Java and SSL certificates

I found that to ensure the highest security/validity I had to import the SSL certificate used by the website into my application

You were partially correct when you said that. You don't need to import the SSL certificate. It is enough to import the StartSSL CA certificate.

Also, there is no such thing as importing the certificate into the Java application. SSL support in Java relies on the concept of keystores and truststores rather than some certificates packaged in the application. If you are publishing an application to be downloaded and executed by end users, you do not need to publish a certificate or use a private key in the application for this purpose. The private key and associated certificate will be stored in the keystore, accessible only to you.

End users of the application will rely on SSL support in the Java runtime, which will enable the application to establish an SSL connection to the site after validating the server certificate. The Java runtime ships with a default set of CA certificates in the truststore, and the only prerequisite for a successful SSL connection is that the server's SSL certificate is issued by a CA in the truststore. As of version 6, StartSSL's certificate does not exist, at least in the Java runtime's truststore , so:

• You can instruct end users to perform the activity of importing the StartSSL CA certificate into the Java truststore. Links that might help include this StartSSL forum thread (importing a CA certificate into the truststore only requires the first four steps), a GitHub project , and this blog post ; disclaimer - I haven't tried any of these, you should Use at your own risk.

• Alternatively, you can use the -Djavax.net.ssl.trustStore=<path_to_truststore> -Djavax.net.ssl.trustStorePassword=<truststore_password>JVM startup flag to initialize the application with your own truststore , or execute the following code before initializing the SSL connection:

  System.setProperty("javax.net.ssl.trustStore","<path_to_truststore>");
  System.setProperty("javax.net.ssl.trustStorePassword","<truststore_password>");
  

  This only works if your application is a Java SE application that doesn't happen to be an applet (or an application with similar restrictions on how to specify the truststore).

Reading the Java keytool documentation will also help .