Setting trustStore in script?

[Patrick Steffes]

We recently had the need to setup a script attribute definition that needed
to query our LDAP Servers.

When attempting to configure LDAP over TLS/SSL in the ECMAScript, I found
that I was unable to specify a custom java truststore using
'System.setProperty("javax.net.ssl.trustStore", "/path/to/jks")'. Running a
getProperties did show that the property was set before initializing the
socket factory and LDAPConnection but stracing showed that the custom jks
was never used.

We were able to resolve this by using the alternative method of setting the
trustStore at the command line in the tomcat environment and in aacli.sh
with '-Djavax.net.ssl.trustStore=/path/to/jks'.

As all is working well I'm just hoping to get some more information on if I
*should* be able to set this value in the script or if this working as
expected? I'm guessing this is just due to my elementary understanding of
java TLS/SSL so any documentation or additional info would be appreciated.

Thanks,
Patrick

[Cantor, Scott]

Post by Patrick Steffes
As all is working well I'm just hoping to get some more information on if I
should be able to set this value in the script or if this working as
expected?

Don't know, but I would point out that if you're using ldaps with Java's
native JNDI code, I believe you have a gaping hole, there's no hostname
verification performed. I discovered that a few years ago.

The best thing you can do is probably use a self-signed long-lived
certificate on LDAP servers and restrict your trust list to only that key.
With so many hostname verification bugs around, that's the best defense,
and it's the best security model overall anyway.

-- Scott