0

When we need to call an internal domain via HTTPS, Java doesn't allow it because it doesn't recognize the certificate that those domain web servers are sending (probably because those certificates are self-signed given that these domains are internal to the organization).

In that case, we're asked to import those certificates. But isn't the cacert location only there for storing root certificates and not self-signed certificates? I mean, the general procedure is that the certificate issuer's CA certificate is located in cacert and then the signature is verified using this certificate issuer's public key. Is the process changed when a self-signed certificate is received?

Or do I have to become my own Certification Authority which would probably require generating a new key pair, then sign the self-signed certificate with my private key, create a CA certificate containing my public key, and then install this certificate in cacerts?

Improve this question

3 Answers 3

Reset to default
2

I think you are slightly confused. Self-signed cert CAN be a root cert. When you are calling your internal domain via HTTPS, in order for TLS handshake to succeed (and, consequently, for communication to proceed over HTTPS) your local service needs to trust the server's CA. For that reason you import that CA into your trust store, thereby trusting the ID certs that the CA will sign. The ID cert is a certificate that the server will present during the TLS handshake. Let me know if I need to clarify further. Getting confused by X509 is the easiest thing to do:)

Improve this answer
7
  • When we're self-signing the certificate, there isn't a server CA (Certification Authority) and hence, no ID certs separate from the self-signed certificate. The self-signed certificate is all there is, no?
    – Daud
    Commented Jun 4, 2020 at 18:22
  • @Daud Incorrect. A server with a self-signed CA presents (during handshake) an ID cert signed by that CA. en.wikipedia.org/wiki/X.509 has all of the background.
    – postoronnim
    Commented Jun 4, 2020 at 18:27
  • "A server with a self-signed CA" -- Since I understand CA to mean Certification Authority, I don't get how can a CA be self-signed. Only a certificate can be self-signed, no? Secondly, to the extent I can understand, you're saying that clients don't import self-signed certificates into their trust store, but instead they import the root certificate of CA that has signed the self-signed certificate. But if the certificate being presented is signed by a server CA, how can it be called self-signed? I read the article you referred, but I'm still terribly confused.
    – Daud
    Commented Jun 4, 2020 at 19:13
  • 1
    @Daud You are confusing CA certs and ID certs - two different things. Self-signed CA is simply a CA generated internally. When a CA is created, the representation of it is a CA certificate. Now, ID certificates are those that are used for authentication of the parties in a TLS handshake. Each ID cert has to be signed by a CA.
    – postoronnim
    Commented Jun 4, 2020 at 19:23
  • Ok. What your're describing is creation of our own CA and then signing certificates with that CA's private key as explained here. In this way, the new CA would have to be added to trusted sources of clients and things proceed normally. But there's another way, and that's what I'm confused about more. If I don't create a CA and self-sign my certificate and install it in client, how will the normal process (explained in the question) be changed given that there're no CA in this case?
    – Daud
    Commented Jun 4, 2020 at 20:00
1

According to Java documentation, cacerts.jks is a name for the "Trust store".

Trust store doesn't necessarily have to store just the certificate authority's certs. Its all the certs that you trust.

Truststore file, cacerts.jks, contains the Application Server’s trusted certificates, including public keys for other entities. For a trusted certificate, the server has confirmed that the public key in the certificate belongs to the certificate’s owner. Trusted certificates generally include those of certification authorities (CAs).

It is upto you to decide whether you want to use an internal CA or not. But regardless, you can install the certificate that you trust in the cacerts store.

Improve this answer
0

All root certificates are self-signed.

What determines whether a certificate can be used to sign another certificate is the basic constraints field. See https://stackoverflow.com/questions/21319841/signing-certificate-with-another-certificate-signed-by-ca for more info.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .