I work with a Java client and server that our startup recently acquired with very limited access to devs who built it. There is very limited documentation. It seems that the Java client used to connect to their server with TLS, there is an Nginx server rule for the right endpoint and a cert and private key associated with it. However, the developer claims that they did not need to have a public key present on the machine that runs the Java client.
So far I learnt that Java stores these trusted certs in the
jre/lib/security/cacerts file. After installing a self-signed cert in there I was able to make the Java client connect to the server with encryption.
Now the question is: how does the cert become available to Java? Does it have to be installed each time manually into
cacerts? Or will it become available to Java after we get a legit cert from some authority like Thawte? By "become available" I mean, will Java's HTTP lib go and find that cert with the public key authority? (I am not familiar with how cert verification works with non-browser clients.)
I am told by the dev of the Java client and server that the public key is downloaded from the server itself during the connection, which to me does not make sense and kind of defeats the purpose of security - if both public key and private key come from the same source, how can we trust it?
I am learning a lot of it as I go (it's a startup) and only know public crypto in theory from the university, but in practice it looks a little different. :) Thank you.