Add SSL self signed certificate to Java keystore for use by JAX-RS in webstart app

Question

I have a webstart application I'm developing and testing on my local computer and wish to use self signed certificates during testing. The application connects to my rest service (also running locally with a self signed cert).

I want the application to use https (SSL) to connect to the local service, which has a self signed certificate that is already in the Java keystore.

I know the certificate is in the keystore because the application works fine when I run it in IntelliJ (ie, not through webstart). When I use my local apache web server, open the JNLP file from a browser, and launch, then the application jars are verified okay and the application launches... but then the SSL connection fails with the much loathed

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I have verified the same versions of Java are being used (and therefore the same keystore) in webstart and in the IDE (for running the application, not the IDE itself).

Does Java webstart use a different keystore? I'm on a Mac. Grails is on the backend.

Answer 1

Java Webstart uses the Java internet plugin on Macs. So even though the versions of the JVM may match, they are running from different directories. This is complicated by the fact that when the webstart application launches it does not use the Java internet plugin to verify the jar signatures!! So you must add the certs for the jars in the keystore located somewhere like

/Library/Java/JavaVirtualMachines/jdk1.8.0_91.jdk/Contents/Home/jre/lib/security/cacerts

And the cert for the service must be added to the keystore located somewhere like

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/cacerts