SSL inspection with Java applications

[DIRTT]

I have found that Java appears to use it's own certificate store which is causing me grief.  Work around is to install our root CA within the Java control panel but this is not efficient for a large organization.  Has anyone found a way to push root CA's to Java through GPO's or make Java use the Windows certificate store using GPO's?

We have a script right now that will import the cert, but our issue is going to come when the next major release of Java comes and everything will break again.  Just looking for an automated way of doing things.

[BPry]

@DIRTT,

The official way of doing this would be to set your own truststore if you don't want to use the default. The quick way would be to start Java with -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT. In short, however, this is something that Java really isn't designed to do. If this is something that you have an in-house Java application you need to have your developers include a custom keystore in the application and utilize that keystore for the application itself. 

Just to put your mind at ease, however, I highly doubt that any script you make right now would break during the next major release of Java. 

[DIRTT]

Thanks for the info.  I am still playing around with this but it is not the script breaking that we are worried about it is having to re-run the script when updates are installed.

[DIRTT · Accepted solution]

So I did some testing and found that the script works.  Once you do a Java upgrade it uses a new cert store again, so the script has to be ran once again.  This is a pain in the @$$ but I guess it is the best that I am going to get for now without restricting the version of Java on our user's systems.