keytool asking for password to read java certificates ubuntu 18.04

南楼画角 提交于 2021-01-05 11:09:16

问题


I have a fresh installation of ubuntu 18.04. I'm having problems with my builds (e.g. Maven and Gradle) accessing a repository https, the message it shows is:

java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

When I try to access the certificates from my keystore using the following command:

keytool -list -keystore /etc/ssl/certs/java/cacerts

I get prompted with a password, which is not a problem, but if I just press enter without inputting the password It does not show any of the entries.

If I put the password, all the certificates appear normally. What I had to do is add to all my Java applications the following system prop: javax.net.ssl.trustStorePassword=changeit

Then everything works normally. What I'm doing wrong?

EDIT:

This is the permission on the cacerts right now:

-rw-r--r-- 1 root root 167K jun  8 11:21 /etc/ssl/certs/java/cacerts

so everyone can read. If I try to use list without a password:

keytool -list -keystore /etc/ssl/certs/java/cacerts                                                                             ✔  308  10:27:15 
Enter keystore password:  

*****************  WARNING WARNING WARNING  *****************
* The integrity of the information stored in your keystore  *
* has NOT been verified!  In order to verify its integrity, *
* you must provide your keystore password.                  *
*****************  WARNING WARNING WARNING  *****************

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 0 entries

with the password:keytool -list -keystore /etc/ssl/certs/java/cacerts                                                                             ✔  310  10:36:33 
Enter keystore password:  
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 134 entries

回答1:


read should be password free, only write operations should need a password

You misunderstand the purpose of the password. The password is (in effect) a decryption key for the keystore. It protects against unauthorized reads, irrespective of file system permissions.

If you want / need to allow reads without a password but protect against writes, you need to use file system permissions for that. The following Q&A explains how to remove the default password:

  • How do I get into a non-password protected Java keystore or change the password?

Here's an explanation why a password controlling write (and not read) cannot work.

Suppose that the trusted key store is readable without a password. A user could then do the following:

  • Read the keys in the keystore
  • Create a new (empty) keystore
  • Write the keys to the new keystore
  • Rename the new keystore so that it replaces the old keystore.

This could be done using a custom Java application or (probably) the standard keytool utility and the mv command.

The only way that you can prevent this is to stop the application (or the user) from replacing the old keystore with the new one via file system permissions. If you can't do that (e.g. because the user has admin-level access) then there is no solution that doesn't have security holes.



来源:https://stackoverflow.com/questions/50798434/keytool-asking-for-password-to-read-java-certificates-ubuntu-18-04

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!