Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to install a certificate from a Java app to a lot of people. I want to use a one click program or batch file to import it as a Trusted Certificate(in Control Panel->Security->Certificate). Then they won't need to press always allow first time they use the application.

I have extracted the needed certificate as both a .csr and as a .cer (the .csr via Control Panel and the .cer via keytool). Now I need to get one of them back without any clicking in menus.

I don't really understand the documentation of importing .cer with keytool and would like an example. Or are there an easier way than using keytool?

share|improve this question

A couple of examples on how to do this using "keytool"

The second link here has an example batch file:

@echo off
echo This will import an X.509 SSL certificate into the keystore for the JVM
echo Press Control+C to abort.

rem -------------------------------------------------
rem 1) Set the path to you JVM here
rem -------------------------------------------------
set JAVA_HOME=C:\j2sdk1.4.2_05

rem -------------------------------------------------
rem -------------------------------------------------
set CERT_NAME=mycert.cer
set CERT_ALIAS=mycert

rem -------------------------------------------------
rem -------------------------------------------------
set KEYTOOL_PASS=changeit

rem -------------------------------------------------
rem -------------------------------------------------
set JAVA_SECURITY=%JAVA_HOME%\jre\lib\security
%JAVA_HOME%\jre\bin\keytool -import -trustcacerts -keystore %JAVA_SECURITY%\cacerts
-storepass %KEYTOOL_PASS% -noprompt -alias %CERT_ALIAS% -file %CERT%

Which part are you having trouble understanding? Is there a particular section that doesn't make sense? Do you need help with the batch file? Where, specifically, are you getting stuck? Perhaps I can help more specifically.

share|improve this answer
Thanks for the Googling :( As I said I had problems understanding how to get it in. – Zalastax May 10 '11 at 18:25
I've updated my answer. – jefflunt May 10 '11 at 18:42
On the second page I think the main problem was the readability of the page. I will see if I can get it all trought – Zalastax May 10 '11 at 18:57
The problem I have now is that I don't know the password. What should enter? I didn't do anything with the certificate after I got it out from keytool. – Zalastax May 10 '11 at 19:06
I found the password out by looking in the batch file. But nothing seems to happen. After entering the right password I don't get any errors but cmd don't seem to do anything either. The certificate don't seem to be there either. – Zalastax May 10 '11 at 19:27

The chain of trust concept for the Java keytool and signed apps expects the user to confirm trust by taking an affirmative action. In this case the user would import the public key related to the code publisher into their keystore which requires them to have a Java keystore and password related to same. See section stating -

6: Import Certificate as a Trusted Certificate

Ray downloads SSignedApplet.jar and CompanyCer.cer to his home directory. Ray must now >create a keystore database (raystore) and import the certificate into it using the alias >company. Ray uses keytool in his home directory to do this:...

This presents a considerable challenge thus the default behavior is to run signed apps with the OK dialog you are trying to address. Remotely accessing/creating Java keystores for others is counter to the security design.

share|improve this answer

We had a similar problem here trying to avoid certificate acceptance pop ups on signed applets. We found a fix, it's not pretty, but it seems to have worked so far. Every user has a trusted.certs keystore (depending on OS it's somewhere under <username>/AppData...Sun/Java/Deployment/trusted.certs) that is generated the first time they access an applet on the given machine. You can have a startup script replace this file for each user from somewhere central. To create the new trusted.certs file, we have just accepted the certs on a single machine that we want in there, and then copy that entire trusted.certs keystore over to the new machine.

Loading into the central certs keystore for the JRE did not work for us, so we went this other route. It's ugly, and if you had the password to that keystore you could also set that via batch script as above, but is what we did.

This approach made the most sense to us since it worked on a user by user basis, and since it's tied to a logon, it allows for centralized administration and mass updates.

share|improve this answer

In C:\Windows\Sun\Java\Deployment create a file called deployment.config.

The contents of this file should be:


Create another file in the same location called and include this line in\:\\Windows\\Sun\\Java\\Deployment\\trusted.certs

copy the trusted.certs from a user profile with all of the necessary certs to c:\windows\sun\java\deployments also.

All certs contained int he file will now appear in java control panel under System/Trusted Certificates

you can also do this with most other java properties by including them in the file such as:


The first line sets the property, the second (with .locked at the end) prevents the users from changing the properties in java control panel

you can also manage the site exception list by creating a file in the same location called exception.sites and adding the web addresses to this file (one site per line) and including this line in\:\\Windows\\Sun\\Java\\Deployment\\exception.sites

this link will explain most of the configurable properties:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.