5

I recently had to add my corporate root CA (based on AD CS) into the JRE default truststore (the $JAVA_HOME/lib/security/cacerts file). I then discovered (as I am new to this) that the default password is changeit.

I found various posts explaining how to change it but there are two questions I can't find answers to:

  1. Is keeping the default password a security risk? I guess an attacker could then import compromised certificates so clients trust them
  2. What are the impacts of changing this truststore password? I also guess the JRE can look for root CA inside because it knows the default password. Once changed, will it have to be provided somewhere (config file, ...)?

We mainly use Java on Windows for websites which have applets, so we don't start anything from the command line (on which I know the password can be provided).

LoTus
  • 65
  • 1
  • 5
  • You don't need to know the password to read a truststore. You only need to know the password to read key entries in a KeyStore. – user207421 Nov 28 '16 at 20:56
  • I am a bit confused then. When I issue the command `keytool -list -alias mycorpCA -keystore $JAVA_HOME/lib/security/cacerts`, I am asked to provide the password. – LoTus Nov 29 '16 at 18:59

2 Answers2

0

Regarding your second question, there are system properties to specify passwords for default trust store and default key store. The one for the trust store is: javax.net.ssl.trustStorePassword

I found that information at https://stackoverflow.com/a/5871352/5629418

If the attacker can read your Java system properties, either in a config file or by running a Java program, then changing the password will be mostly futile though.

Roland Weber
  • 1,865
  • 2
  • 17
  • 27
0

Regarding your second question: "What are the impacts of changing this truststore password?"

One of the implications of changing of that password is that the memory bits holding the new password value is better to allocate and to store somewhere for their following retrievals, provisions for the corresponding accesses. And if that password is not stored, it is better to have a procedure about how to restore it then.

That article contains the code for changing such password:

thetechawesomeness.ideasmatter.info

Oleksii Kyslytsyn
  • 2,458
  • 2
  • 27
  • 43