Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
794 views
in Technique[技术] by (71.8m points)

ssl - Import Windows certificates to Java

I have a java server that is trying to connect to an external Ldap server through SSL (as a client in order to perform queries).

I'm having trouble connecting since the certificate they send me upon connecting is trusted only in my local windows Truststore but is not present in java truststore (cacerts).

Is there a way to tell Java to trust any certificate that windows would have trust?

Or, alternatively, is there a way to import all trusted certificates from windows truststore to Java's cacerts?

Any idea would be appreciated.

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

Solution

On Windows, set the following JVM properties:

javax.net.ssl.trustStore=NUL
javax.net.ssl.trustStoreType=Windows-ROOT

I’ve successfully tested this with Java 7, which runs on a 64-bit Windows installation which trusts a self-signed CA.

Configuring the security provider

If the above solution works for you (it should), you may skip this section. Otherwise, check the setup of your Java Cryptography Extension (JCE), which is bundled with modern JDKs. Your JDK installation should have a property file which contains a list of security providers. The location of that file may vary with Java versions; mine is located at "%JAVA_HOME%jrelibsecurityjava.security". Inside that file, locate a set of properties whose names begin with security.provider. One of those entries should be set to sun.security.mscapi.SunMSCAPI.

Example

To set the properties at runtime, use the following Java code:

System.setProperty("javax.net.ssl.trustStore", "NUL");
System.setProperty("javax.net.ssl.trustStoreType", "Windows-ROOT");

Explanation

javax.net.ssl.trustStoreType

On Windows, Java ships with SunMSCAPI, a security provider which is actually a wrapper around the Windows CAPI.

Setting the javax.net.ssl.trustStoreType property to Windows-ROOT instructs Java to refer to the native Windows ROOT keystore for trusted certificates, which includes root CAs. (Similarly, setting javax.net.ssl.keyStoreType to Windows-MY tells Java to refer to the native Windows MY keystore for user-specific certificates and their corresponding keys).

javax.net.ssl.trustStore

If the javax.net.ssl.trustStoreType property is set to Windows-ROOT, one would expect that the value of javax.net.ssl.trustStore is ignored, and that it can be set to e.?g. NONE.

One common workaround for this issue is to set javax.net.ssl.trustStore to NONE, and then creating a dummy file whose file name is NONE. If you find yourself affected by this quirk, try setting javax.net.ssl.trustStore to NUL so you won’t have to create any dummy files.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

1.4m articles

1.4m replys

5 comments

56.8k users

...