ErgoTechWiki

When TransSECS connects to an HTTPS endpoint that uses a self-signed certificate, Java may reject the connection unless the certificate is explicitly trusted.

Disabling certificate validation is not recommended, especially in production environments. A more secure and stable approach is to configure Java to trust the specific self-signed certificate used by the HTTPS server.

If you do not already have a copy of the server certificate, you can extract it using OpenSSL:

openssl s_client -connect yourserver.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > server-cert.pem

Replace yourserver.com with the hostname of the HTTPS server.

This creates a PEM-formatted certificate file named:

server-cert.pem

Use the keytool utility included with the JDK to import the certificate:

keytool -import -alias myserver -file server-cert.pem -keystore mykeystore.jks

You will be prompted to choose a password for the keystore.

The certificate can be imported into a new keystore or added to an existing keystore.

TransSECS allows Java system properties to be configured through the ErgoTechConfiguration.properties file.

The file can be located in:

* the TransSECS Builder directory, or * the directory where a built TransSECS deployment is being run.

Add the following properties to ErgoTechConfiguration.properties:

javax.net.ssl.trustStore=/path/to/mykeystore.jks
javax.net.ssl.trustStorePassword=yourpassword

Replace /path/to/mykeystore.jks with the path to the Java keystore and replace yourpassword with the password assigned to the keystore.

These properties tell Java to use the specified keystore when validating HTTPS certificates.

The settings are loaded when TransSECS starts. If the properties are placed in the ErgoTechConfiguration.properties file in a deployment directory, they will be loaded when the built application starts.

For more information about ErgoTechConfiguration.properties and other TransSECS runtime configuration options, see TransSECS - Configuration.