truststore

Java Exception on SSLSocket creation

由 被刻印的时光 ゝ 提交于 2019-12-01 13:12:13
问题 In the code: System.setProperty("javax.net.ssl.trustStore", cacerts); System.setProperty("javax.net.ssl.trustStorePassword", pwdCacerts); SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault(); SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", port); I obtain a Java Exception: java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security

Set JRE to use Windows trust store, specifically the user's trust store

由 不羁岁月 提交于 2019-12-01 07:24:42
问题 Summary: Java option "Djavax.net.ssl.trustStoreType=WINDOWS-ROOT" allows Java to use the Windows trust store for the computer account. What option allows it to use the Windows trust store for the user account ? We have a Java application that we run on our Windows clients. The application gets data from various sources, some of which use certificates that are not in the default cacerts file. When a user selects an item that accesses the external data, they are prompted to download the

How support multiple TrustStores in java SSL client application

由 强颜欢笑 提交于 2019-12-01 01:50:40
问题 In our java application we need to communicate with a list of servers on SSL using https protocol. The list of servers to communicate will change at runtime. Initially we do not have any of the server's certificate. At runtime, we will obtain a new server's certificate and add the public key certificate into a truststore; and any new https connection with the server should use the updated trust store. We are thinking that we should use two trust stores, one cacerts(default one shipped with

Is it a bad practice to use Java standard keystore

由 不问归期 提交于 2019-11-30 09:40:30
We had been using java standard keystore ( $JAVA_HOME/jre/lib/security/cacerts ) as the trusted store for tomcat. And that tomcat server would communicate with some other server. A recent OS(AIX) upgrade apparently over-wrote the file at $JAVA_HOME/jre/lib/security/cacerts and that resulted in lost certificates and lot of issues with application hosted in tomcat. Looking at this is it a bad practice to relay up on $JAVA_HOME/jre/lib/security/cacerts ? What are the alternate (better|standard) ways to tackle this scenario? In terms of what is in the cacerts file, it's not necessarily worse

How to find current truststore on disk programatically?

由 五迷三道 提交于 2019-11-30 07:27:31
Is there any function which tells me what's the current truststore being used in my program. On windows, the default trust store is at JAVA_HOME\lib\security\cacerts. However, the default can be changed in a variety of ways. Using -Djavax.net.ssl.keyStore in the command line Using Keystore class. If the program is running on an App Server under which the application runs may set the store path through it's panel. If the program is running on Tomcat, then Tomcat settings may change the truststore. and many other ways. Is there a programmatic way by which I can find out the disk path of the

javax.net.ssl.SSLHandshakeException: Received fatal alert: unknown_ca

由 隐身守侯 提交于 2019-11-29 15:34:00
问题 I have to connect to a server via SSL dual authentication. I have added my own private key plus certificate to a keystore.jks and the self signed certificate of the server to a truststore.jks , both files are copied to /usr/share/tomcat7. The socket factory used by my code is delivered by the following provider: @Singleton public static class SecureSSLSocketFactoryProvider implements Provider<SSLSocketFactory> { private SSLSocketFactory sslSocketFactory; public SecureSSLSocketFactoryProvider(

Is it a bad practice to use Java standard keystore

由 一笑奈何 提交于 2019-11-29 15:07:26
问题 We had been using java standard keystore ( $JAVA_HOME/jre/lib/security/cacerts ) as the trusted store for tomcat. And that tomcat server would communicate with some other server. A recent OS(AIX) upgrade apparently over-wrote the file at $JAVA_HOME/jre/lib/security/cacerts and that resulted in lost certificates and lot of issues with application hosted in tomcat. Looking at this is it a bad practice to relay up on $JAVA_HOME/jre/lib/security/cacerts ? What are the alternate (better|standard)

PoolingHttpClientConnectionManager: How to do Https requests?

由 余生长醉 提交于 2019-11-28 17:57:59
问题 I'm currently trying to do multiple HttpGet requests at the same time with CloseableHttpClient . I googled on how to do that and the answer was to use a PoolingHttpClientConnectionManager . At this point I got this: PoolingHttpClientConnectionManager cManager = new PoolingHttpClientConnectionManager(); CloseableHttpClient httpClient = HttpClients.custom() .setConnectionManager(cManager) .build(); Then I tried a HttpGet request to http://www.google.com and everything worked fine. Then I

How to make Python use CA certificates from Mac OS TrustStore?

由 放肆的年华 提交于 2019-11-27 21:05:00
I need to use curtom root certificates on the company intranet and loading them in the Mac OS TrustStore (KeyChain) does solve the problem for all browsers and GUI apps. It seems that it works even with the version of curl that ships with Mac OS X but it doesn't work with python , even the version that ships with Mac OS 10.12 Sierra (Python 2.7.10) Still, it seems that I would be hit by: urllib2.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)> How can I solve this? Because I encounter this issue in lots and lots of Python tools I would really

Do you not need a password to access a truststore (made with the java keytool)?

由 邮差的信 提交于 2019-11-27 15:35:22
问题 I just created a truststore with the java keytool (for server authentication of a server that does not have a CA cert). However I just noticed something strange. I am starting my client like this: java -Djavax.net.ssl.trustStore=<PATHSTUFF>/client.keystore -classpath <STUFF> Client (Note: there is NOT a password specified) The above call works. However when I try this: java -classpath <STUFF> Client It does not work. (Obviously it does not work it requires the truststore). I was expecting to
订阅 truststore