0

Since not all jvm's have letsencrypt yet in their cacert keystore, I need to temporarily add it when running a program. My code is as follows:

public void addRootCA() throws Exception {
    InputStream fis = new BufferedInputStream(this.getClassLoader().getResourceAsStream("letsencrypt.crt"));
    Certificate ca = CertificateFactory.getInstance("X.509").generateCertificate(fis);
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
    ks.load(null, null);
    ks.setCertificateEntry("LetsEncrypt CA", ca);
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(ks);
    SSLContext ctx = SSLContext.getInstance("TLS");
    ctx.init(null, tmf.getTrustManagers(), null);
    HttpsURLConnection.setDefaultSSLSocketFactory(ctx.getSocketFactory());
}

It does seem to add the certificate (the exceptions for it being missing disappears and I get a response on the serverside) but it seems that the other CA's from the default java key store aren't loaded anymore. I got the code mostly from another stackoverflow question that was marked as the right answer, so I am puzzled that it doesn't behave appropriately.

What is the reason that other CA's don't get loaded? Or is there maybe an entirely different problem?

Rik Schaaf
  • 1,101
  • 2
  • 11
  • 30

1 Answers1

1

The default Java keystore isn't loading because you aren't loading it. You're loading it from null which creates an empty keystore. You would need to locate the default Java keystore, open it, load from it, and close it.

user207421
  • 305,947
  • 44
  • 307
  • 483
  • I thought that I read somewhere that null defaults to the default java keystore, but I might have been wrong. What is the easiest way to access this keystore? Does Java provide something to make locating it easier? – Rik Schaaf Jan 31 '16 at 13:53
  • I found a way to access the current truststore in another thread. Thanks for your help – Rik Schaaf May 23 '16 at 02:57
  • For reference, this is a way to access the keystore: `Path ksPath = Paths.get(System.getProperty("java.home"), "lib", "security", "cacerts"); keyStore.load(Files.newInputStream(ksPath), "changeit".toCharArray());` – ChristophK Apr 10 '17 at 07:39