NetBeans JVM TrustStore Configuration for Custom SSL Certificates

TrustStore Override Behavior

Specifying a custom trust store via -Djavax.net.ssl.trustStore in netbeans.conf overrides the default JRE cacerts file. It does not append to or merge with the system certificates; the JVM will only trust certificates contained within the specified custom store.

Implementation Strategy

Because the custom store replaces the default one, the recommended approach to maintain global trust while adding a custom certificate is to create a derivative keystore.

1. Clone the default store: Copy the existing cacerts file to a new location to preserve the default CA chain.

   cp $JAVA_HOME/lib/security/cacerts /path/to/custom_truststore.jks

2. Import the custom certificate: Use the keytool utility to add your specific certificate to the copy.

   keytool -import -alias custom-cert -file mycert.crt -keystore /path/to/custom_truststore.jks -storepass changeit

3. Configure NetBeans: Add the following arguments to the netbeans_default_options string in netbeans.conf:

   -Djavax.net.ssl.trustStore=/path/to/custom_truststore.jks -Djavax.net.ssl.trustStorePassword=changeit

4. Restart the IDE to apply the JVM changes.

Verification Methods

To confirm that NetBeans is utilizing the custom store during plugin updates or other network operations, use these methods:

• SSL Debugging: Add -Djavax.net.debug=ssl,handshake to netbeans.conf. Upon restart, check the IDE output/logs for the line trustStore is: /path/to/custom_truststore.jks.
• Functional Test: Perform the HTTPS operation (e.g., a plugin update) that previously failed. The absence of an SSLHandshakeException indicates the certificate is now trusted.
• Keystore Inspection: Verify the certificate exists in the file using keytool -list -keystore /path/to/custom_truststore.jks.

Diagnostic Requirement

If the connection still fails after these steps, please provide the JDK version NetBeans is using and the exact error message from the log to determine if the JVM is ignoring the configuration or if there is a certificate chain mismatch.