title: Adding a foreign server's self-signed certificate to the trusted certificates of my Tomcat
body: <p>My Tomcat needs to connect to <strong>another</strong> web server (at <a href="https://foreign.example.com" rel="noreferrer">https://foreign.example.com</a>) using SSL (TLS).</p>
  
  <p>foreign.example.com has a self-signed certificate, which I trust. Of course, my Tomcat does not by default - so I have to tell it. One way to do this is:</p>
  
  <pre><code>$JRE/bin/keytool -import -alias my -file ssl-cert-myselfsigned.cer -keystore 
   $JRE/lib/security/cacerts
  </code></pre>
  
  <p><em>This works</em>: My Tomcat allows the SSL connection.</p>
  
  <p>However, I <em>don't like to do it this way</em>: It imports the certificate into the trusted keys of my Java installation. I don't want to say: "Every application that runs Java on my machine should trust that certificate". Only Tomcat (or the user that runs Tomcat) should trust it.</p>
  
  <p>So I tried importing it into the tomcat-user's keystore at <code>~/.keystore</code>, and setting up Tomcat's <code>&lt;Connector&gt;</code> with these attributes:</p>
  
  <pre><code>keystoreFile="${user.home}/.keystore"
  keystorePass="thePassphraseICreatedTheKeystoreWith"
  </code></pre>
  
  <p>However, that doesn't work at all (I believe, this is only for the server certificate of my Tomcat, not for server certificates of foreign servers, right?)</p>
  
  <p>I tried the same with the <code>truststoreFile</code>/<code>truststorePass</code> attributes, but they didn't work either. (The attributes are documented at <a href="http://tomcat.apache.org/tomcat-6.0-doc/config/http.html" rel="noreferrer">http://tomcat.apache.org/tomcat-6.0-doc/config/http.html</a>)</p>
  
  <p>Is there a way to set up Tomcat with the foreign server's server cert, or maybe to add some command line parameters to <code>java</code> which makes my keystore (and keystore passphrase) available to the JVM instance?</p>