How to suppress keystore password hint when using Java Webstart with auth client?

Question

Is there a way to suppress a password prompt when using Java Webstart with an https server that uses client authentication? I would like to do this because the web application runs on a touch screen that does not have a keyboard and works in kiosk mode. Therefore, it would be enough to either remove the password from the keystore, or save it somewhere, maybe on the desktop that launches the application.

I already tried to connect the JVM parameter to a shortcut like this, but it does not work:

javaws -J-Djavax.net.ssl.keyStorePassword=mypass https://... 

I also found that when I activate the "use keystore browser" -option in the Java control panel and add a certificate to it, I can cancel the password prompt and still successfully connect. It seems that only Java-Keystore asks for a password, and Internet-Explorer does not.

Answer 1

You are trying to use a custom implementation of KeystoreProvider. This is not so difficult to create, and I assume that you can eliminate the need for a password. You will need to configure the security.properties JRE properties that are used to launch the webstart application.

Although in your case ... is there a reason why you do not want to use the browser keystore? In this case, you have no problem.

David

Answer 2

I think the problem is with a certification authority (CA)! If your webstart application is signed with a CA-approved certificate that is already part of the CA JVM list (Verisign, Thawte, ...), no password is required to add the application key to the local keystore.
So, if you want, you can manually store your own certification authority in the default Java key store (you will need a password once), and then sign the bank with the certificate issued from this private CA.
I don’t know which JVM you are using on your device (I had some problem with the IBM JDK performing the above trick), but it should work!