SSL inspection with Java applications

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL inspection with Java applications

L2 Linker

I have found that Java appears to use it's own certificate store which is causing me grief.  Work around is to install our root CA within the Java control panel but this is not efficient for a large organization.  Has anyone found a way to push root CA's to Java through GPO's or make Java use the Windows certificate store using GPO's?

 

We have a script right now that will import the cert, but our issue is going to come when the next major release of Java comes and everything will break again.  Just looking for an automated way of doing things.

1 accepted solution

Accepted Solutions

So I did some testing and found that the script works.  Once you do a Java upgrade it uses a new cert store again, so the script has to be ran once again.  This is a pain in the @$$ but I guess it is the best that I am going to get for now without restricting the version of Java on our user's systems.

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

@DIRTT,

The official way of doing this would be to set your own truststore if you don't want to use the default. The quick way would be to start Java with -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT. In short, however, this is something that Java really isn't designed to do. If this is something that you have an in-house Java application you need to have your developers include a custom keystore in the application and utilize that keystore for the application itself. 

 

Just to put your mind at ease, however, I highly doubt that any script you make right now would break during the next major release of Java. 

Thanks for the info.  I am still playing around with this but it is not the script breaking that we are worried about it is having to re-run the script when updates are installed.

So I did some testing and found that the script works.  Once you do a Java upgrade it uses a new cert store again, so the script has to be ran once again.  This is a pain in the @$$ but I guess it is the best that I am going to get for now without restricting the version of Java on our user's systems.

  • 1 accepted solution
  • 4739 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!