JRE Keystore - Can't import certificate in user keystore (wrong password)

Question

I have an issue while importing certificate in users keystore for Java. (in appdata\LocalLow\Sun\Java\Deployment\Security).

I already have made scripts to add certificates to the "machine" keystore (in C:\Program Files...) and those works using the default password "changeit". But if I try to use this password (or changeme, which is for Mac OS IIRC), I can't list or import certificate in users keystore, for example trusted.certs and trusted.cacerts. Is there another "default password" for those?

Here is an example of the command I used :

.\keytool.exe -import -file C:\temp\CACERT_G3.cer -keystore "C:\Users\username\AppData\LocalLow\Sun\Java\Deployment\security\trusted.cacerts" -v -storepass "changeit"
erreur keytool : java.io.IOException: Keystore was tampered with, or password was incorrect
java.io.IOException: Keystore was tampered with, or password was incorrect
        at sun.security.provider.JavaKeyStore.engineLoad(Unknown Source)
        at sun.security.provider.JavaKeyStore$JKS.engineLoad(Unknown Source)
        at sun.security.provider.KeyStoreDelegator.engineLoad(Unknown Source)
        at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(Unknown Source)
        at java.security.KeyStore.load(Unknown Source)
        at sun.security.tools.keytool.Main.doCommands(Unknown Source)
        at sun.security.tools.keytool.Main.run(Unknown Source)
        at sun.security.tools.keytool.Main.main(Unknown Source)
Caused by: java.security.UnrecoverableKeyException: Password verification failed
        ... 8 more

(The reason of this requirement is that we have a problem with an app that ignores certicate when we put them in the machine keystore, but if a user manually add the cert is in keystore with the Control Panel GUI, it works. So we have to deploy that solution to 18k+ users)

Answer 1

The java User trusted.cacerts store is blank by default, like:

keytool -list -storepass "" -keystore .\path\to\Sun\Java\Deployment\Security\trusted.certs

But it is also in user-space, so any user could change the password, delete the keystore, etc.

---

However, you mention using the Control Panel GUI, certmgr.msc (User) or certlm.msc (System), which manages the windows trust store. These are separate locations, but are used for the same thing

Java can use the windows store with options like -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT, though there are some other settings required, depending on your configuration.

Importing certificates into the windows trusted ca certs would be done with different tools like group policy, cmd (certutil.exe), or powershell, for example