Question

I’ve got a java applet that loads some pre-installed native code extensions to display custom content in the browser. Some of this content may include native code to be loaded by the JVM. Obviously, this is a security concern. I’d like to enforce that all content comes only from authorized servers.

The path I’ve been following to accomplish this is to create a keystore that contains just one SSL certificate. I set the keystore location and password and turned on debug output.

System.setProperty("javax.net.ssl.keyStore", "C:\\keys\\keystore");
System.setProperty("javax.net.ssl.keyStorePassword", "changeit");
System.setProperty("javax.net.debug", "ssl");

I was under the impression that this would mean that the JVM would have access to only the one keystore file and consequently the one key inside it. In fact, the SSL debug info lists something like 75 CA keys in addition to the one key I added. Clearly, this isn’t going to keep anyone from sending us untrusted code.

Is there a way to tell the SSL system to only use a single certificate? Should I be using a completely different approach?

Update:
Changing the cacerts file isn’t really an option here. The JVM should continue to function normally for other applications using it. Is there a way, at runtime, to elect not to load that file? I’m looking at the TrustManager and KeyManager classes but I don’t really understand how to use them.

Answer 1

You need to set the javax.net.ssl.trustStore system property to point to a keystore with your one certificate in it. The keystore is for your authentication credentials, not your peer’s.