public void setCertificateEntry ( String alias , Certificate cert ) throws KeyStoreException , KeyException { if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isEntryEnabled ( ) ) { Tr . entry ( this , tc , "setCertificateEntry" , new Object [ ] { alias , cert } ) ; } if ( Boolean . parseBoolean ( getProperty ( Constants . SSLPROP_KEY_STORE_READ_ONLY ) ) ) { if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isDebugEnabled ( ) ) { Tr . debug ( this , tc , "Unable to update readonly store" ) ; } throw new KeyStoreException ( "Unable to add to read-only store" ) ; } final KeyStoreManager mgr = KeyStoreManager . getInstance ( ) ; try { KeyStore jKeyStore = getKeyStore ( false , false ) ; if ( null == jKeyStore ) { final String keyStoreLocation = getProperty ( Constants . SSLPROP_KEY_STORE ) ; if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "Cannot load the Java keystore at location \"" + keyStoreLocation + "\"" ) ; } throw new KeyStoreException ( "Cannot load the Java keystore at location \"" + keyStoreLocation + "\"" ) ; } // store the cert... errors are thrown if conflicts or errors occur jKeyStore . setCertificateEntry ( alias , cert ) ; try { store ( ) ; } catch ( IOException e ) { // Note: debug + ffdc in store() itself // on z/OS we have an issue where the certificate may be stored but the // alias // already exists in RACF so the keystore API will through an // IOException // we need to catch this condition on z/OS and if the certs is in the // keystore // prior after adding the certificate then we know the cert was actually // added and its not // a true failure. If the cert was not added then we need to rethrow the // exception. final String ksType = getProperty ( Constants . SSLPROP_KEY_STORE_TYPE ) ; if ( ( ksType . equals ( Constants . KEYSTORE_TYPE_JCERACFKS ) || ksType . equals ( Constants . KEYSTORE_TYPE_JCECCARACFKS ) || ksType . equals ( Constants . KEYSTORE_TYPE_JCEHYBRIDRACFKS ) ) ) { KeyStore ks = getKeyStore ( true , false ) ; if ( mgr . checkIfSignerAlreadyExistsInTrustStore ( ( X509Certificate ) cert , ks ) ) { if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "Certificate already exists in RACF: " + e . getMessage ( ) ) ; } } else { throw new KeyException ( e . getMessage ( ) , e ) ; } } else { throw new KeyException ( e . getMessage ( ) , e ) ; } } } catch ( KeyStoreException kse ) { throw kse ; } catch ( KeyException ke ) { throw ke ; } catch ( Exception e ) { throw new KeyException ( e . getMessage ( ) , e ) ; } // after adding the certificate, clear the keystore and SSL caches so it // reloads it. AbstractJSSEProvider . clearSSLContextCache ( ) ; mgr . clearJavaKeyStoresFromKeyStoreMap ( ) ; if ( TraceComponent . isAnyTracingEnabled ( ) && tc . isEntryEnabled ( ) ) { Tr . exit ( this , tc , "setCertificateEntry" ) ; } }
Set a new certificate into the keystore and save the updated store .