Is it possible to create JKS keystore file without a password?

Question

I'm experimenting with OSGi conditional permissions mechanism. More specifically, I'm trying to use org.osgi.service.condpermadmin.BundleSignerCondition to restrict which bundles can be started. Documentation I have states that in order to use this permission, I must specify the path to JKS keystores using org.osgi.framework.trust.repositories framework configuration property. However, the same documentation mentions that JKS mentioned in this property must not have a password. So the question is: how to create a JKS without a password? Keytool utility refuses to create JKS with blank password.

Answer 1

You cannot create a keystore with a blank password with keytool since a while, but you can still do it programmatically.

Read a cert like this:

private static Certificate readCert(String path) throws IOException, CertificateException {
    try (FileInputStream fin = new FileInputStream(path)) {
        return CertificateFactory.getInstance("X.509").generateCertificate(fin);
    }
}

Than create the keystore with the empty password like this:

try {
    // Reading the cert
    Certificate cert = readCert("/tmp/cert.cert");

    // Creating an empty JKS keystore
    KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
    keystore.load(null, null);

    // Adding the cert to the keystore
    keystore.setCertificateEntry("somecert", cert);

    // Saving the keystore with a zero length password
    FileOutputStream fout = new FileOutputStream("/tmp/keystore");
    keystore.store(fout, new char[0]);
} catch (GeneralSecurityException | IOException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
}

Run the command:

keytool -list -keystore keystore

It will ask for a password but you can simply push an enter. You will get the following warning, but the content of the keystore will be listed:

*****************  WARNING WARNING WARNING  *****************
* The integrity of the information stored in your keystore  *
* has NOT been verified!  In order to verify its integrity, *
* you must provide your keystore password.                  *
*****************  WARNING WARNING WARNING  *****************

This might work for you.