How do I find out what keystore my JVM is using?

java

keystore-management

jvm-security

ssl-configuration

byAlex Kataev·Dec 4, 2024

To find the keystore your JVM uses, check the javax.net.ssl.keyStore system property first. By default, the JVM looks for the keystore in the $JAVA_HOME/lib/security/cacerts directory. You can pull keystore location and type with the following lines of code:

System.out.println("Keystore: " + 
  (System.getProperty("javax.net.ssl.keyStore") != null ? System.getProperty("javax.net.ssl.keyStore") : KeyStore.getDefaultType() + " at " + System.getProperty("java.home") + "/lib/security/cacerts"));
System.out.println("Password: " + 
  (System.getProperty("javax.net.ssl.keyStorePassword") != null ? System.getProperty("javax.net.ssl.keyStorePassword") : "Changeit(default)"));

Making Sense of Keystores

Understanding keystores at a deeper level provides a foundation for implementing them correctly. Here are some key aspects:

Keystores guard your JVM
Safety of keystores relies on a strong password
Losing your keystore means losing access to your JVM's treasure trove of secure communication, like forgetting where you hid the One Ring 🧝‍♂️

Dealing with Custom Keystores

You may need to use a custom keystore due to specific security requirements of your application. To facilitate this, pass the -Djavax.net.ssl.trustStore option to the JVM:

-Djavax.net.ssl.trustStore=/my/secret/chamber/truststore.jks // Now try to find the Chamber of Secrets, Tom!

Ensure to set the matching password using -Djavax.net.ssl.trustStorePassword. Unprotected keystore entries are like open windows for the birdies...and hackers!

Errors - It's not you, it's them!

Error management matters during certificate imports; no one likes surprises! Always verify the keystore and password–think of it as knocking before you enter.⚔️️

Tools of the Trade

Utilize the jarsigner utility - a superhero for APKs! Jarsigner ensures your app's authenticity with keystore-borne signatures. It's like branding your cow!

Between Windows and Linux

Windows and Linux have subjective differences regarding default keystore location and management:

Windows: C:\Users\<YOUR_ACCOUNT>\.keystore 🪟
Linux: /home/<YOUR_ACCOUNT>/.keystore 🐧

Switch your commands according to your hosting OS 👓.

explain-codes / Java / How do I find out what keystore my JVM is using?

Linked

Unable to find valid certification path to requested target - error even after cert imported



Accept server's self-signed SSL certificate in Java client



How to import an existing X.509 certificate and private key in Java keystore to use in SSL?



Java Keytool error after importing certificate, "keytool error: java.io.FileNotFoundException & Access Denied"



How to convert .pfx file to keystore with private key?



Trusting all certificates using HttpClient over HTTPS



Java HTTPS Client Certificate Authentication



Making Sense of Keystores Dealing with Custom Keystores Errors - It's not you, it's them!Tools of the Trade Between Windows and Linux