Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Downloads and installs the startssl CA certs into the global Java keystore
#!/bin/sh
#
# Downloads and installs the startssl CA certs into the global java keystore
# Author: Klaus Reimer <k@ailis.de>
#
# Check if JAVA_HOME is set
if [ "$JAVA_HOME" = "" ]
then
echo "ERROR: JAVA_HOME must be set."
exit 1
fi
# Check if cacerts file is present
if [ ! -f $JAVA_HOME/lib/security/cacerts ]
then
echo "ERROR: \$JAVA_HOME/lib/security/cacerts not found. JAVA_HOME set correctly?"
exit 1
fi
# Download the startssl certs
echo "Downloading certs..."
wget --quiet --continue http://www.startssl.com/certs/ca.crt
wget --quiet --continue http://www.startssl.com/certs/sub.class1.server.ca.crt
wget --quiet --continue http://www.startssl.com/certs/sub.class2.server.ca.crt
wget --quiet --continue http://www.startssl.com/certs/sub.class3.server.ca.crt
wget --quiet --continue http://www.startssl.com/certs/sub.class4.server.ca.crt
# Install certs into global keystore
echo "Adding certs to cacerts keystore (sudo password required)..."
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -noprompt -alias startcom.ca -file ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -noprompt -alias startcom.ca.sub.class1 -file sub.class1.server.ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -noprompt -alias startcom.ca.sub.class2 -file sub.class2.server.ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -noprompt -alias startcom.ca.sub.class3 -file sub.class3.server.ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -noprompt -alias startcom.ca.sub.class4 -file sub.class4.server.ca.crt
# If jsse is installed then also put the certs into jssecacerts keystore
if [ -f $JAVA_HOME/lib/security/jssecacerts ]
then
echo "Adding certs to jssecacerts keystore (sudo password required)..."
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/jssecacerts -storepass changeit -noprompt -alias startcom.ca -file ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/jssecacerts -storepass changeit -noprompt -alias startcom.ca.sub.class1 -file sub.class1.server.ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/jssecacerts -storepass changeit -noprompt -alias startcom.ca.sub.class2 -file sub.class2.server.ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/jssecacerts -storepass changeit -noprompt -alias startcom.ca.sub.class3 -file sub.class3.server.ca.crt
sudo $JAVA_HOME/bin/keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/jssecacerts -storepass changeit -noprompt -alias startcom.ca.sub.class4 -file sub.class4.server.ca.crt
fi
# Remove downloaded certs
rm -f ca.crt sub.class1.server.ca.crt sub.class2.server.ca.crt sub.class3.server.ca.crt sub.class4.server.ca.crt
@mohamed-el-habib

This comment has been minimized.

Copy link

mohamed-el-habib commented Mar 17, 2016

Hello,

Thanks for this script. Please see my fork.

  • i updated startcom certificates urls.
  • added a delete certificate from keystore before import to force new version.
  • i'm using a function to make update more easy

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.