SSL/TLS certificates in Java applications

Keystore vs. Truststore¶

The keystore contains your private key and certificate. The truststore contains CA certificates you trust. Never modify the default cacerts — create a copy.

Keytool¶

Import a certificate, generate a self-signed certificate, export, list contents. For mutual TLS (enterprise integration): both parties need both a keystore and a truststore.

Debugging and common errors¶

-Djavax.net.debug=ssl,handshake for detailed logging. PKIX path failed = CA missing from truststore. Certificate expired = renew it. Hostname mismatch = wrong CN/SAN.

Automation¶

A Perl script + Nagios monitoring of certificate expiry. 60 days = WARNING, 30 days = CRITICAL. With dozens of servers, manual management is unsustainable.

Rules¶

1. Never disable SSL validation. 2. Use a custom truststore. 3. Monitor certificate expiry. 4. Document the certificate inventory.