3 ms·
It's a nightmare for using a custom CA for server certs too. You can't just add a new CA, you have to rebuild the entire keystore. And then you need to do it a
by thayne 1y ago
It's a nightmare for using a custom CA for server certs too.
You can't just add a new CA, you have to rebuild the entire keystore. And then you need to do it again every time you update the JVM, or risk missing updates to the default keystore.
For some reason the keystore is required to be protected by a password, even if it doesn't contain any secret keys.
The documentation for the tools that manage keystores is incomplete and sometimes out of date.
The whole thing is a relic from another time and could really use some modernization.
- jeroenhd 1y agoThere are workarounds for that, by specifying a custom key store file and overriding the socket factory to force it to load your keys. Unfortunately, most example code for SSL socket factories just disable TLS validation entirely. So yes, your custom CA now works reliably, but unfortunately so do self-signed certificates if you're not careful. Luckily, modern Java doesn't need keystores anymore. Unfortunately, half the world seems stuck on Java 8.
- pixl97 1y ago>most example code for SSL socket factories just disable TLS validation entirely. I see this happen in large enterprise far more often than it should, like the kind of business where disabling SSL is a baaaad idea for the kind of attacks they're apt to get.