Question

I have found the following post, which I think I may help because I need a way of verifying my website (that my java application connects to) without having to use the java keystore:

http://www.mombu.com/programming/java/t-ssl-for-java-without-keystores-1366416.html

However, I’m quite new to the world of SSL and don’t know which files and passwords I need to use, so if anybody can point me in the right direction that would be great. If you didn’t guess, I got my SSL certificate from StartSSL, who are ran/owned/something by StartCom Ltd. Here is a post I used for putting the details into the keystore:

https://forum.startcom.org/viewtopic.php?t=1390

Thanks in Advance!

Alternitively, is there any way for me to use a custom keystore. i.e I’ll do what I need with the default keystore and then copy the keystore into the .JAR so that I can tell my application to use the one in the .JAR instead of the one in the Java install directory, etc…

Answer 1

Yes, you can create and use your own keystore for your app using the keytool utility which comes with the JDK.

Basically, a keystore is a datastore for your keys & certificates, which will be used in your app either to authenticate yourself to another entity or to digitally sign your messages or any other data.

A distinct keystore called trustore is used to keep the public key certificates of the entities you trust.

You can have these keystores placed in your classpath and specify the path in your app in code like (these are VM params which will affect all apps running in this VM):

Properties properties = System.getProperties();
properties.put("javax.net.ssl.keyStore", path/to/keystorefile);
properties.put("javax.net.ssl.keyStorePassword", keyStorePassword);
properties.put("javax.net.ssl.trustStore", path/to/truststore);
properties.put("javax.net.ssl.trustStorePassword", trustStorePassword);

EDIT:

Yes, you can specify the keystore & trustore locations and their passwords in a property file and load the properties file as myProperties.load(myProperties.getClass().getResourceAsStream("/path/to/proertyfile.properties"));

and then use it in your code as (exception handling omitted)(this will not affect any other app):

KeyStore mykeystore = KeyStore.getInstance("JKS");
InputStream is = new FileInputStream("/path/from/myproperties");
mykeystore.load(is, myKeystorePasswordFromProperties.toCharArray());