Get instance of keystore that JVM loads by default

Question

I was playing with security in Java and Tomcat and I came to the point where I was curious which keystore/truststore was loaded by the JVM at the end. Even though I had my own keystore created and in Tomcat configuration, this was used both as keystore and trustore, the reality was that default cacerts file was loaded as truststore (as keystore, my file was used properly).

I was trying to get the name of the file that JVM loads, but I haven't found the solution. My idea was to get System.getProperty("javax.net.ssl.keyStore") but this gave me null. I tried to set this both in Tomcat's server.xml via Connector and as a command line parameter -Djavax.net.ssl.keyStore="file". I am sure that the command line parameter was provided correctly as I am setting JMX paramneters at the same place.

br, Martin

Answer 1

Are you on Tomcat 6?

I've tried setting this in catalina.bat as

set JAVA_OPTS=%JAVA_OPTS% %LOGGING_CONFIG% -Djavax.net.ssl.keyStore="path-to-file"

and it reflects in my code used as System.getProperty("javax.net.ssl.keyStore")

Also, for your info, there was a Bugzilla on other SSL attributes being ignored which was fixed in 6.0.16. keyStore is not specifically mentioned there, but my version is 6.0.20 and it works

Answer 2

You won't necessarily be able to get exactly what you want from the file name of even the type and setting the keystore in the connector will have absolutely no effect on the system property.

In addition, the keystore, whether specified from the javax.net.ssl.keyStore property or instantiated explicitly is only one part of the setup of the KeyManager and the SSLContext. (By default, Apache Tomcat will use files and a relatively simple loading mechanism, but it's also possible to customize this using Tomcat's SSLImplementation.) If you really want to see what's being loaded, I would look at the JSSE debugging flags, more specifically, something like this:

-Djavax.net.debug=SSL,keymanager,trustmanager

EDIT: I should add that there is no default keystore generally speaking (outside the context of Tomcat), only a default truststore. Tomcat's JSSEImplementation uses System.getProperty("user.home") + "/.keystore" by default.