How do I find out what keystore my JVM is using?

To find out which keystore and truststore the Java Virtual Machine (JVM) is using, you can check the relevant javax.net.ssl.* system properties. The JVM uses separate properties for the keystore (client certificates) and truststore (trusted CA certificates).

Here's an example of how you can retrieve these values in Java:

public class KeystoreUtils {
  public static void main(String[] args) {
    System.out.println("KeyStore: " + System.getProperty("javax.net.ssl.keyStore"));
    System.out.println("KeyStore Type: " + System.getProperty("javax.net.ssl.keyStoreType"));
    System.out.println("TrustStore: " + System.getProperty("javax.net.ssl.trustStore"));
    System.out.println("TrustStore Type: " + System.getProperty("javax.net.ssl.trustStoreType"));
  }
}

This code will print the paths and types that the JVM is configured to use to the console. If a property is not set, it will print null, indicating the JVM will fall back to its default configuration.

On most systems running Java 8u161 or later, the JVM defaults to the "PKCS12" keystore and truststore type, which corresponds to the .p12/.pfx file format. However, other types, such as "JKS" (Java KeyStore) and "Windows-MY" (Windows certificate store), are also supported.

You can use the -Djavax.net.ssl.keyStore, -Djavax.net.ssl.keyStoreType, -Djavax.net.ssl.trustStore, and -Djavax.net.ssl.trustStoreType system properties to specify the location and type of the keystores that you want the JVM to use.

For example, you can start the JVM with the following options to use a JKS keystore and truststore located at /path/to/keystore.jks and /path/to/truststore.jks:

java -Djavax.net.ssl.keyStore=/path/to/keystore.jks -Djavax.net.ssl.keyStoreType=JKS -Djavax.net.ssl.trustStore=/path/to/truststore.jks -Djavax.net.ssl.trustStoreType=JKS ...

I hope this helps! Let me know if you have any questions.