Add a cert to JVM keystore + `keytool` cheatsheet

add-cert-to-jvm.sh

#!/bin/sh

# Taken from StackOverflow and modified lightly.
#
# For general keytool tips, this site is useful:
#     https://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html
#
# Also, if you goof, can remove simply using:
#     keytool -delete -alias ourdomain -keystore pc.keystore
# Also also: If you are given a PEM file, you can try the following instead:
#     keytool -import -trustcacerts -alias some_alias -file your.pem -keystore yourkeystore.jks

HOST=target.domain.com
PORT=443
KEYSTOREFILE=${JAVA_HOME}/lib/security/cacerts
KEYSTOREPASS=changeit # hopefully default keystore password is changed...

# get the SSL certificate
openssl s_client -connect ${HOST}:${PORT} </dev/null \
    | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${HOST}.cert

# create a keystore and import certificate
keytool -import -noprompt -trustcacerts \
    -alias ${HOST} -file ${HOST}.cert \
    -keystore ${KEYSTOREFILE} -storepass ${KEYSTOREPASS}

# verify we've got it.
keytool -list -v -keystore ${KEYSTOREFILE} -storepass ${KEYSTOREPASS} -alias ${HOST}