应用程序服务器如何不使用密码读取自定义信任存储

Question

I have created custom truststore using keytool and provided password while creating it. I configured Jboss EAP to use the trust store using the following options:

JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=/path/to/truststore.jks"

I didn't provide any truststore password in jboss configuration.

My question is how jboss is able to read the trust store without password ? I am seeing that the outbound ssl connections from servers are working fine after configuring the trust store.

Answer 1

The password is not really needed to read the truststore entries of a JKS. The file is not encrypted and only the private keys are encrypted with their own password. See JKS protection See also this example code to change JKS password without know the orginal

It seems that the cryptographic provider used by your Jboss deployment is omitting the password to read the entries