打开默认Java信任库的最可移植的方法是什么？

Question

I am programmatically manipulating the default Java TrustStore. In order to do that, I need its path.

I tried reading javax.net.ssl.keyStore and javax.net.ssl.trustStore and they're both undefined.

I came up with System.getenv("JAVA_HOME") + "/jre/lib/security/cacerts" , is it the right approach?

It works but I'd like the code to be as portable and future-proof as possible.

Edits:

1. This is for an app running in AWS Lambda, Lamda does not allow to customize or provide your own JRE.
2. This question was originally asking for the default keystore. I changed it to truststore since keystores are app-specific.

Answer 1

No. You probably won't have permission to modify files in an installed JRE. And that path does not exist, starting with Java 9.

Furthermore, as of Java 11, there is no JRE. The only way to distribute an application is to use jlink to create an image containing a subset of Java SE containing only the modules required by the application.

In summary, you can't rely on a Java installation, and even if you find one, you can't rely on the presence of a default keystore file.

You shouldn't be changing a user's Java installation anyway. Your code should include a custom keystore file as an application resource , which you should pass to Keystore.load :

InputStream embeddedKeystore =
    MyApplication.class.getResourceAsStream("custom-keystore.pkcs");

assert embeddedKeystore != null : "Application was not properly built."
    + " Keystore is missing!";

KeyStore keystore = KeyStore.getInstance("pkcs12");
keystore.load(embeddedKeystore,
    new char[] { 's', 'w', 'o', 'r', 'd', 'f', 'i', 's', 'h' });

embeddedKeystore.close();

Answer 2

Posting my solution so far.

In my question, I was reading from System.getenv("JAVA_HOME") + "/jre/lib/security/cacerts" but that is the path of the JDK (which isn't installed on AWS Lambda) and is the root of the /jre folder.

String trustStoreLocation = Optional.ofNullable(System.getProperty("javax.net.ssl.trustStore"))
    .orElseGet(() -> System.getProperty("java.home") + "/lib/security/cacerts");

File trustStoreFile = new File(trustStoreLocation);
if (!trustStoreFile.exists()) {
    throw new RuntimeException("Unable to locate the Java TrustStore: the system property javax.net.ssl.trustStore is undefined or " + trustStoreLocation + " does not exist.");
}

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
try (FileInputStream fis = new FileInputStream(trustStoreFile)) {
    keyStore.load(fis, new char[] { 't','h','e',' ','p','a','s','s','w','o','r','d' });
}

Answer 3

You can use your own path for the trustsotre and the keystore using passing system property option to the JVM

-Djavax.net.ssl.keyStore=your_custom_path
-Djavax.net.ssl.trustStore=your_custom_path