0

Java/JDK/JRE they have a keystore cacerts under lib\Security folder as shown below

enter image description here

Java comes with around 93 certificates out of box, These are not self-signed these are supplied by java itself

enter image description here

These certificates are SHA1 Certificates

Background

The application that we use depends upon java and our company saying they are moving away from SHA1 and want to change these SHA1 to SHA2.

Questions

  1. Is there a version/type of java that does uses SHA2 for out of box certs?
  2. Is it possible to replace out of box certs with SHA2?
Improve this question
5
  • Java fully supports SHA2 certificates.. It also is important to point out cacerts also supports SHA2 certificates. Be sure you know how to import certificates by reading this
    – Ramhound
    Mar 23, 2016 at 15:54
  • 1
    Oracle is the identity, who would need to issue the default root CAs, to be SHA256 certificates. Its not clear if you understand the contents of cacerts or not.. You can can delete the root CAs then add only SHA256 certificates if you want with the understand a Java update might or might effect the store.
    – Ramhound
    Mar 23, 2016 at 15:59
  • Do you understand, its simply the certificate store Java will use, so if you don't want to support SHA1 certificates you don't add SHA1 certificates? How exactly did you verify that every certificate in the java certificate store is only SHA1?
    – Ramhound
    Mar 23, 2016 at 16:04
  • Question is edited, these are out of box certs not added by us
    – SeanClt
    Mar 23, 2016 at 16:24
  • I understand they are "out of box" certificates. Just remove the SHA1 certificates and replace them with the SHA256 certificates you want to use.
    – Ramhound
    Mar 23, 2016 at 16:39

2 Answers 2

Reset to default
1

This is a late reply, but there's an important misconception in the question that should be cleared for future readers. Keytool output can be misleading: it shows a SHA1 fingerprint for all certificates, whether they use SHA1 or SHA2 signing hash function (which is what you're looking for). SHA1 fingerprint is simply a unique ID of the certificate.

To find SHA2 certificates in a bundle, you can't rely on keytool -list. You need to extract all certificates with keytool -exportcert, and then check the details for each one with keytool -printcert: SHA2 certificates will have this line in the output:

Signature algorithm name: SHA256withRSA

SHA2 CA certificates have been part of the standard Java cacerts bundle since JRE 1.6.14 (see certificate ttelesecglobalrootclass3ca), if not earlier.

Improve this answer
0

As CA providers upgrade their certificates to SHA-2 they submit the new certificates for inclusion in the various products that use SSL such as browsers and Java.

Obviously, older versions of a given product will not have newer certificates (there is no mechanism to automatically upgrade them).

If the provider does not submit a new certificate it will not be included in Java and you will have to manually add newer certificates into the Java trusted certificate repository.

So if you get an error like:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

... then you probably do not have the correct CA root certificate and you will need to manually download and install the certificates into the Java trusted certificate keystore. Here is a method of doing this: http://mikepilat.com/2011/05/adding-a-certificate-authority-to-the-java-runtime.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .