1

I use this command several times and always works :

cd ../../jdk/jre/lib/security
keytool -import -trustcacerts -alias my.alias -file /../../myCert.crt -keystore cacerts

Now in openshift with a jboss-as 7 :

cd /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.95/jre/lib/security
keytool -import -trustcacerts -alias my.alias -file /../.../myCert.crt -keystore cacerts

Error log is:

Enter keystore password:
Owner: CN=...
Issuer: CN=...
Serial number:....
...
Trust this certificate? [no]:  yes
Certificate was added to keystore
keytool error: java.io.FileNotFoundException: cacerts (Permission denied)

Reviewing the archivies, I see that cacerts file is a simlink. This simlink has 0777 permissions but source file has rw-r--r-- or 0644 permissions:

/etc/pki/java/cacerts

So my questions are :

1.- How can I alter permisssions in openshift? I tried and I get an error.

2.- Is there another way to add my certificate to java cacerts file in openshift?

3.- Openshift offer some configuration to do this ?

Thanks in advance!

JRichardsz
  • 14,356
  • 6
  • 59
  • 94

2 Answers2

2

I came across this question and found a solution

At first, I copied the default keystore and added a custom certificate afterwards:

    RUN mkdir -p source/configuration/security && \
        keytool --importkeystore -noprompt \
        -srckeystore /etc/pki/ca-trust/extracted/java/cacerts \
        -srcstorepass changeit \
        -destkeystore source/configuration/security/<custom>.jks \
        -deststorepass changeit

    ADD certificates /

    RUN keytool -import -v -file /certs/<my-certficate> \
        -keystore source/configuration/security/<custom>.jks \
        -noprompt -storepass changeit
Reporter
  • 3,897
  • 5
  • 33
  • 47
Jonas Janz
  • 21
  • 2
0

This is an operating systems permissions issue, not an openshift, PKI, or keytool issue. Perhaps you should use root/administrator access and modify the file permissions (e.g. chmod) so you can access it.

KyleM
  • 4,445
  • 9
  • 46
  • 78
  • Openshift does now alow super user access : http://stackoverflow.com/a/31322169/3957754. – JRichardsz Mar 28 '16 at 15:46
  • @JRichardsz Ok, then create a new cacerts keystore on a different machine and scp it to the openshift server. Configure your server product (e.g. webserver) to use the new cacerts keystore as the truststore. This varies by product so that's the best direction I can give you. If you can't SCP a different cacerts file, or modify the existing one then I see no way to do it.\ – KyleM Mar 28 '16 at 16:12
  • thanks @KyleM. I will try it!! I 'll tell you the result. Regards. – JRichardsz Mar 28 '16 at 16:33