# Java upgrade removes CA cert for LDAP connection

**URL:** <https://forums.suse.com/t/java-upgrade-removes-ca-cert-for-ldap-connection/27095>\
**Category:** SLES Updates\
**Created:** [June 1, 2015, 9:16pm UTC](https://forums.suse.com/t/java-upgrade-removes-ca-cert-for-ldap-connection/27095 "2015-06-01T21:16:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![boblmartens](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@boblmartens](https://forums.suse.com/u/boblmartens)\
**Post date:** [June 1, 2015, 9:16pm UTC](https://forums.suse.com/t/java-upgrade-removes-ca-cert-for-ldap-connection/27095/1 "2015-06-01T21:16:47Z")

</div>

We load our institutional CA into the Java keystore for LDAP connections. After a recent Java upgrade, that CA was not loaded automatically and it looks like the keystore that we had loaded it into was replaced.

Is there some blessed way to load CA certs into the keystore so that they are kept around even on upgrades?

Running SLES 12 at the moment. Thanks!

---

<div class="post-metadata">

**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\
**Post date:** [June 1, 2015, 10:22pm UTC](https://forums.suse.com/t/java-upgrade-removes-ca-cert-for-ldap-connection/27095/2 "2015-06-01T22:22:59Z")

</div>

Most of the time it is the best practice to have the code running within  
Java use a truststore outside of the JRE but specific to the application  
for this exact reason. It’s Sun/Oracle’s job to keep us safe by replacing  
that file with new trusted CAs, removing old untrusted CAs, and that  
cannot happen in the situation as developed. On the other hand, there are  
articles aplenty on how to code an application to use a truststore loaded  
at runtime, and many applications have this option present by default.

–  
Good luck.

If you find this post helpful and are logged into the web interface,  
show your appreciation and click on the star below…

---

<div class="post-metadata">

**Author:** ![boblmartens](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@boblmartens](https://forums.suse.com/u/boblmartens)\
**Post date:** [June 1, 2015, 10:32pm UTC](https://forums.suse.com/t/java-upgrade-removes-ca-cert-for-ldap-connection/27095/3 "2015-06-01T22:32:23Z")

</div>

Could you point me at one? I’m super lazy. 🙂

[QUOTE=ab;28127]Most of the time it is the best practice to have the code running within  
Java use a truststore outside of the JRE but specific to the application  
for this exact reason. It’s Sun/Oracle’s job to keep us safe by replacing  
that file with new trusted CAs, removing old untrusted CAs, and that  
cannot happen in the situation as developed. On the other hand, there are  
articles aplenty on how to code an application to use a truststore loaded  
at runtime, and many applications have this option present by default.

–  
Good luck.

If you find this post helpful and are logged into the web interface,  
show your appreciation and click on the star below…[/QUOTE]

---

<div class="post-metadata">

**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\
**Post date:** [June 1, 2015, 10:59pm UTC](https://forums.suse.com/t/java-upgrade-removes-ca-cert-for-ldap-connection/27095/4 "2015-06-01T22:59:27Z")

</div>

First hit from Google querying for java use custom truststore:

[http://stackoverflow.com/questions/24555890/using-a-custom-truststore-in-java-as-well-as-the-default-one](http://stackoverflow.com/questions/24555890/using-a-custom-truststore-in-java-as-well-as-the-default-one)

–  
Good luck.

If you find this post helpful and are logged into the web interface,  
show your appreciation and click on the star below…