I've installed Jenkins on CentOS7 and I was getting an SSL error when trying to update/install plugins. After some investigation, it turned out I had a missing root CA certificate in the Java CA store.

I used the keytool utility to add the missing CA certificate into the Java CA store and it worked. However I find it annoying to have to tamper with that.

Isn't there a way to make Java inherit the root CA certificates trusted by the system? If yes, how?


Simply copy your certificate files to this directory on CentOS 7.x:

$ sudo cp <cert file> /etc/pki/ca-trust/source/anchors/

Once the certificate files put into this directory, run this command to update the system with this newly added certificate:

$ sudo update-ca-trust

What about Java

If you look through the man page for update-ca-trust you'll see the following section:

$ man update-ca-trust



Classic filename, file contains a list of CA certificates trusted for TLS server authentication usage, in the Java keystore file format, without distrust information. This file is a symbolic link that refers to the consolidated output created by the update-ca-trust command.

If you look at that file you can see how it plugs into the rest of the /etc/pki directory structure:

$ ll /etc/pki/java/cacerts
lrwxrwxrwx. 1 root root 40 May  2 10:41 /etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts

And if we run the Java keytool against it:

$ keytool -list -keystore /etc/pki/java/cacerts -storepass changeit |& head
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 155 entries

hellenicacademicandresearchinstitutionsrootca2011, May 2, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): FE:45:65:9B:79:03:5B:98:A1:61:B5:51:2E:AC:DA:58:09:48:22:4D
taiwangrca, May 2, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): F4:8B:11:BF:DE:AB:BE:94:54:20:71:E6:41:DE:6B:BE:88:2B:40:B9
teliasonerarootcav1, May 2, 2018, trustedCertEntry,

You can see that the above has picked up all the certificates available and they're incorporated automatically into this Java JKS file. This file is available to any Java application that's running on the system.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.