Java Keystore (JKS)

SecTrail CM enables automatic management of SSL certificates by establishing agentless connections to applications using Java Keystore (JKS/PKCS12).

Platform Support

SecTrail CM supports Java KeyStores running on both Linux and Windows systems. You can perform automatic certificate deployment and management for both platforms.

Use Cases

• Java Applications: Standalone Java applications
• Microservices: Spring Boot, Quarkus, Micronaut microservices
• Message Brokers: Apache Kafka, RabbitMQ (TLS)
• Databases: Elasticsearch, Cassandra (SSL/TLS)

Connection Requirements

Linux Systems

Requirement	Detail	Description
Protocol	SSH (Secure Shell)	Secure remote connection protocol
Port	22	Standard SSH port or custom port
Authentication	SSH Key or Password	Authentication via SSH key or password
User Permission	Keystore read/write permission	Access and edit permission to keystore files

Windows Systems

Requirement	Detail	Description
Protocol	WinRM (Windows Remote Management)	Windows remote management protocol
Port	5985 (HTTP) / 5986 (HTTPS)	Standard WinRM ports
Authentication	Username and Password	Windows user authentication
User Permission	Keystore read/write permission	Access and edit permission to keystore files

Automated Operations

SecTrail CM automatically performs the following operations on Java KeyStore:

1. Keystore Backup: Backing up the existing keystore
2. Certificate Import: Importing new certificate and private key with keytool
3. Truststore Update: Adding Root/Intermediate CA certificates to truststore
4. Validation: SSL/TLS connection testing and validation

Configuration Steps

1. Creating Java KeyStore Linux User

Navigate to Automation > Device Users and create a user for Java KeyStore.

2. Adding Java KeyStore Device to SecTrail CM

Click Automation > Devices > Add New Device button and enter the following information:

• Name: Provide a descriptive name for the device
• Device Users: Select the user created in Step 1
• IP: Enter the IP address of the Java KeyStore server
• Device Type: Select Java KeyStore Linux from the dropdown menu
• Become Method: Select privilege escalation method (e.g., sudo)
• Custom Path: (Optional) You can specify a custom path
• KeyStore Path: Enter the path to the KeyStore file
• KeyStore Storepass: Enter the KeyStore password
• Service Name to Restart: (Optional) Enter the service name to restart

Automatic Discovery and Monitoring

After the Java KeyStore device is added to SecTrail CM, certificates in the KeyStore are automatically included in the discovery period and scanned regularly. Automatic alarms are created for certificates that are about to expire or have issues.

3. Viewing Device Information

After the device is added, it will be displayed in the Automation > Devices list. Click on the row to view device details:

The following information is displayed in device details:

• Certificate Subject: Certificate subject information (CN, ST, L, O, OU)
• Issuer: CA information that issued the certificate
• Not After: Certificate expiration date
• Store Path: KeyStore file path
• Alias Name: Certificate alias name
• Deploy: For certificate deployment

Certificate Deployment

Step 1: KeyStore and Certificate Selection

1. Select your Java KeyStore device from Automation > Devices
2. In the device details, find the KeyStore where you want to deploy the certificate
3. Click the Deploy button on the relevant row
4. In the Deploy Certificate window that opens:
   • Virtual Servers: Target KeyStore information is displayed (IP, Subject, Alias Name)
   • Certificate: Select the certificate you want to deploy from the dropdown menu

Step 2: Starting the Deployment Process

Click the Deploy button to start the certificate deployment process.

Step 3: Process Tracking

The deployment process can be tracked from Automation > Processes:

Operation Details

The following steps are performed during deployment:

Step	Operation Description
1	Certificate file is uploaded to the server
2	New certificate is added to existing keystore file

Certificate Removal (Remove)

SecTrail CM supports certificate removal from Java KeyStore.

Removal Operation Steps

1. Select your Java KeyStore device from Automation > Devices
2. Select the relevant operation in the row of the certificate you want to remove
3. Confirm to start the removal operation

Removal Operation Task Details

The removal operation can be tracked from Automation > Processes. The following steps are performed during the operation:

Step	Operation Description
1	Existing keystore file is backed up
2	Certificate is deleted from keystore with specified alias