CODEWITHSUNDEEP
javatomcatsslkeytooljks
Ryan Pelletier
Ryan Pelletier

Reputation: 706

Consequences of storing TrustedCertEntry and PrivateKeyEntry in JKS?

I recently joined a project that has an application running in Tomcat that uses a single file as both the KeyStore and the TrustStore. In other words, it includes both entries of types trustedCertEntry and PrivateKeyEntry.

While upgrading from Tomcat 8.5.6 to 8.5.20, I realized catalina.out was giving me 

java.lang.IllegalArgumentException: java.security.KeyStoreException: Cannot store non-PrivateKeys

The solution was to make to remove the trustedCertEntry entries from the keystore.

To me, this seems fairly obvious that you would want to keep these separate. My question is, are there any possible security consequences to using the same file as a keystore and truststore? If so, why does Java (or SSL) allow these to be kept in the same file?

Upvotes: 1

Views: 828

Answers (1)

dave_thompson_085
dave_thompson_085

Reputation: 38990

SSL and TLS are interoperable protocols; by IETF policy and tradition they say nothing about storage of anything and everything at either or any endpoint. "That's a local matter."

Java historically used one file format (JKS) for both TrustedCert's and PrivateKey's, not only for SSL/TLS but for all public-key crypto (and optionally with JCEKS some symmetric crypto also), and Java9 is switching to PKCS12 for both. Using the same format doesn't mean you must use the same file, and I would say it's preferable to use separate files, but I don't see an actual security problem in using a single file as long as you keep any file containing a privatekey restricted to one system, or as few systems as absolutely necessary, plus appropriate backup; however that's not really a programming Q and you might try for better answers on security.SX.

Tomcat 8.5 sorta-kinda combines the previously separate and (often confusingly) different config for Java-JSSE and APR=OpenSSL stacks, and I believe this restriction that the keystore can only contain PrivateKey's is a result of that change.

Upvotes: 1

Related Questions