0

How can i force liberty on cloud to use JVM default truststore, As i undrstood it is create a new truststore that include the CA.

I have tried the following in jmv.options:

-Djavax.net.ssl.trustStore=/opt/ibm/java/jre/lib/security

But it is still refere to : CWWKS4104A: LTPA keys created in 0.801 seconds. LTPA key file: /opt/ibm/wlp/output/defaultServer/resources/security/ltpa.keys [AUDIT ] CWPKI0803A: SSL certificate created in 1.830 seconds. SSL key file: /opt/ibm/wlp/output/defaultServer/resources/security/key.jks

Any advice to at beside the created file use default JVM truststore as cloudant is submitted there by default.

User
  • 573
  • 3
  • 15
  • 28
  • 1
    In general you should add required certificates to the Liberty truststore instead of default JVM truststore. Please explain in more details what you are trying to achieve. Attach any stacktrace with errors that you see. LTPA key file has noting to do with connection with the cloudant. – Gas Nov 23 '18 at 13:04
  • @Gas, my main issue is when trying to use cloudant within a liberty application it gives me the following exception "handling exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: PKIXCertPathBuilderImpl could not build a valid CertPath." and when i searched i found the cloudant registered at the default JVM truststore but liberty not using the default JVM truststore it create its own key.jsk – User Nov 26 '18 at 09:30
  • what i am trying to do is to force liberty to use default jvm instead of key.js or use both – User Nov 26 '18 at 09:33
  • P.s.: it is not recommended to import the certificate as per this link: https://console.bluemix.net/docs/services/Cloudant/offerings/security.html#secure-access-control – User Nov 26 '18 at 09:33
  • 1
    Are you using CF or Kubernetes for Liberty and for Cloudant? In the link it says that it is not recommended to use current certificate as it is subject to change, but you should import parent certs, which is what error is saying - it cannot find all required certs. – Gas Nov 27 '18 at 18:10
  • See https://stackoverflow.com/questions/54044281/best-way-to-package-liberty-app-with-default-java-truststore-cacerts Gordon – Gordon Hutchison Jul 08 '19 at 05:15

0 Answers0