Import Java Trusted Certificate to JRE

Question

I need to install a certificate from a Java app to a lot of people. I want to use a one click program or batch file to import it as a Trusted Certificate(in Control Panel->Security->Certificate). Then they won't need to press always allow first time they use the application.

I have extracted the needed certificate as both a .csr and as a .cer (the .csr via Control Panel and the .cer via keytool). Now I need to get one of them back without any clicking in menus.

I don't really understand the documentation of importing .cer with keytool and would like an example. Or are there an easier way than using keytool?

Answer 1

The chain of trust concept for the Java keytool and signed apps expects the user to confirm trust by taking an affirmative action. In this case the user would import the public key related to the code publisher into their keystore which requires them to have a Java keystore and password related to same. See http://java.sun.com/developer/onlineTraining/Programming/JDCBook/signed.html section stating -

6: Import Certificate as a Trusted Certificate

Ray downloads SSignedApplet.jar and CompanyCer.cer to his home directory. Ray must now >create a keystore database (raystore) and import the certificate into it using the alias >company. Ray uses keytool in his home directory to do this:...

This presents a considerable challenge thus the default behavior is to run signed apps with the OK dialog you are trying to address. Remotely accessing/creating Java keystores for others is counter to the security design.

Answer 2

A couple of examples on how to do this using "keytool"

• http://download.oracle.com/javase/tutorial/security/toolsign/rstep2.html
• http://www.talkingtree.com/blog/index.cfm?mode=entry&entry=25AA75A4-45A6-2844-7CA3EECD842DB576

The second link here has an example batch file:

@echo off
echo
echo This will import an X.509 SSL certificate into the keystore for the JVM
specified
echo
echo Press Control+C to abort.
pause
SETLOCAL

rem -------------------------------------------------
rem 1) Set the path to you JVM here
rem -------------------------------------------------
set JAVA_HOME=C:\j2sdk1.4.2_05

rem -------------------------------------------------
rem 2) SET THE CERTIFICATE NAME AND ALIAS HERE
rem -------------------------------------------------
set CERT_NAME=mycert.cer
set CERT_ALIAS=mycert

rem -------------------------------------------------
rem 3) SET THE KEYTOOL PASSWORD HERE
rem -------------------------------------------------
set KEYTOOL_PASS=changeit

rem -------------------------------------------------
rem DO NOT EDIT BELOW THIS LINE
rem -------------------------------------------------
set JAVA_SECURITY=%JAVA_HOME%\jre\lib\security
set CERT=%JAVA_SECURITY%\%CERT_NAME%
%JAVA_HOME%\jre\bin\keytool -import -trustcacerts -keystore %JAVA_SECURITY%\cacerts
-storepass %KEYTOOL_PASS% -noprompt -alias %CERT_ALIAS% -file %CERT%
ENDLOCAL
pause

Which part are you having trouble understanding? Is there a particular section that doesn't make sense? Do you need help with the batch file? Where, specifically, are you getting stuck? Perhaps I can help more specifically.