1
00:00:00.05 --> 00:00:03.01
- [Narrator] Java KeyStores
are an integral way

2
00:00:03.01 --> 00:00:06.06
of transmitting secure
files across an enterprise

3
00:00:06.06 --> 00:00:09.01
when dealing with Java programs.

4
00:00:09.01 --> 00:00:11.04
In addition, KeyStores and TrustStores

5
00:00:11.04 --> 00:00:13.05
are very important when dealing

6
00:00:13.05 --> 00:00:15.06
with self signed infrastructure

7
00:00:15.06 --> 00:00:18.06
on an internal enterprise based network.

8
00:00:18.06 --> 00:00:19.09
We're gonna talk a little bit about how

9
00:00:19.09 --> 00:00:23.02
to leverage Java KeyStores
in your applications

10
00:00:23.02 --> 00:00:25.07
in order to load keys.

11
00:00:25.07 --> 00:00:27.03
So, let's first start by talking about

12
00:00:27.03 --> 00:00:29.02
what is a KeyStore?

13
00:00:29.02 --> 00:00:31.02
Essentially a KeyStore is nothing more

14
00:00:31.02 --> 00:00:35.03
than a database or a collection of values.

15
00:00:35.03 --> 00:00:38.04
It's used to store secrets in small doses.

16
00:00:38.04 --> 00:00:40.09
Now, the reason that I say small doses

17
00:00:40.09 --> 00:00:42.08
is I wouldn't put a whole lot of secrets

18
00:00:42.08 --> 00:00:44.09
into an individual KeyStore

19
00:00:44.09 --> 00:00:47.02
unless you absolutely have to.

20
00:00:47.02 --> 00:00:50.03
If you actually wanna load
secrets into an application

21
00:00:50.03 --> 00:00:52.09
you should look at a
tool like HashiCorp Vault

22
00:00:52.09 --> 00:00:55.01
or Thycotic Secret Server in order

23
00:00:55.01 --> 00:00:57.04
to get secrets into your application,

24
00:00:57.04 --> 00:00:58.09
but in small bits and pieces

25
00:00:58.09 --> 00:01:01.03
like private keys or certificates

26
00:01:01.03 --> 00:01:03.09
KeyStores are a great way to do it.

27
00:01:03.09 --> 00:01:05.05
Some of things that you can store,

28
00:01:05.05 --> 00:01:06.05
as I've alluded to,

29
00:01:06.05 --> 00:01:13.00
are public keys, PKI pairs,
or symmetric shared keys.

30
00:01:13.00 --> 00:01:14.08
Now, when you build a KeyStore

31
00:01:14.08 --> 00:01:20.03
it's usually actually built
using the Java keytool, usually.

32
00:01:20.03 --> 00:01:23.01
It can however be built in code,

33
00:01:23.01 --> 00:01:26.09
and building it in code
can either save it on disk

34
00:01:26.09 --> 00:01:29.03
or run it in memory.

35
00:01:29.03 --> 00:01:31.03
Now, this is often very useful

36
00:01:31.03 --> 00:01:34.03
when scripting DevOps type activities,

37
00:01:34.03 --> 00:01:36.06
especially as I alluded to when using

38
00:01:36.06 --> 00:01:39.04
internally signed certificates.

39
00:01:39.04 --> 00:01:43.03
By being able to generate
a KeyStore dynamically

40
00:01:43.03 --> 00:01:45.02
with a signed certificate

41
00:01:45.02 --> 00:01:47.07
that is signed by your internal CA

42
00:01:47.07 --> 00:01:50.05
you can actually push
those out to applications,

43
00:01:50.05 --> 00:01:52.02
so that they are automatically trusted

44
00:01:52.02 --> 00:01:55.01
when they come up if
you do KeyStores right

45
00:01:55.01 --> 00:01:57.05
and you spend a little time understanding

46
00:01:57.05 --> 00:02:01.09
the various formats and
structures of KeyStores.

47
00:02:01.09 --> 00:02:04.08
Now, the JCA KeyStore object

48
00:02:04.08 --> 00:02:07.00
is not the traditional KeyStore per se

49
00:02:07.00 --> 00:02:08.04
that we deal with.

50
00:02:08.04 --> 00:02:11.02
It's actually a class for interacting

51
00:02:11.02 --> 00:02:14.06
with the Java KeyStore file itself.

52
00:02:14.06 --> 00:02:17.07
Now, I alluded earlier that
it can be purely in memory

53
00:02:17.07 --> 00:02:20.09
or it can be on disk.

54
00:02:20.09 --> 00:02:23.01
You can leverage various file types

55
00:02:23.01 --> 00:02:26.01
like PKS, or P12 files,

56
00:02:26.01 --> 00:02:28.01
or with other libraries like Bouncy Castle

57
00:02:28.01 --> 00:02:31.05
you can expand that list even further.

58
00:02:31.05 --> 00:02:33.01
Before we jump into code however,

59
00:02:33.01 --> 00:02:35.04
we do need to talk about
a little difference

60
00:02:35.04 --> 00:02:39.09
in terminology between a
TrustStore and a KeyStore.

61
00:02:39.09 --> 00:02:44.00
Now, in reality a
TrustStore is a KeyStore.

62
00:02:44.00 --> 00:02:47.00
It is a type of a Java KeyStore.

63
00:02:47.00 --> 00:02:51.04
It is usually used for
certificates from a CA.

64
00:02:51.04 --> 00:02:53.03
Now, it can contain certificates signed

65
00:02:53.03 --> 00:02:56.03
by a public CA like DigiSign,

66
00:02:56.03 --> 00:02:59.06
or it can contain certificates signed

67
00:02:59.06 --> 00:03:02.07
by your private CA in your enterprise,

68
00:03:02.07 --> 00:03:04.07
and this is really an example of how

69
00:03:04.07 --> 00:03:07.06
we would get an application on start up

70
00:03:07.06 --> 00:03:11.03
to trust the certificates when
it's making web service calls

71
00:03:11.03 --> 00:03:14.04
to other systems within your enterprise.

72
00:03:14.04 --> 00:03:16.04
We're not gonna get too deep into that,

73
00:03:16.04 --> 00:03:18.04
but just know that the CA search file

74
00:03:18.04 --> 00:03:20.09
that shifts with Java
is really a trustworthy,

75
00:03:20.09 --> 00:03:22.07
it can be manipulated the same way

76
00:03:22.07 --> 00:03:25.00
that we do with any
other KeyStore in Java.

