Digital Certificate: How to import .cer file in to .truststore file using?

Question

Has anyone came across where they have to deal with .truststore file? and knowing how to import .cer into .truststore file?

I am not sure if I have to use Java Keytool or Linux command (such as openssl command).

Thanks

Answer 1

# Copy the certificate into the directory Java_home\Jre\Lib\Security
# Change your directory to Java_home\Jre\Lib\Security>
# Import the certificate to a trust store.

keytool -import -alias ca -file somecert.cer -keystore cacerts -storepass changeit [Return]

Trust this certificate: [Yes]

changeit is the default truststore password

Answer 2

Instead of using sed to filter out the certificate, you can also pipe the openssl s_client output through openssl x509 -out certfile.txt, for example:

echo "" | openssl s_client -connect my.server.com:443 -showcerts 2>/dev/null | openssl x509 -out certfile.txt

Answer 3

The question is how to import a .cer file into the trust store, but I have a .crt file, which I exported from Firefox.

Searching the internet how to import .crt to trust store points to this question. Since I found out how to import the .crt in the trust store I answer that too.

The answer is: the same as for .cer files.

By the way, you do not have to put an alias and the password of the keystore can be typed after you enter the command:

keytool -v -import -file somefile.crt  -alias somecrt -keystore my-cacerts

Preferably use the cacerts file that is already in your Java installation (jre\lib\security\cacerts) as it contains already secure "popular" certificates.

Update regarding the differences of cer and crt (just to clarify) According to Apache with SSL - How to convert CER to CRT certificates? and user @Spawnrider

CER is an X.509 certificate in binary form, DER encoded.
CRT is a binary X.509 certificate, encapsulated in text (base-64) encoding.
It is not the same encoding.