Customer HubCA certificate in Java keystore
It may be necessary to load a certificate into the Java keystore (cacerts) of the JVM used by the Relution server and make it trusted. This is necessary, for example, when the Relution server establishes a TLS connection to an internal service whose certificate was issued by an internal CA.
The following procedure only applies to the native installation on Windows (see Deprecated: Windows Server 2019 →). From Relution 26.4 onward, CA certificates for outgoing connections of the Relution server can also be stored under Settings → TLS Trust configuration → Trusted certificates for all installation types. They take effect without a restart, in addition to the Java keystore, see CA certificate in Docker →.
These instructions do not apply to the Secure Mail Gateway. From Relution 26.4 onward, it runs as a separate container with its own Java runtime; the CA certificate of the Exchange server is mounted into that container as a PEM file under /opt/app/ca-certs, see Installing Secure Mail Gateway →. The TLS trust configuration in Relution has no effect on the Secure Mail Gateway.
Instructions
The Windows command line is opened with administrative privileges.
The current directory is changed to
%JAVA_HOME%\lib\security.
The path may vary depending on the Java version and provider.The following command is executed in the CMD (in the example, the certificate is located under
C:\temp\mdeCert.cer):keytool -import -trustcacerts -alias mdecert -file C:\temp\mdeCert.cer -keystore cacertsIf a password is requested,
changeitis entered. This is the default password of the keystore.When asked whether the certificate should be trusted,
yesis entered.
The certificate is imported and a message with the contentCertificate was added to keystoreshould appear.The Relution service is then restarted. The Java keystore is only read at startup; the imported certificate is used only after the restart.