2

Thanks to this stack overflow post, I found I am able to add a certificate to the java keystore in order to resolve an ssl handshake error. Although this method works, every user of my application also needs to run the commands, which seems avoidable. I do not control the certificate, so I cannot use a certificate that would be automatically widely recognized.

echo | openssl s_client -connect <host>:<port> | gsed -n '/BEGIN/,/END/p' > tmp.crt
sudo keytool -importcert -file tmp.crt -alias <alias_name> -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
rm tmp.crt

I am wondering if there is a solution via maven (or potentially another method) that allows me to fetch the certificate automatically so that other users don't have to run these commands. I could provide a bash script to "simplify" the process, but I don't want to mess with portability quirks. Even then, they'd still have to run the script manually, which I wouldn't prefer.

My project uses spring boot 2.0, in case it helps knowing that. I'm new to spring boot and know it has a lot of features, but I don't think it has something to support auto-adding specific certificates.

I know maven can be run such that all certificates are accepted, which I don't want either. Maybe there is a plugin that I could use?

I would prefer a solution that can be put into a pom.xml file as opposed to command line arguments so that I can commit my changes into a github repository.

Matt
  • 378
  • 5
  • 9
  • 1
    You can do it programmatically inside your project: https://stackoverflow.com/questions/18889058/programmatically-import-ca-trust-cert-into-existing-keystore-file-without-using – Mzzl Sep 16 '19 at 17:02
  • @Mzzl Thanks for the link. It looks like that only loads a cert file already on the filesystem. Do you know how to download the cert as well? – Matt Sep 16 '19 at 17:21
  • You could probably use something like a URLConnection.getInputStream rather than a FileInputStream to fetch it from a server – Mzzl Sep 16 '19 at 17:53
  • You're barking up the wrong tree. The simple solution is to use a CA-signed certificate. – user207421 Sep 16 '19 at 21:05

0 Answers0