44

Which trusted root certificates are included in Java, specifically Sun Java and IBM Java? How can I get the list myself? Does Java on Windows use certificates from operating system?

Improve this question

2 Answers 2

Reset to default
39

Go to the "Java Control Panel", "Secure" tab and click on "Certificates". Go to "System" tab and select "Secure CA" or "Secure Sites CA" from the drop down.

IIRC, the certificates are stored in a Java serialised file in jre/lib/security/cacerts. This is a standard Java keystore that can be manipulated with the keytool utility:

keytool -keystore "$JAVA_HOME\jre\lib\security\cacerts" -storepass changeit -list

I believe Mac OS X now uses the OS to handle certificates.

Improve this answer
4
  • Does this has anything to do with the system's own root certs? (E.g. Windows' certmgr.msc.)
    – Pacerier
    Nov 6, 2015 at 9:46
  • 4
    @Pacerier No, Java maintains its own list of trusted CAs.
    – Hexaholic
    Dec 14, 2015 at 15:49
  • I get Warning: use -cacerts option to access cacerts keystore. Adding -cacerts didn't resolve the warning.
    – joseph
    Aug 17, 2021 at 16:01
  • The command becomes keytool -storepass changeit -list -cacerts
    – joseph
    Aug 17, 2021 at 16:05
7

Although the Oracle JRE (formerly the Sun JRE) comes with a range of certificates as Tom mentioned, on Windows the JRE will also use certificates associated with the current browser by default for applets and Web Start apps (as long as you're using "Internet Explorer 5.0 or higher or Mozilla 1.4 or higher").

It should "just work" if you want to do signature signing verification, HTTPS server authentication or HTTPS client authentication (e.g. signing Web Start applications with a corporate certificate that has already been installed on your machine). For more complicated use cases you might find this document more helpful.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .