title: Hide JKS keystore / truststore password when running Java process
body: <p>I have a number of Java applications which connect to other applications and services via connections secured with SSL. During development, I can specify the keystore/truststore to use and the password by using the JVM args:</p>
  
  <pre><code>-Djavax.net.ssl.trustStore=certificate.jks 
  -Djavax.net.ssl.trustStorePassword=mypassword 
  -Djavax.net.ssl.keyStore=certificate.jks 
  -Djavax.net.ssl.keyStorePassword=mypassword 
  -Djavax.net.ssl.keyStoreType=jks
  </code></pre>
  
  <p>This works perfectly. However, there is a requirement when going to production to hide the password, using JVM args means anyone who looks at the process list will be able to see the password in clear text. </p>
  
  <p>Is there a simple way to get around this? I considered importing the certificates into the JRE's lib/security/cacerts file, but my understanding is that this will still require a password. One option would be to store the password, encrypted, in a file and then get the applications to read and decrypt on the fly, but this will involve changing and re-releasing all the applications (there are quite a few of them) so I would rather avoid this if at all possible. Does the javax.net.ssl library have any native built-in support for encrypted passwords (even if it's something as simple as just base64encoding, or anything that makes the passwords not-clear-text)?</p>
  
  <p>Any suggestions much appreciated.</p>