topic Re: Where is the truststore located? in Alfresco Forum

Where is the truststore located?

fabrice7 — Mon, 30 Nov 2020 14:29:44 GMT

Hello,

I need to run Alfresco Repository and Share 6.2.2 CE such that all traffic is encrypted. I created a PKI and now I need to import the root CA certificate for both Repository and Share. I ran the usual `update-ca-trust` and I can see my root CA certificate has been added to `/etc/pki/ca-trust/extracted/java/cacerts`. Yet, I still get exceptions looking like `can't build certificate path`.

Someone on my team suggested that it could be because Repository and Share use their own trust stores, not the system ones. Is that true? If yes, were are the trust stores for Repository and Share?

Thanks a lot for any help!

Re: Where is the truststore located?

angelborroy — Mon, 30 Nov 2020 16:05:18 GMT

They are true.

Hope this helps:

https://hub.alfresco.com/t5/alfresco-content-services-blog/alfresco-mtls-configuration-deep-dive/ba-p/296422

Re: Where is the truststore located?

fabrice7 — Mon, 30 Nov 2020 16:42:49 GMT

Hi @angelborroy ,

Thanks for the link. Does Alfresco has a default trust store file? Or do I have to create one myself and modify the alfresco-global.properties?

Thanks!

Re: Where is the truststore located?

fabrice7 — Tue, 01 Dec 2020 15:55:20 GMT

Hi,

OK, a colleague of mine finally found the problem (and the solution). The update-ca-trust command apparently doesn't work very well and I had to manually add the certificate using keytool. For reference the command to use is:

keytool -import -keystore /usr/java/openjdk-11.0.7+10/lib/security/cacerts -file /path/to/myownrootca.crt -alias myrootca -storetype jks -storepass changeit -noprompt -trustcacerts

After that, I couldn't see the "can't build certificate path" exceptions anymore.