How to check a Certificate is in default cacerts

Question

A client provide me with a HTTPS URL for a service call. I need to make a request to that URL. I know that if the certificate of that URL is from a common provider chances are that it's already available on the default java truststore cacerts.

However I am unsure how to check whether I need to import the certificate or not. How can I check whether a certificate from a website is already in default java truststore \jre1.8\lib\security\cacerts?

Answer 1

You can inspect (list) certificates in your cacert keystroke using the java keytool.

keytool -list -v -keystore /path/to/cacerts

keytool has to be in your path, or can be found in the bin directory of your Java Installation (e.g. C:/Program Files (x86)/Java/jre1.8/bin/keytool.exe).

Answer 2

Just try to connect to it with URL and HttpsURLConnection, going at least as far as getting the response code, and no fancy trust managers or anything. If it's trusted, you won't have a problem.

Your terminology is astray. All certificates are public. If it's a CA-signed certificate, signed by a CA whose certificate is in cacerts, you don't need to import it.