topic Re: SSL inspection with Java applications in General Topics

SSL inspection with Java applications

DIRTT — Mon, 01 Apr 2019 17:22:35 GMT

I have found that Java appears to use it's own certificate store which is causing me grief. Work around is to install our root CA within the Java control panel but this is not efficient for a large organization. Has anyone found a way to push root CA's to Java through GPO's or make Java use the Windows certificate store using GPO's?

We have a script right now that will import the cert, but our issue is going to come when the next major release of Java comes and everything will break again. Just looking for an automated way of doing things.

Re: SSL inspection with Java applications

BPry — Tue, 02 Apr 2019 03:27:43 GMT

@DIRTT,

The official way of doing this would be to set your own truststore if you don't want to use the default. The quick way would be to start Java with -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT. In short, however, this is something that Java really isn't designed to do. If this is something that you have an in-house Java application you need to have your developers include a custom keystore in the application and utilize that keystore for the application itself.

Just to put your mind at ease, however, I highly doubt that any script you make right now would break during the next major release of Java.

Re: SSL inspection with Java applications

DIRTT — Tue, 02 Apr 2019 20:29:59 GMT

Thanks for the info. I am still playing around with this but it is not the script breaking that we are worried about it is having to re-run the script when updates are installed.

Re: SSL inspection with Java applications

DIRTT — Wed, 03 Apr 2019 14:46:33 GMT

So I did some testing and found that the script works. Once you do a Java upgrade it uses a new cert store again, so the script has to be ran once again. This is a pain in the @$$ but I guess it is the best that I am going to get for now without restricting the version of Java on our user's systems.