<html><body><p style="line-height: normal; margin: 0px 0px 12px;">BTW I think there are a few Composite Trust Managers out there, I know that „sslcontect kickstart“ had one <span style="font-family: "Times New Roman"; font-size: 12px; color: rgb(0, 0, 0);">https://github.com/Hakky54/sslcontext-kickstart </span></p><p style="line-height: normal; margin: 0px 0px 12px;">to that extend such a merging manager would be a good general component </p><p style="line-height: normal; margin: 0px 0px 12px;">(but the idea of merging os and cacerts Sounds only good on the first look)</p><div id="ms-outlook-mobile-body-separator-line" data-applydefaultfontstyles="true" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;" dir="ltr"><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;"><br></div></div><div style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;" id="ms-outlook-mobile-signature"><span style="font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Gruß,</span><div dir="ltr" style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0);">Bernd</div><div dir="ltr" style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0);">-- </div><div style="font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0);"><span style="background-color: rgb(255, 255, 255);">https://bernd.eckenfels.net</span></div></div><div id="mail-editor-reference-message-container"><hr style="display: inline-block; width: 98%;"><div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif;"><b>Von:</b> security-dev <security-dev-retn@openjdk.org> im Auftrag von Baesken, Matthias <matthias.baesken@sap.com><br><b>Gesendet:</b> Mittwoch, Oktober 1, 2025 3:16 PM<br><b>An:</b> security-dev@openjdk.org <security-dev@openjdk.org><br><b>Cc:</b> Sean Mullan <sean.mullan@oracle.com>; Langer, Christoph <christoph.langer@sap.com>; Seán Coffey <sean.coffey@oracle.com><br><b>Betreff:</b> OS & JVM keystores</span><div style="font-family: Calibri, sans-serif;"> </div></div><meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">Hi , we were recently asked if it is possible to have in Java something like a "union" of the Java certs and the system keystore.</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">Currently it seems only be possible to use one of them, e.g. a) use the Java cacerts or b) switch fully to the system keystore (on Windows, there seems to be -Djavax.net.ssl.trustStoreType=Windows-ROOT )</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">For a more detailed discussion see</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="color: rgb(70, 120, 134);"><u><a href="https://urldefense.com/v3/__https://github.com/eclipse-platform/eclipse.platform.releng.aggregator/pull/929__;!!ACWV5N9M2RV99hQ!MZG04zXcn4IlpyOa_UDJl2-Fzb8aajztWecVbGgy74qgYbxtucZFIoV_fZpyk__sk3QIXQc7xqj3ZlRNAaE8Tm_Iz8I$" style="color: rgb(70, 120, 134); margin-top: 0px; margin-bottom: 0px;">https://github.com/eclipse-platform/eclipse.platform.releng.aggregator/pull/929</a></u></span></p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"><b>"What we would need is a union of both keystores, which is currently not possible (neither is accessing the 'System Roots' nor is telling the JVM to use a union of multiple stores)."</b></p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">and also</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="color: rgb(70, 120, 134);"><u><a href="https://urldefense.com/v3/__https://github.com/eclipse-packaging/packages/pull/224__;!!ACWV5N9M2RV99hQ!MZG04zXcn4IlpyOa_UDJl2-Fzb8aajztWecVbGgy74qgYbxtucZFIoV_fZpyk__sk3QIXQc7xqj3ZlRNAaE8j4QB9Iw$" style="color: rgb(70, 120, 134); margin-top: 0px; margin-bottom: 0px;">https://github.com/eclipse-packaging/packages/pull/224</a></u></span></p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">Sean Coffey also pointed out that there is the option of
implementing an own 'TrustManagerFactory' implementation via addition of a provider (currently, only the JSSE provider provides such functionality by default. e.g. entry point to loading trusted certs would be via this code:
<span style="color: rgb(70, 120, 134);"><u><a href="https://urldefense.com/v3/__https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/ssl/TrustManagerFactoryImpl.java*L48__;Iw!!ACWV5N9M2RV99hQ!Pdqi9KrO5AO_y6ZznwdSXbEoDEQHWDkIys-OOLQmQl134sT8OK4RyzRqIXu3e8oEQF3tnVeGP1Tnju0HOYp5hiQwZos$" style="color: rgb(70, 120, 134); margin-top: 0px; margin-bottom: 0px;">
https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/ssl/TrustManagerFactoryImpl.java#L48</a></u></span> ).</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> So is there some plan to have such a "union" / merging directly in the JDK ?</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">Or any hints how to handle this ?</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">(seems there are some people building a "union" / merged trustStore with scripts but this looks a bit like a hack to me and will not work for all users)</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;">Best regards, Matthias</p><p class="MsoNormal" style="margin: 0cm; font-family: Aptos, sans-serif; font-size: 11pt;"> </p></div></body></html>