Using a custom truststore in java as well as the default one

You could use a similar pattern to what I've mentioned in a previous answer (for a different problem).

Essentially, get hold of the default trust manager, create a second trust manager that uses your own trust store. Wrap them both in a custom trust manager implementation that delegates call to both (falling back on the other when one fails).

TrustManagerFactory tmf = TrustManagerFactory    .getInstance(TrustManagerFactory.getDefaultAlgorithm());// Using null here initialises the TMF with the default trust store.tmf.init((KeyStore) null);// Get hold of the default trust managerX509TrustManager defaultTm = null;for (TrustManager tm : tmf.getTrustManagers()) {    if (tm instanceof X509TrustManager) {        defaultTm = (X509TrustManager) tm;        break;    }}FileInputStream myKeys = new FileInputStream("truststore.jks");// Do the same with your trust store this time// Adapt how you load the keystore to your needsKeyStore myTrustStore = KeyStore.getInstance(KeyStore.getDefaultType());myTrustStore.load(myKeys, "password".toCharArray());myKeys.close();tmf = TrustManagerFactory    .getInstance(TrustManagerFactory.getDefaultAlgorithm());tmf.init(myTrustStore);// Get hold of the default trust managerX509TrustManager myTm = null;for (TrustManager tm : tmf.getTrustManagers()) {    if (tm instanceof X509TrustManager) {        myTm = (X509TrustManager) tm;        break;    }}// Wrap it in your own class.final X509TrustManager finalDefaultTm = defaultTm;final X509TrustManager finalMyTm = myTm;X509TrustManager customTm = new X509TrustManager() {    @Override    public X509Certificate[] getAcceptedIssuers() {        // If you're planning to use client-cert auth,        // merge results from "defaultTm" and "myTm".        return finalDefaultTm.getAcceptedIssuers();    }    @Override    public void checkServerTrusted(X509Certificate[] chain,            String authType) throws CertificateException {        try {            finalMyTm.checkServerTrusted(chain, authType);        } catch (CertificateException e) {            // This will throw another CertificateException if this fails too.            finalDefaultTm.checkServerTrusted(chain, authType);        }    }    @Override    public void checkClientTrusted(X509Certificate[] chain,            String authType) throws CertificateException {        // If you're planning to use client-cert auth,        // do the same as checking the server.        finalDefaultTm.checkClientTrusted(chain, authType);    }};SSLContext sslContext = SSLContext.getInstance("TLS");sslContext.init(null, new TrustManager[] { customTm }, null);// You don't have to set this as the default context,// it depends on the library you're using.SSLContext.setDefault(sslContext);

You don't have to set that context as the default context. How you use it depends on the client library you're using (and where it gets its socket factories from).

This being said, in principle, you'd always have to update the truststore as required anyway. The Java 7 JSSE Reference Guide had an "important note" about this, now downgraded to just a "note" in version 8 of the same guide:

The JDK ships with a limited number of trusted root certificates in the java-home/lib/security/cacerts file. As documented in keytool reference pages, it is your responsibility to maintain (that is, add and remove) the certificates contained in this file if you use this file as a truststore.

Depending on the certificate configuration of the servers that you contact, you may need to add additional root certificates. Obtain the needed specific root certificates from the appropriate vendor.

You can retrieve the default trust store by calling TrustManagerFactory.init((KeyStore)null) and get its X509Certificates. Combine this with your own certificate. You can either load the self-signed certificate from a .jks or .p12 file with KeyStore.load or you can load a .crt (or .cer) file via CertificateFactory.

Here is a some demo code that illustrates the point. You can run the code if you download the certificate from stackoverflow.com with your browser. If you comment out both adding the loaded certificate and the default, the code will get a SSLHandshakeException, but if you keep either, it will return status code 200.

import javax.net.ssl.*;import java.io.*;import java.net.URL;import java.security.*;import java.security.cert.*;public class HttpsWithCustomCertificateDemo {    public static void main(String[] args) throws Exception {        // Create a new trust store, use getDefaultType for .jks files or "pkcs12" for .p12 files        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());        // Create a new trust store, use getDefaultType for .jks files or "pkcs12" for .p12 files        trustStore.load(null, null);        // If you comment out the following, the request will fail        trustStore.setCertificateEntry(                "stackoverflow",                // To test, download the certificate from stackoverflow.com with your browser                loadCertificate(new File("stackoverflow.crt"))        );        // Uncomment to following to add the installed certificates to the keystore as well        //addDefaultRootCaCertificates(trustStore);        SSLSocketFactory sslSocketFactory = createSslSocketFactory(trustStore);        URL url = new URL("https://stackoverflow.com/");        HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();        // Alternatively, to use the sslSocketFactory for all Http requests, uncomment        //HttpsURLConnection.setDefaultSSLSocketFactory(sslSocketFactory);        conn.setSSLSocketFactory(sslSocketFactory);        System.out.println(conn.getResponseCode());    }    private static SSLSocketFactory createSslSocketFactory(KeyStore trustStore) throws GeneralSecurityException {        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());        tmf.init(trustStore);        TrustManager[] trustManagers = tmf.getTrustManagers();        SSLContext sslContext = SSLContext.getInstance("SSL");        sslContext.init(null, trustManagers, null);        return sslContext.getSocketFactory();    }    private static X509Certificate loadCertificate(File certificateFile) throws IOException, CertificateException {        try (FileInputStream inputStream = new FileInputStream(certificateFile)) {            return (X509Certificate) CertificateFactory.getInstance("X509").generateCertificate(inputStream);        }    }    private static void addDefaultRootCaCertificates(KeyStore trustStore) throws GeneralSecurityException {        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());        // Loads default Root CA certificates (generally, from JAVA_HOME/lib/cacerts)        trustManagerFactory.init((KeyStore)null);        for (TrustManager trustManager : trustManagerFactory.getTrustManagers()) {            if (trustManager instanceof X509TrustManager) {                for (X509Certificate acceptedIssuer : ((X509TrustManager) trustManager).getAcceptedIssuers()) {                    trustStore.setCertificateEntry(acceptedIssuer.getSubjectDN().getName(), acceptedIssuer);                }            }        }    }}

Maybe I am 6 years too late to answer this question, but it could be maybe helpful for other developers too. I also ran into the same challenge of loading the default truststore and my own custom truststore. After using the same custom solution for multiple projects, I thought it would be handy to create a library and also make it publicly available to contribute back to the community. Please have a look here: Github - SSLContext-Kickstart

Usage:

import nl.altindag.sslcontext.SSLFactory;import javax.net.ssl.SSLContext;import java.security.cert.X509Certificate;import java.util.List;public class App {    public static void main(String[] args) {        String trustStorePath = ...;        char[] password = "password".toCharArray();        SSLFactory sslFactory = SSLFactory.builder()                .withDefaultTrustMaterial()                .withTrustMaterial(trustStorePath, password)                .build();        SSLContext sslContext = sslFactory.getSslContext();        List<X509Certificate> trustedCertificates = sslFactory.getTrustedCertificates();    }}

I wasn't quite sure if I should post this here, because it could also be seen as a way to promote "my library" but I thought it could be helpful for developers who have the same challenges.

You can add the dependency with the following snippet:

<dependency>    <groupId>io.github.hakky54</groupId>    <artifactId>sslcontext-kickstart</artifactId>    <version>7.0.0</version></dependency>