I have two Glassfish 7 installations, one for development on windows and one for production on linux. I noticed that in both the cacerts.jks in domains/domain1/config contains only the server certificates. This is causing problems with ssl connections initiated from my application because remote server certificates are not trusted. Which is the best way to solve ? I know how to import a single certificate, but I would need hundreds, so it is impractical. Can I say Glassfish to use cacerts from java installation ? Instead I think it is not a good idea to overwrite cacerts.jks because it may cause Glassfish to fail to start.
The root cause is known from years but it seems nobody cares, am I missing something ?
I have two Glassfish 7 installations, one for development on windows and one for production on linux. I noticed that in both the cacerts.jks in domains/domain1/config contains only the server certificates. This is causing problems with ssl connections initiated from my application because remote server certificates are not trusted. Which is the best way to solve ? I know how to import a single certificate, but I would need hundreds, so it is impractical. Can I say Glassfish to use cacerts from java installation ? Instead I think it is not a good idea to overwrite cacerts.jks because it may cause Glassfish to fail to start.
The root cause is known from years but it seems nobody cares, am I missing something ?
Share Improve this question asked Feb 5 at 12:14 FilippoFilippo 1,1611 gold badge12 silver badges30 bronze badges1 Answer
Reset to default 0yes, this is a known issue in GlassFish. Unfortunately, the GlassFish team hasn't find a solution that would improve this and keep GlassFish server secure in production at the same time. Here's a newer ticket, which is still open, and includes the discussion: https://github.com/eclipse-ee4j/glassfish/issues/24523
A workaround is to copy all the certificates from the JDK truststore, with this command:
keytool -importkeystore -v -noprompt -srckeystore "$JAVA_HOME/jre/lib/security/cacerts" -destkeystore "$GLASSFISH_HOME/glassfish/domains/domain1/config/cacerts.jks" -deststoretype jks