54

keytool -import -trustcacerts

I am confused with this trustcacerts option of keytool.

When I googled on this, I found these points:

  • Depending on the situation you may not require the -trustcacerts option. Try the operation without it if you like.

  • The -trustcacerts argument tells keytool that you want to import this as a trusted certificate.

  • Use the cacerts file to obtain trusted certificates from certificate authorities that have signed the certificate that is being imported.

At last I found out that this trustcacerts is optional.

Generally any Developer/CEO of the website wants that their site to be trusted by the Customers, then why do we need to explicitly specify this with the keytool command?

Thanks

Pedro A
  • 3,989
  • 3
  • 32
  • 56
Pawan
  • 31,545
  • 102
  • 256
  • 434

1 Answers1

94

When you import a certificate other than a self-signed root certificate (e.g. intermediate certificates), keytool tries to build and validate a proper certificate path first.

If you use the trustcacerts parameter, then for building the path, keytool will not only consider the certificates already contained in the trust store, but it will additionally consider the certificates contained in the cacerts key store (this file is located in the lib/security folder of your JRE installation). The certificates in cacerts are a kind of default trust list, the officially trusted root certificates (similar to the lists your browser trusts by default).

The option is not really necessary since you can always force the import for a certificate. It also makes no sense when importing a self-signed root certificate, because no certificate path can be built in this situation - you either trust a root or you don't.

But it may be a nice feature if you know that the imported certificate should be issued by one of the certificates contained in cacerts - keytool would warn you if it still could not build and validate an entire certificate path - which would most likely be a warning that something is not right with the certificate you tried to import.

emboss
  • 38,880
  • 7
  • 101
  • 108