SSL CA CERTS

[patoessy]

Since glassfish server does not have the certificates, can we get a way to import from jdk while running asadmin create domain. I am having hard time importing ssl certs in glassfish 8.0.0. I have imported them using keytool -importkeystore -v -noprompt -srckeystore "/home/pat/.sdkman/candidates/java/25-zulu/lib/security/cacerts" -destkeystore \
"/home/pat/Apps/glassfish/glassfish8/glassfish/domains/production/config/cacerts.p12" -deststoretype PKCS12 and included -Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.p12 in domain.xml file. However, jakarta mail works fine while jdk httpclient does not. Removing -Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.p12 in domain.xml file causes the opposite to happen. Jakarta mail fails while jdk client succeeds. The code works well in payara server 7.2026.1

Is this a bug? Or a misconfiguration?

[OndroMih]

Hi, is it possible for you to create a reproducere where Java Mail works and HTTP client doesn’t ?

Adding ability to copy JDK certs on domain creation or copy them to existing domain via some asadmin command was already discussed in some other ticket. Our team at OmniFish considered this already and but it’s not high enough on our priority list. Though if there’s bug as you say, we would like to fix it in any case.

[patoessy]

Hi, I have found the issue. Jakarta.mail.Session no longer need mail.smtp.socketFactory.class as jjakarta.net.ssl.SSLSocketFactory or javax.net.ssl.SSLSocketFactory.

Also needed to add javax.net.ssl.truststore passwords as jvm options.

Thank you for your quick reply.

[dmatej]

We will improve our monitoring of breaking changes in the future, so GF could resolve these issues automatically. However as these changes are usually done just once, it doesn't have the highest priority; but we should document them better, probably in release notes.