${KEYSTORE_PASS} -alias $REMHOST:$REMPORT -file /tmp/$REMHOST:$REMPORT.pem fifidone
```