使用 Java 标准密钥库是一种不好的做法吗
我们一直使用 java 标准密钥库 ($JAVA_HOME/jre/lib/security/cacerts) 作为 tomcat 的可信存储。该 tomcat 服务器将与其他服务器通信。最近的 OS(AIX) 升级显然覆盖了 $JAVA_HOME/jre/lib/security/cacerts 处的文件，导致证书丢失以及 tomcat 中托管的应用程序出现很多问题。
看看这个，中继 $JAVA_HOME/jre/lib/security/cacerts 是一个不好的做法吗？ 解决这种情况的替代（更好|标准）方法是什么？
We had been using java standard keystore ($JAVA_HOME/jre/lib/security/cacerts) as the trusted store for tomcat. And that tomcat server would communicate with some other server. A recent OS(AIX) upgrade apparently over-wrote the file at $JAVA_HOME/jre/lib/security/cacerts and that resulted in lost certificates and lot of issues with application hosted in tomcat.
Looking at this is it a bad practice to relay up on $JAVA_HOME/jre/lib/security/cacerts ?
What are the alternate (better|standard) ways to tackle this scenario?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
如果您有一个会重复导入的构建过程，那么这不是一个坏习惯。
It's not a bad practice if you have a build process that will repeat the imports.
不确定，但假设您的假设是正确的，请小心放置密钥库的位置。我强烈建议将它放在 Apache 文件夹中。
默认情况下，在 Websphere 中密钥库以这种方式工作，因为它带来了自己的 JVM :)
Not sure, but assuming your assumptions are correct, caution where you put your keystore. I would strongly suggest it is placed inside Apache folder.
By default in Websphere the keystore works this way, since it brings it's own JVM :)
就 cacerts 文件中的内容而言，这并不一定比依赖操作系统或浏览器中安装的默认 CA 证书更糟糕，但这并不意味着它很好。
Sun/Oracle 在 关于此的 JSSE 参考指南：
在配置方面，对于必须安装“本地”CA 证书的特定应用程序，我发现使用本地信任存储更稳定（例如，使用 javax.net.ssl.trustStore 指定）代码>）。
In terms of what is in the
cacertsfile, it's not necessarily worse practice than relying on the default CA certificates installed in your OS or your browser, but that doesn't mean it's great.Sun/Oracle have a little "important note" somewhere in the middle of the JSSE Reference Guide about this:
In terms of configuration, for specific applications where I've had to install "local" CA certificates, I find it more stable to use a local trust store (for example, specified with
javax.net.ssl.trustStore).AIX 升级是一个补丁。任何补丁都不得删除/覆盖用户数据。我建议受此类数据丢失影响的用户要求 IBM 修复补丁程序。相比之下，httpd 服务器的补丁不会覆盖/删除配置，即使它位于程序目录中。
The AIX upgrade is a patch. Any patch must not delete / overwrite user data. I would suggest that users affected by this kind of data loss ask IBM to fix the patch procedure. In comparison, a patch of the httpd server does not overwrite / delete the configuration even though it is in the program directory.
是的，这样做是一种不好的做法。
最佳实践是根据需要限制您的受信任证书。
因此，您应该仅使用自己的密钥库以及应用程序信任的证书。
Yes it is a bad practice to do that.
The best practice is to have to limit your trusted certificates as much as needed.
So you should have used you own keystore with only the certificates trusted by your application.