title: Set JRE to use Windows trust store, specifically the user's trust store
body: <p>Summary: Java option <code>-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT</code> allows Java to use the Windows trust store for the <em>computer account.</em> What option allows it to use the Windows trust store for the <em>user account</em>?</p>
  
  <p>We have a Java application that we run on our Windows clients. The application gets data from various sources, some of which use certificates that are not in the default <code>cacerts</code> file. </p>
  
  <p>When a user selects an item that accesses the external data, they are prompted to download the external site's certificate. Due to our security settings, the <code>cacerts</code> file is read-only for users. Because JRE can't import the cert into <code>cacerts</code>, the external isn't downloaded. And the user is prompted over and over to download the cert.</p>
  
  <p>When a user is given write access to <code>cacerts</code>, the issue doesn't occur. But our security team will not let us grant write access to that file to regular users. Their policy is that no files on the <code>C:</code> drive, outside the user's own profile, should be read-write. </p>
  
  <p>We thought we found a workaround to make Java use the Windows trust store. We added the flag <code>-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT</code> to the startup script. This forced Java to use the Windows trust store, which users can write to.</p>
  
  <p>Unfortunately, users can only write to their certificate store, not to the computer's certificate store. When we run the app as an administrator, the certificate is imported into the computer's store. After that, regular users are not prompted to download the cert. However, if we don't run it once with admin rights, the cert is not imported, because Java tries to write to the Windows <em>computer account</em> store, which is locked down just as tightly as <code>cacerts</code>.</p>
  
  <p>Is there a flag to force Java to use the entire Windows trust store, not just the computer account's store?</p>