0

Do we need to explicitly import the Trusted CA Certificates into the java keystore? If so, then why?

I can understand that we should always import the Self-Signed SSL certificates into the keystore, because they are not verified ones and java can't trust unless it's there in the keystore. But do we need to exercise the same thing even for Trusted CA Production Certificates?

Note: I'm using jdk v1.6.x.

4
  • i think you should put all types of certificates into keystore, otherwise java will have no way to verify. for example, browsers usually verify the certificate by means of their certificate storage, local or remote
    – mangusta
    Oct 29, 2015 at 8:38
  • @mangusta The Java keystore or trusstore have nothing to do with what browsers do.
    – user207421
    Oct 29, 2015 at 9:06
  • @EJP, I never mentioned about any relation between Java keystore and browsers. It was just an example, to show that the certificates are always stored somewhere, whether the client is a browser or a Java program
    – mangusta
    Oct 30, 2015 at 2:23
  • @mangusta So you need to clarify it. It's far from clear.
    – user207421
    Oct 30, 2015 at 3:38

2 Answers 2

0

I can understand that we should always import the Self-Signed SSL certificates into the keystore, because they are not verified ones and java can't trust unless it's there in the keystore.

In the trust store.

But do we need to exercise the same thing even for Trusted CA Production Certificates?

No. If the CA is already trusted by the Java truststore you don't need to do anything.

-1

It does not matter, if you use a self-signed certificate or a CA certificate. You need to import it into the truststore (which can be the same file as the keystore) to make it available to your java application. Java itself does not load any trusted certificate from the Internet because it does not know, which site it can trust, and which not.

1
  • It does matter. If it's signed by a recognized CA you don't have to do anything.
    – user207421
    Oct 29, 2015 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.