Java SSL and keystore password in application

0
votes

Sorry in advance if this question has been posted before. I have look around but couldn't find an answer.

I am creating a server in Java that has a SSL socket to accept clients. I have been looking around on how to create the socket and have started to add the code to my application. After looking around the find out how to allow a self-signed certificate for testing I found that I create a keystore and add the certificate to that. To use the certificate I would need to add "System.setProperty("javax.net.ssl.keyStore", "keystorename.jks")" The only problem is I have to specify the password in the code as well if I go off other developers examples.

I would like to know if I have to specify the password and if I do need to what is the security implications?

Thanks in advance,

1
javassl

1 Answers

0
votes

Yes you do, and the security implication is that the password is (1) fixed by the code and (2) probably visible in the object code. The solution to (2) is ultimately physical security of the software and the host it runs on.