ErgoTechWiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Trusting Self-Signed Certificates in TransSECS =====

When TransSECS connects to an HTTPS endpoint that uses a self-signed certificate, Java may reject the connection unless the certificate is explicitly trusted.

Disabling certificate validation is not recommended, especially in production environments. A more secure and stable approach is to configure Java to trust the specific self-signed certificate used by the HTTPS server.

==== Step 1: Export the Server Certificate ====

If you do not already have a copy of the server certificate, you can extract it using OpenSSL:

<code>
openssl s_client -connect yourserver.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > server-cert.pem
</code>

Replace ''yourserver.com'' with the hostname of the HTTPS server.

This creates a PEM-formatted certificate file named:

<code>
server-cert.pem
</code>

==== Step 2: Import the Certificate into a Java Keystore ====

Use the ''keytool'' utility included with the JDK to import the certificate:

<code>
keytool -import -alias myserver -file server-cert.pem -keystore mykeystore.jks
</code>

You will be prompted to choose a password for the keystore.

The certificate can be imported into a new keystore or added to an existing keystore.

==== Step 3: Configure TransSECS to Use the Keystore ====

TransSECS allows Java system properties to be configured through the ''ErgoTechConfiguration.properties'' file.

The file can be located in:

* the TransSECS Builder directory, or
* the directory where a built TransSECS deployment is being run.

Add the following properties to ''ErgoTechConfiguration.properties'':

<file>
javax.net.ssl.trustStore=/path/to/mykeystore.jks
javax.net.ssl.trustStorePassword=yourpassword
</file>

Replace ''/path/to/mykeystore.jks'' with the path to the Java keystore and replace ''yourpassword'' with the password assigned to the keystore.

These properties tell Java to use the specified keystore when validating HTTPS certificates.

The settings are loaded when TransSECS starts. If the properties are placed in the ''ErgoTechConfiguration.properties'' file in a deployment directory, they will be loaded when the built application starts.

==== Related Configuration ====

For more information about ''ErgoTechConfiguration.properties'' and other TransSECS runtime configuration options, see [[transsecs_configuration|TransSECS - Configuration]].